[katsugtgz]

Updates handlebars to address 11 advisories: GHSA-2qvq-rjwj-gvw9, GHSA-2w6w-674q-4c4q, GHSA-3mfm-83xf-c92r, GHSA-442j-39wm-28r2, GHSA-7rx3-28cr-v5wh, GHSA-8r5x-fm3f-whwj, GHSA-9cx6-37pm-9jff, GHSA-p8wg-vrv2-v86f, GHSA-xhpv-hc6g-r9c6, GHSA-xjpj-3mr7-gcpf, GHSA-xw65-4hp5-5hc7.

Evidence:

• package.json referenced handlebars@4.7.7
• osv-scanner reported all 11 IDs against package-lock.json before the update
• updated version: 4.7.10 (also minimist 1.2.7 to 1.2.8, required by the new handlebars range)

Validation:

• osv-scanner no longer reports any handlebars advisory against package-lock.json
• npx tsc --noEmit -p tsconfig.json passes
• runtime smoke test: require('handlebars') at 4.7.10 compiles and renders a template
• the full npm run test suite needs a postgres and redis instance, which I could not run here

Scope: dependency pins and lockfile entries only.

Summary by CodeRabbit

• Chores
  • Updated the application’s underlying template-rendering support to a newer version. No user-facing features or behavior changes are specified for this update.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 837f2ffb-5a61-4a47-9691-fdd56bfb15ba

---

📥 Commits

Reviewing files that changed from the base of the PR and between 686a7da and 0474c48.

---

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

---

📒 Files selected for processing (1)

• package.json

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

Walkthrough

The handlebars dependency in package.json changes from version 4.7.7 to 4.7.10.

Changes

Handlebars Dependency Update

Layer / File(s)	Summary
Update Handlebars version package.json	The declared handlebars dependency version changes from 4.7.7 to 4.7.10.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 0474c

No actionable merge-blocking issue is identified in this dependency update; the full test suite remains unrun because PostgreSQL and Redis were unavailable.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: upgrading the handlebars dependency from 4.7.7 to 4.7.10.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{A rabbit checks the package line,
A newer Handlebars version shines.
From seven-seven to seven-ten,
The little change is noted then.
Hop by hop, the list is right.}

_{Comment @coderabbitai help to get the list of available commands.}