[Snyk] Security upgrade handlebars from 4.0.11 to 4.7.9

[ryanmcmorrowsnyk]

Snyk has created this PR to fix 5 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803084	370
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803082	341
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803086	243
	Improper Check for Unusual or Exceptional Conditions SNYK-JS-HANDLEBARS-15807042	227
	Improper Encoding or Escaping of Output SNYK-JS-HANDLEBARS-15807040	223

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Access of Resource Using Incompatible Type ('Type Confusion')
🦉 Access of Resource Using Incompatible Type ('Type Confusion')
🦉 Improper Encoding or Escaping of Output

[ryanmcmorrowsnyk]

This upgrade of Handlebars contains security fixes that introduce potentially breaking behavioral changes, primarily around template compilation and property access.

Key Changes:

• Prototype Property Access Blocked: To prevent prototype pollution vulnerabilities, versions from 4.6.0 onwards block access to object prototype properties from within templates by default. The release notes describe this as a breaking change, but state it should only impact applications relying on undocumented features. Standard template usage should not be affected.

• Precompiled Template Incompatibility: Templates precompiled with a Handlebars version before 4.3.0 are not compatible with the runtime of version 4.3.0 and later. This is due to an internal change in how missing helpers are handled.

Recommendation:
Before merging, verify the following:

1. Your templates do not rely on accessing object prototype properties.
2. If you use precompiled templates, ensure they are recompiled with the new handlebars@4.7.9 compiler as part of your build process.

Source: Handlebars Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.