[HSTG-23533] Fix open Dependabot alerts

[deividasma]

Fixes the 4 open Dependabot alerts (HSTG-23533).

Alert	Template	Package	Severity	Fix
#662 GHSA-8r5x-fm3f-whwj	api-reference	handlebars 4.7.9 (runtime, via hbs)	critical	override → 4.7.10
#663 GHSA-p8wg-vrv2-v86f	api-reference	handlebars 4.7.9	critical	override → 4.7.10
#661 GHSA-xw65-4hp5-5hc7	api-reference	handlebars 4.7.9	medium	override → 4.7.10
#664 GHSA-6qxp-vccf-f47h	sunday-league	@modelcontextprotocol/sdk 1.30.0 (dev, via @angular/cli)	high	@angular/cli ^21.2.0 → ^21.2.27 (pins 1.31.0)

Why an override for handlebars

RULES.md prefers bumping the parent package. hbs@4.3.1 is the latest release and still pins handlebars@4.7.9 exactly, so there's no parent bump to make. The override is documented in the template README, following the pattern from #40. Remove it once hbs ships a newer pin. Dependabot can't open this fix itself because of that exact pin.

sunday-league gets the parent bump: @angular/cli 21.2.26 and later pin @modelcontextprotocol/sdk@1.31.0. Its engines (^20.19.0 || ^22.12.0 || >=24.0.0) still cover the platform's Node 22.

Both lockfiles were regenerated with npm 10, as the Hostinger deploy platform requires.

Testing

• npm audit: api-reference has 0 vulnerabilities. sunday-league has 0 high/critical; one pre-existing moderate dev-only fast-uri finding remains, see below.
• api-reference: lint and build pass. I ran dist/main.js and requested / plus three /endpoints/* pages. All return 200 and render through hbs with handlebars 4.7.10. The homepage is byte-for-byte the same size as the live demo.
• sunday-league: lint and build pass on Angular CLI 21.2.27, and dist/sunday-league/browser serves / with 200.
• Same output as main: I built both templates from main and from this branch and compared them:
  • api-reference: I crawled every page on both servers (home, all 4 endpoint pages, /endpoints, the 404 page, query-string URLs), 9 in total. All are byte-for-byte identical on handlebars 4.7.9 and 4.7.10, covering all three .hbs views and both partials.
  • sunday-league: all 11 files in dist/sunday-league/browser have identical hashes. The bump only changes dev tooling, not what's served. The 17.3% / 11.1% screenshot diff in the preview comment is the same as on chore(deps): bump the security group across 13 directories with 8 updates #35 (CI's Linux rendering against the committed screenshots), not a change from this PR.
• Deploy platform: both lockfiles pass npm ci with npm 10 on Node 22.
• The Template preview CI runs the full install, lint, build, audit-regression, health and screenshot checks on both templates.

Advisories npm audit still reports

A repo-wide npm audit --package-lock-only also flags these. None needs action in this PR:

• braces GHSA-vfj7-8cjw-p6xm (high, dev-only, through eslint plugins and Nuxt): every version is affected and no patch exists. Dependabot auto-dismissed it (#618).
• node-forge GHSA-86w9-cpqp-85rv (high, Nuxt templates): every version is affected and no patch exists. Already dismissed as tolerable risk (#601).
• fast-uri GHSA-hrr3-gc8f-f4qj (moderate, dev-only): auto-dismissed (#611). A lockfile-only npm audit fix would clear it in about 20 templates if we want that later.

🤖 Generated with Claude Code

[github-actions]

Template preview

Built each changed template, opened npm run preview, requested /, then compared Playwright screenshots to the committed catalog images (preview/<id>-thumbnail.png at 1440×900 and preview/<id>-homepage.png full page).

Template	Install	Lint	Build	Audit	Health	Thumbnail diff	Homepage diff
api-reference	✅	✅	✅	✅ 2 resolved	✅	2.3% ✅	1.6% ✅
sunday-league	✅	✅	✅	✅	✅	17.3% ✅	11.1% ✅

api-reference

Expected thumbnail	Actual	Diff

sunday-league

Expected thumbnail	Actual	Diff

Download screenshots and diffs from this run’s visual-<template> artifacts.

This check fails if install, lint, build, / health, or screenshot diff over the limit fails, or if the PR introduces a high/critical advisory in production dependencies that the base commit did not have (npm audit --omit=dev, head vs base). Pre-existing advisories are listed for information and belong to dependency-update PRs. Limits default to 25% (thumbnail) and 30% (homepage) to absorb Mac-vs-Linux font rasterization.