[mtrezza]

Closes #624

Bumps the transitive dev dependency handlebars from 4.7.9 to 4.7.10 (lock file only).

This is a security update for a development-only dependency. It resolves GHSA-p8wg-vrv2-v86f (critical), GHSA-8r5x-fm3f-whwj (critical) and GHSA-xw65-4hp5-5hc7 (medium), which affect handlebars <= 4.7.9 and are patched in 4.7.10. handlebars is only required by conventional-changelog-writer@8.0.0 (via @semantic-release/commit-analyzer and @semantic-release/release-notes-generator) to render release notes. It is not in the production dependency tree, so this does not trigger a release.

Changes

• 4.7.10:
  • Security: Sanitize the source map URL when minifying (handlebars-lang/handlebars.js@f37c599)
  • Security: Iterate lazily in #each and strip whitespace in linear time (handlebars-lang/handlebars.js@812c226)
  • Security: Escape <!-- and <script in precompiled output, GHSA-xw65-4hp5-5hc7 (handlebars-lang/handlebars.js@609d1b1)
  • Security: Don't trust special properties on context data, GHSA-p8wg-vrv2-v86f (handlebars-lang/handlebars.js@ceec388)
  • Security: Only compile partials that are template strings (handlebars-lang/handlebars.js@c28ee7a)
  • Security: Only dispatch known node types in the Compiler and Visitor (handlebars-lang/handlebars.js@7d501a5)
  • Security: Validate AST values in the compiler instead of the parser, GHSA-8r5x-fm3f-whwj (handlebars-lang/handlebars.js@703fdcc)
  • Raise the minimist range to ^1.2.8 (handlebars-lang/handlebars.js@ea8ed82). The lock file already resolves minimist to 1.2.8, so no other entries change.
  • Compatibility note: {{#each}} now iterates non-array iterables (Map, Set, generators) lazily instead of copying them into an array first.

Lock file diff: only the node_modules/handlebars entry changes (version, resolved, integrity, and its own minimist range ^1.2.5 → ^1.2.8).

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement.

conventional-changelog-writer@8.0.0 registers the partials as strings, compiles with noEscape: true and only passes arrays to #each, so none of the changed code paths affect it. The repository's release templates (.releaserc/*.hbs, as configured in .releaserc.js) were rendered through @semantic-release/release-notes-generator@14.1.1 with the lock file's toolchain versions on handlebars 4.7.9 and 4.7.10 for patch, minor, major (with notes), first-release and prerelease scenarios. The output was byte-identical.

Summary by CodeRabbit

• Chores
  • Updated a package version and its dependency range.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 47288a6a-6d72-4032-b4da-2867b2cb6a8b

📥 Commits

Reviewing files that changed from the base of the PR and between d18eb77 and 676276e.

📒 Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Walkthrough

The lockfile updates Handlebars from 4.7.9 to 4.7.10. It also updates the package’s archive URL, integrity hash, and minimist dependency range.

Changes: Dependency update

Layer / File(s)	Summary
Update locked Handlebars version package-lock.json	The lockfile changes Handlebars to version 4.7.10 and updates its archive URL, integrity hash, and minimist requirement from ^1.2.5 to ^1.2.8.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 67627

The lockfile update is mergeable with no unresolved actionable risk.

Pre-merge checks: 7

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title starts with the allowed refactor: prefix, uses a capitalized first word, and accurately describes the Handlebars dependency update.
Linked Issues check		Issue #624 requires Handlebars 4.7.9 to be bumped to 4.7.10. The whole-PR diff changes node_modules/handlebars in package-lock.json to version 4.7.10, updates its resolved archive and integrity, a…
Out of Scope Changes check		The whole-PR diff contains only the expected package-lock.json entry for handlebars. It changes the requested version, archive metadata, integrity value, and transitive minimist range. No unrela…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check		PASS: The pull request changes only package-lock.json. It replaces the transitive dev-only handlebars package from 4.7.9 to 4.7.10, updates its integrity data, and raises minimist to ^1.2.8. The chang…
Engage In Review Feedback		No review feedback comments or actionable findings were supplied. Therefore, no feedback was available for the contributor to engage, implement, or discuss.

Full details: Linked Issues check

Explanation

Issue #624 requires Handlebars 4.7.9 to be bumped to 4.7.10. The whole-PR diff changes node_modules/handlebars in package-lock.json to version 4.7.10, updates its resolved archive and integrity, and raises its minimist range to ^1.2.8. The PR changes the dependency lock entry that supplies the requested upstream security fixes. No application-code change is required by the issue.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff contains only the expected package-lock.json entry for handlebars. It changes the requested version, archive metadata, integrity value, and transitive minimist range. No unrelated source, configuration, or dependency changes are present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

PASS: The pull request changes only package-lock.json. It replaces the transitive dev-only handlebars package from 4.7.9 to 4.7.10, updates its integrity data, and raises minimist to ^1.2.8. The changed dependency entry is marked dev:true, and no application code or new security-sensitive pattern is introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.77%. Comparing base (d18eb77) to head (676276e).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #629   +/-   ##
=======================================
  Coverage   97.77%   97.77%           
=======================================
  Files           2        2           
  Lines         225      225           
=======================================
  Hits          220      220           
  Misses          5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.