From 5d46e502f8a58e6c457a1288c910c41ac0145b73 Mon Sep 17 00:00:00 2001 From: Sphia Sadek Date: Mon, 12 Oct 2026 13:31:11 +0000 Subject: [PATCH] fix(deps): clear the handlebars osv advisories GHSA-8r5x-fm3f-whwj (9.8), GHSA-p8wg-vrv2-v86f (9.2) and GHSA-xw65-4hp5-5hc7 (4.7), published 2026-10-08, affect handlebars through 4.7.9; 4.7.10 fixes all three. Add a `resolutions` floor and re-resolve only that yarn.lock entry. handlebars is transitive through ts-jest (`^4.7.9`), so 4.7.10 stays inside its range; minimist's lockfile key moves to `^1.2.8` with its version unchanged. Not in jira-forge-app's lockfile. Co-Authored-By: Claude Opus 5.5 --- package.json | 1 + yarn.lock | 12 ++++++------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 4fa83a2b..8250169f 100644 --- a/package.json +++ b/package.json @@ -28,6 +28,7 @@ "devalue": "^5.9.3", "fast-uri": "^3.1.8", "fast-xml-parser": "^5.7.0", + "handlebars": "^4.7.10", "http-cache-semantics": "^4.3.0", "ip-address": "^10.5.1", "js-yaml": "^4.3.2", diff --git a/yarn.lock b/yarn.lock index b8161b63..3a667602 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5526,12 +5526,12 @@ h3@^1.15.10: ufo "^1.6.3" uncrypto "^0.1.3" -handlebars@^4.7.9: - version "4.7.9" - resolved "https://registry.yarnpkg.com/handlebars/-/handlebars-4.7.9.tgz#6f139082ab58dc4e5a0e51efe7db5ae890d56a0f" - integrity sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ== +handlebars@^4.7.10, handlebars@^4.7.9: + version "4.7.10" + resolved "https://registry.yarnpkg.com/handlebars/-/handlebars-4.7.10.tgz#12419ea1b41391b3ffcf003f2164dcbce090c417" + integrity sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg== dependencies: - minimist "^1.2.5" + minimist "^1.2.8" neo-async "^2.6.2" source-map "^0.6.1" wordwrap "^1.0.0" @@ -7429,7 +7429,7 @@ minimatch@^9.0.4: dependencies: brace-expansion "^2.0.2" -minimist@^1.2.5: +minimist@^1.2.8: version "1.2.8" resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.8.tgz#c1a464e7693302e082a075cee0c057741ac4772c" integrity sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==