fix(deps): handlebars@4.7.9 carries three critical advisories, arrived with the ts-jest bump #1306

Note: this is an in-house item already being handled by the maintainer and is not available for community pickup. Filed for tracking only.

Our own self-scan is reporting three critical advisories against handlebars@4.7.9, visible on the Security tab as open Code Scanning alerts.

• GHSA-8r5x-fm3f-whwj
• GHSA-p8wg-vrv2-v86f
• GHSA-xw65-4hp5-5hc7

All three are fixed in 4.7.10.

How it got here

#1305, a Self Fix PR, upgraded ts-jest to clear one medium advisory. The newer ts-jest brings in handlebars@4.7.9, which carries these three criticals. So the automated fix resolved one medium and introduced three criticals, and nothing flagged that trade at the time.

That is worth more than this one bump: a Self Fix PR is not currently scanned against its own result before it merges, only on the next scheduled self-scan afterwards. Filed separately as a follow-up thought rather than conflated here.

The fix

No version bump anywhere. ts-jest declares handlebars: ^4.7.9, which already permits 4.7.10, so only the lockfile moves. This is the within-range case our own output describes as ts-jest already permits handlebars@4.7.10.

Success criterion

cve-lite . --no-cache reports zero critical and zero high. The one remaining medium is sprintf-js@1.0.3, transitive through jest and genuinely unfixable, since 1.1.3 is the newest published version and carries the same advisory.