build: upgrade semantic-release to 25 and clear handlebars advisory

[chhoumann]

Summary

Modernizes the release/dependency tooling, isolated from the build/runtime migration (#118, Phase 3):

• Bump semantic-release ^20.1.1 -> ^25.0.5 (devDependency).
• Add pnpm.overrides.handlebars: "^4.7.9" to clear a batch of handlebars advisories the dependency-review gate fails on.

Only package.json and pnpm-lock.yaml change. No src/, Svelte, tsconfig, Rollup, or workflow changes.

Why

semantic-release 20 is several majors behind. This brings it to current (25.0.5) and removes the one pre-existing dev-tooling advisory (handlebars 4.7.8) that the moderate+ dependency-review gate would flag once the lockfile is touched. Releases are manual (workflow_dispatch), so nothing here auto-triggers a release.

Compatibility verification

• @semantic-release/git@10.0.1 kept as-is - its peer range is semantic-release: ">=18.0.0", which sr25 satisfies. No newer major exists; no bump needed.
• Bundled plugins auto-resolved to their sr25-compatible majors: commit-analyzer@13.0.1, release-notes-generator@14.1.1, npm@13.1.5, github@12.0.8.
• Node: sr25 requires ^22.14.0 || >=24.10.0. CI/Release run Node 24 (check-latest: true), so the release job satisfies it. The plugin's own engines.node (>=20.18.1) is left untouched - it describes the runtime to use the plugin and is independent of the dev-only release toolchain.

semantic-release dry-run proof

npx semantic-release --dry-run --no-ci (repo config, no overrides) runs clean under 25.0.5 - all five plugins load, verifyConditions for npm/git/github pass, and it correctly reports no release because the PR branch is not master:

ℹ  Running semantic-release version 25.0.5
✔  Loaded plugin "verifyConditions" from "@semantic-release/npm" | "@semantic-release/git" | "@semantic-release/github"
✔  Loaded plugin "analyzeCommits" from "@semantic-release/commit-analyzer"
✔  Loaded plugin "generateNotes" from "@semantic-release/release-notes-generator"
ℹ  This test run was triggered on the branch chhoumann/118p3-release-deps, while semantic-release is
   configured to only publish from master, therefore a new version won't be published.

Re-running with the (now-pushed) branch treated as the release branch proves version computation is sane (all side-effecting steps skipped in dry-run):

ℹ  Found git tag 1.8.4 associated with version 1.8.4
ℹ  Found 14 commits since last release
[@semantic-release/commit-analyzer] ℹ  Analysis of 14 commits complete: minor release
ℹ  The next release version is 1.9.0
⚠  Skip 1.9.0 tag creation in dry-run mode
⚠  Skip step "publish" of plugin "@semantic-release/github" in dry-run mode

Verified no side effects: no 1.9.0 tag (local or remote), GitHub releases still top out at 1.8.4.

handlebars advisory + override rationale

handlebars is dev/build-time only (pulled via conventional-changelog-writer); pnpm why --prod handlebars is empty and the sole runtime dependency remains @popperjs/core. handlebars <= 4.7.8 carries multiple advisories, all patched in 4.7.9:

• GHSA-2w6w-674q-4c4q - critical - JS injection via AST type confusion
• GHSA-7rx3-28cr-v5wh - moderate - prototype method access control gap
• GHSA-2qvq-rjwj-gvw9 - moderate - prototype pollution -> XSS
• plus several high (GHSA-xjpj-3mr7-gcpf, GHSA-xhpv-hc6g-r9c6, GHSA-9cx6-37pm-9jff, GHSA-3mfm-83xf-c92r)

The override moves the tree to a single handlebars@4.7.9 node (confirmed via pnpm why handlebars and lockfile). It is needed because the sr20->25 bump changes handlebars' parent, so without pinning, handlebars could re-resolve as a changed node at 4.7.8 and trip the gate.

dependency-review gate analysis

The gate fails only on newly-introduced moderate+ advisories. I diffed the master lockfile against the regenerated one (131 packages added, 147 removed) and intersected the added package@version set with the GitHub Advisory DB (pnpm audit):

• 0 of the added nodes carry any advisory. Every flagged module in the dev tree (lodash, lodash-es, svelte, vite, etc.) is pre-existing on master at an identical version.
• handlebars 4.7.8 is removed and 4.7.9 added (a vuln removal, not an introduction).

So the bump introduces no new advisories and clears the handlebars one.

Validation

Check	Result
pnpm install --frozen-lockfile	pass
pnpm run build	pass
pnpm run test	200/200 pass
pnpm run lint	0 errors (11 pre-existing .svelte/logger warnings, untouched)
pnpm why --prod handlebars	empty (dev-only)

Risk / rollout

Dev-tooling only; no runtime or source changes. The Release workflow is manual, so this does not auto-trigger a release. Lockfile is regenerated and passes --frozen-lockfile.

Refs #118

[github-actions]

🎉 This PR is included in version 1.9.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀