fix: upgrade handlebars to 4.7.9 to resolve critical security vulnerabilities#15
Conversation
… CVEs Add npm overrides to force handlebars to ^4.7.9, resolving 8 CVEs affecting all 4.0.0-4.7.8 versions (GHSA-2w6w-674q-4c4q critical, GHSA-3mfm-83xf-c92r high, GHSA-3mfm-83xf-c92r, and others). The vulnerable version was introduced via the conventional-changelog-writer transitive dependency. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
@treycucco I added you as reviewer as I wanted to check with you, since dependabot already opened a similar PR here - #14 - but didn't update the overrides. Are they necessary here or is the package lock change enough? |
|
Good q. Lots of times the package that depends on the vulnerable package has a range specifier that includes the fix, so you can update package-lock only to the newest version. The nice thing about adding the overrides is it makes sure that we don't ever see the problem again. Either approach is fine, I personally like to do a package-lock only update when possible, but adding overrides gives us some extra security in the unlikely event that a newer package were to specify the problem package exactly. |
| "yaml-lint": "^1.7.0" | ||
| }, | ||
| "overrides": { | ||
| "handlebars": "^4.7.9" |
There was a problem hiding this comment.
I prefer to see a vulnerability range specifier. Specifying the range of vulnerable packages that should update handlebars can protect us against things in the future being downgraded unexpected
Narrow the handlebars override to the vulnerable range (>=4.0.0 <4.7.9) so npm only applies the resolution when the affected versions are requested. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2 participants
Summary
overridesentry to forcehandlebarsto^4.7.9, resolving all known CVEs in the4.0.0 – 4.7.8rangeconventional-changelog-writer(used bysemantic-release)npm auditno longer reports any handlebars vulnerabilitiesVulnerabilities fixed
Test plan
npm auditreports no handlebars vulnerabilities after checkout🤖 Generated with Claude Code