Repository navigation
CICD-5561: bump handlebars 4.7.8 -> 4.7.9 - #16
Merged
Merged
Conversation
Patches the vulnerabilities reported for handlebars-4.7.8 (alert orca-158035636). package.json already declares "^4.7.8", which admits 4.7.9, so this is a lockfile refresh only - no manifest change and no range tightening. Refreshed with 'npm update handlebars --lockfile-version=2' to keep the lockfile at version 2 and avoid unrelated churn.
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Secrets |  0  0  0  0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
|
hagitshomrony-orca
approved these changes
Sep 2, 2026
dekelattias-orca
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps
handlebars4.7.8 → 4.7.9 inpackage-lock.json.Fixes CICD-5561 (Orca alert orca-158035636).
Why this is a lockfile-only change
package.jsonalready declares"handlebars": "^4.7.8"as a direct dependency, and that caret range already admits 4.7.9 — the lockfile just hadn't been regenerated. So there is no manifest edit and no range tightening (^4.7.8is left as-is deliberately; narrowing it adds churn without adding protection).4.7.9 is the current
lateston npm and the only published version above 4.7.8 — a single patch step within the same minor, no major crossing.Refreshed with
npm update handlebars --lockfile-version=2(rather thannpm install handlebars@4.7.9) so that:package.jsonis not rewritten, andlockfileVersion: 2instead of being migrated to v3, which would have turned a 7-line diff into thousands.No
dist/rebuild is needed — this is a Docker-based action anddist/is built inside the container at runtime (npm run build --if-presentinentrypoint.sh); there is no committed bundle to regenerate.Verification
Run locally on this branch:
npm ci— succeeds. This is the install path theDockerfileuses, so it confirms the lockfile is in sync withpackage.json. (unit-tests.ymlusesnpm install, which would not catch a desync.)npm ls handlebars→handlebars@4.7.9npm run lint— cleannpm test— 14/14 pass.src/summary.jsis the only handlebars consumer.npm audit— handlebars no longer appears.On this PR,
test-secrets-action.yamlandtest-secrets-action-sarif.yamlboth build the action image viauses: ./and run a real scan, exercisingsrc/summary.jsend to end.Remaining
npm auditfindings (js-yaml,minimatch,picomatch) are dev-dependency-only and out of scope for this ticket.Note
Because the README pins consumers to
@v1, thev1tag needs to be re-pointed after release for this fix to actually reach anyone.