[PMerlet]

👋 First-level support: see Handling automated security PRs for how to triage and merge this PR.

Summary

2 fixed, 2 ignored, 1 deferred, 0 security pins added, 0 security pins removed, 0 could-not-auto-fix. | label: 🔒 security applied

Fixed

Done	Alert	Gem	Ecosystem	From → To	Severity	What was bumped
- [ ]	#139	handlebars	npm	4.7.9 → 4.7.10	critical	Added root resolutions entry "handlebars": "^4.7.10" in package.json — the gem is transitive via semantic-release → @semantic-release/commit-analyzer → conventional-changelog-writer, which still constrains to ^4.x, so yarn now resolves 4.7.10.
- [ ]	#140	handlebars	npm	4.7.9 → 4.7.10	medium	Same bump as #139 — both advisories are patched in handlebars 4.7.10.

Ignored

Dismissed	Alert	Gem	Ecosystem	Severity	Reason
- [ ]	#136	braces	npm	high	No upstream patch exists yet (first_patched_version is null for braces <= 3.0.3). Will be reconsidered once an upstream fix ships.
- [ ]	#137	http-cache-semantics	npm	high	No upstream patch exists yet (first_patched_version is null for http-cache-semantics <= 4.2.0). Will be reconsidered once an upstream fix ships.

Deferred

• #141 — handlebars (critical). Created 2026-10-14, within the 7-day age gate; the fix in this PR (handlebars 4.7.10) already closes the vulnerable range this alert covers, so it is expected to auto-close when the PR merges. If it does not, the next run will pick it up.

Risks

• handlebars 4.7.9 → 4.7.10 — pure security patch within the 4.7.x line (CVEs addressing property-check / AST-type-confusion injection paths). No API changes; the gem is used only by semantic-release's changelog generation during release, which runs CI-side, not in any published Ruby gem. No behavior change beyond the patched vuln is expected.

Manual testing

Covered by CI.

Validation

✅ CI green (Actions + commit statuses; app-based checks not monitored)

Note

Patch 2 Dependabot alerts by pinning handlebars to ^4.7.10

Adds handlebars at ^4.7.10 as a direct dependency in package.json and updates yarn.lock to match. The pinned version is the patched release that resolves the Dependabot security alerts.

^{Macroscope summarized c4b16f6.}

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[forest-bot]

🎉 This PR is included in version 1.46.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀