Skip to content

fix: [handlebars] Upgrade handlebars from 4.0.14 to 4.7.9 to resolve SNYK-JS-HANDLEBARS-534988 (Prototype Pollution) #224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hannahhuh-cog wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: [handlebars] Upgrade handlebars from 4.0.14 to 4.7.9 to resolve SNYK-JS-HANDLEBARS-534988 (Prototype Pollution) #224

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
130 changes: 45 additions & 85 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,5 +53,8 @@
"nodemon": "^2.0.7",
"snyk": "^1.244.0"
},
"license": "Apache-2.0"
"license": "Apache-2.0",
"overrides": {
"handlebars": "4.7.9"
}
Comment on lines +57 to +59

@devin-ai-integration devin-ai-integration Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Lockfile missing overrides breaks npm ci

package.json adds an overrides block, but the lockfile root packages[""] records no matching overrides field, so the two are out of sync. npm ci compares the overrides and aborts with an EUSAGE error, breaking clean and CI installs.

Prompt for agents 
The package.json now declares an overrides block for handlebars, but package-lock.json was not truly regenerated by npm: the lockfile root object packages[""] has no overrides field. When npm regenerates a lockfile (lockfileVersion 2/3) with overrides present, it writes the overrides into packages[""]. Its absence means npm ci will detect package.json and package-lock.json as out of sync and fail. Regenerate the lockfile with a real npm install (npm install --package-lock-only) using an npm version that supports overrides (>=8.3), and commit the result so packages[""] includes the overrides entry.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified locally — npm ci is not broken by this.

I regenerated the lockfile with npm install --package-lock-only on npm 10.8.2. This repo's lockfile is lockfileVersion: 2 (hybrid v1/v2), and npm did not write an overrides key into packages[""] — but it did resolve the overridden version in the tree, and npm only enforces the overrides-sync check when the lockfile records one.

Evidence, from a clean checkout of just package.json + package-lock.json on this branch:

$ npm ci --ignore-scripts
added 947 packages in 5s
$ node -e "console.log(require('handlebars/package.json').version)"
4.7.9

No EUSAGE error. Leaving the lockfile as npm generated it.

Comment on lines +57 to +59

@devin-ai-integration devin-ai-integration Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 hbs forced from exact handlebars 4.0.14 to 4.7.9

hbs@4.0.4 pins an exact handlebars@4.0.14; the override forces 4.7.9. Handlebars 4.x is broadly compatible, but hbs was never tested against 4.7.9, so a runtime smoke test of view rendering is warranted.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smoke-tested hbs against the forced handlebars@4.7.9 from this branch's lockfile:

handlebars 4.7.9
compile('Hello {{name}}!')({name:'world'}) -> "Hello world!"
views/account.hbs  -> rendered, 890 chars
views/layout.hbs   -> rendered, 482 chars

No API breakage from hbs's pinned 4.0.14 to 4.7.9.

}
Loading