fix: address dependency CVEs (handlebars, hbs, tar, serialize-javascript)#8543

Open

hectormmg wants to merge 12 commits into

devfrom

dependency-updates

Commits on Apr 23, 2026

Upgrade handlebars from 4.7.8 to 4.7.9

hectormmg
and
Copilot
committed
Upgrade hbs from 4.2.0 to 4.2.1

hectormmg
and
Copilot
committed
fix: address tar CVE by removing electron samples from workspaces and overriding tar to ^7.5.3

hectormmg
and
Copilot
committed
fix: upgrade @rollup/plugin-terser to v1 to address serialize-javascript CVE

hectormmg
and
Copilot
committed
refactor: move electron samples to electron/ subdirectory to restore workspace globs

hectormmg
and
Copilot
committed
chore: pin tar override to exact version 7.5.13

hectormmg
and
Copilot
committed
chore: regenerate package-lock preserving optional platform deps

hectormmg
and
Copilot
committed
chore: add beachball changefile for serialize-javascript CVE fix

hectormmg
and
Copilot
committed
fix: downgrade ts-jest-mock-import-meta lockfile entry to 1.3.1

hectormmg
and
Copilot
committed
fix: point 1P resource ref to dependency-updates branch for E2E CI

hectormmg
and
Copilot
committed
chore: revert 1P pipeline ref to dev; fix changefile comment

hectormmg
and
Copilot
committed

Commits on Apr 27, 2026

Merge branch 'dev' into dependency-updates
hectormmg
authored