fix(deps): bump handlebars 4.7.8 → 4.7.9 (CVE-2026-33937)

[gyermich]

Security Fix

Bumps `handlebars` from 4.7.8 → 4.7.9 to resolve a critical security vulnerability.

Vulnerability

CVE-2026-33937 — Handlebars.js JavaScript Injection via AST Type Confusion

• Severity: Critical (CVSS 9.8)
• Advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-33937
• Affected: `handlebars >= 4.0.0, <= 4.7.8`
• Fixed in: `handlebars >= 4.7.9`

What changed

handlebars is a transitive dependency pulled in by semantic-release → conventional-changelog-writer@7.0.1, which specifies handlebars: "^4.7.7". That range already covers 4.7.9 - the lockfile was stale at 4.7.8. Only pnpm-lock.yaml needed updating, no package.json changes are required.

Verified with pnpm why handlebars:

└── handlebars 4.7.9

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.13%. Comparing base (da78d4d) to head (fb72396).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #164   +/-   ##
=======================================
  Coverage   80.13%   80.13%           
=======================================
  Files          44       44           
  Lines         589      589           
  Branches      111      111           
=======================================
  Hits          472      472           
  Misses         77       77           
  Partials       40       40           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🎉 This PR is included in version 2.3.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀