[teallarson]

Linear: ENGTOP-356

What changed and why

handlebars is resolved in only one place: as a transitive dev dependency through ts-jest. The repo has a single package (no workspace packages) and a single lockfile (pnpm-lock.yaml). The resolved copy was 4.7.9, which is affected by CVE-2026-106445 and CVE-2026-106446.

I upgraded the parent package instead of adding an override:

• package.json: ts-jest ^29.1.0 → ^29.4.15. 29.4.15 is the first ts-jest release that requires handlebars: ^4.7.10 (29.4.7–29.4.14 require ^4.7.9). It was published 2026-10-15, so it clears the workspace's minimumReleaseAge: 1440 gate.
• pnpm-lock.yaml: regenerated with pnpm install (pnpm 10.30.1, as pinned in packageManager). The lockfile changes are ts-jest 29.4.6 → 29.4.15 and handlebars 4.7.9 → 4.7.10, plus the new transitive versions those releases need: minimist 1.2.8 for handlebars, semver 7.8.5 for ts-jest.

No new overrides were added. The existing override handlebars@>=4.0.0 <4.7.9: '>=4.7.9' was left alone. ts-jest's ^4.7.10 range already excludes 4.7.9.

handlebars versions per lockfile

Lockfile	Before	After
pnpm-lock.yaml	4.7.9 (via ts-jest 29.4.6)	4.7.10 (via ts-jest 29.4.15)

$ rg -n handlebars pnpm-lock.yaml
12:  handlebars@>=4.0.0 <4.7.9: '>=4.7.9'
1185:  handlebars@4.7.10:
3321:  handlebars@4.7.10:
4157:      handlebars: 4.7.10

$ pnpm why handlebars
handlebars@4.7.10
└─┬ ts-jest@29.4.15
  └── @arcadeai/arcadejs@2.4.1 (devDependencies)
Found 1 version of handlebars

Checks run (locally, Node 22.23.3, pnpm 10.30.1)

• pnpm install --frozen-lockfile: pass
• ./scripts/lint (eslint, build, tsc, attw, publint): pass ("Types ok!", publint "All good!")
• ./scripts/build: pass
• ./scripts/test (jest against the Steady mock server): pass. 22/22 suites, 395/395 tests, 3/3 snapshots.
• knip: not configured in this repo, so it wasn't run.
• ./scripts/format: this check fails, and the failure was already there before this change. It runs prettier --write, which reformats all of package.json and pnpm-lock.yaml. prettier --check fails on those two files on unmodified main as well, and CI doesn't run the format script. I left that reformatting out of this PR to keep it scoped. The script made no other changes.

Not addressed here: pnpm audit still reports 5 unrelated advisories (2 moderate, 3 high). They're out of scope for ENGTOP-356.

— Strider 🐦‍⬛, Teal's agent · approved by Teal

  

---

Note

Low Risk
Dev-only test tooling and lockfile resolution changes; no runtime or application code is modified.

^{Reviewed by Cursor Bugbot for commit 8194634. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sdserranog]

Is this still using Stainless? They had a really specific ways of merging things.

[teallarson]

@sdserranog do you want to take this issue? I have no context on this repo 💀

[sdserranog]

@teallarson I can take it 😄

[sdserranog]

@teallarson this was good to go haha.