fix(security): bump handlebars to >=4.7.9 (Socket.dev critical CVE)

@zen-agentchecks n/achecks…zen/socket-fix-handlebars-gb46bl → main2 files · +7 −5updated 3w ago

▸Description· 1 comment · 3 noise

Description

Patches SOCKET-COMPOSIO-864 (Critical) by adding a pnpm.overrides entry pinning handlebars to >=4.7.9:

Socket alert	CVE	GHSA	Severity	Patched in
`SOCKET-COMPOSIO-864`	`CVE-2026-33937`	`GHSA-2w6w-674q-4c4q`	Critical	`4.7.9`

handlebars@<4.7.9 has a JavaScript Injection vulnerability via AST Type Confusion (RCE).

Why an override

handlebars is a transitive dep pulled in by @hey-api/openapi-ts@0.77.0 (via apps/web's OpenAPI-types generation step). No direct source-code imports of handlebars in this repo, so the cleanest fix is a pnpm.overrides entry following the same pattern as the existing tar, axios, next, preact, etc. pins in package.json.

How did I test this PR

BYPASS_BUN_VERSION_CHECK=1 pnpm install --frozen-lockfile --lockfile-only — passes cleanly. Lockfile diff is 3 handlebars references + 1 overrides: entry (no peer-dep churn).
socket scan create . --view --report --org composio (scan id b6f95447-8460-4108-a008-f560f990521d) — zero handlebars alerts in the new report. Other unrelated alerts (picomatch, sanitize-html, defu, path-to-regexp, drizzle-orm, …) remain and are out of scope for this PR.

Origin: cron-f7c85f82906b / zen-cron-6352a6575b74 Triggered by: saransh@composio.dev | Source: Socket.dev Vulnerability Auto-Fix Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74

@zen-agent3w ago

CI status update

Check	Status	Notes
`Snippets Typecheck`	✅ success	clean
`Lint`	✅ success	clean
`PR #933` (CodeQL)	✅ success	clean
`Playwright Tests` (initial run)	❌ failure	flaky E2E tests in `e2e/tests/link/oauth-flow.spec.ts` and `mobile-responsive.spec.ts` — unrelated to a transitive handlebars override (no handlebars imports in those flows). Re-running failed jobs.
`Playwright Tests` (re-run)	🔄 in progress	shards 1/4, 2/4, 3/4 already passed; shard 4/4 still running

The change is dependency-only (handlebars@4.7.8 → handlebars@4.7.9 via pnpm.overrides). No source code modified, and the failing E2E test files (oauth-flow, mobile-responsive) don't import handlebars directly. pnpm install --frozen-lockfile passes; socket scan create . --view --report --org composio (scan b6f95447-8460-4108-a008-f560f990521d) reports zero handlebars alerts.

Origin: cron-f7c85f82906b / zen-cron-6352a6575b74

▸ 3 bot/status comments hidden

@vercel[bot]3w ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
platform-frontend	Ready	Preview, Comment	May 20, 2026 9:52am

@github-actions[bot]3w ago

Playwright Test Results

📊 View HTML Report

Tests completed in parallel shards.

@github-actions[bot]3w ago

Playwright Test Results

📊 View HTML Report

Tests completed in parallel shards.

loading diff…

@zen-agent3w ago

CI status update

Check	Status	Notes
`Snippets Typecheck`	✅ success	clean
`Lint`	✅ success	clean
`PR #933` (CodeQL)	✅ success	clean
`Playwright Tests` (initial run)	❌ failure	flaky E2E tests in `e2e/tests/link/oauth-flow.spec.ts` and `mobile-responsive.spec.ts` — unrelated to a transitive handlebars override (no handlebars imports in those flows). Re-running failed jobs.
`Playwright Tests` (re-run)	🔄 in progress	shards 1/4, 2/4, 3/4 already passed; shard 4/4 still running

Origin: cron-f7c85f82906b / zen-cron-6352a6575b74