[dependabot]

Bumps handlebars to 4.7.10 and updates ancestor dependency verdaccio. These dependencies need to be updated together.

Updates handlebars from 4.7.9 to 4.7.10

Release notes

Sourced from handlebars's releases.

v4.7.10

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Commits

• 45ce152 v4.7.10
• e47b236 Update release notes
• f37c599 Sanitize the source map URL when minifying
• 812c226 Iterate lazily in #each and strip whitespace in linear time
• 609d1b1 Escape <!-- and <script in precompiled output
• ceec388 Don't trust special properties on context data
• c28ee7a Only compile partials that are template strings
• 7d501a5 Only dispatch known node types in the Compiler and Visitor
• 703fdcc Validate AST values in the compiler instead of the parser
• 0fcf25c Clarify that --root does not restrict filesystem access
• Additional commits viewable in compare view

Updates verdaccio from 6.9.2 to 6.10.6

Release notes

Sourced from verdaccio's releases.

v6.10.6

Patch Changes

• 56b6a85: Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.

  The production installation now uses npm's --ignore-scripts and --min-release-age=3 options. Verdaccio and packages matching @verdaccio/* or verdaccio-* are excluded from the age restriction so new Verdaccio releases can be built immediately. The final stage updates npm to support these exclusions and disables installation audit and funding output. Image builds still fail if another required dependency has no eligible version. No configuration changes are required for operators.

• db47d78: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.34 → 9.0.0-next-9.36

• fdbfef9: Improve request validation when changing passwords and signing in through the web API.

  Password changes validate the supplied credential fields before invoking the authentication plugin. Existing passwords remain eligible for replacement even when they do not meet the current policy. The existing validation for new passwords and authentication plugin error handling remain unchanged. No configuration changes are required.

  Web sign-in requests now validate the supplied credential fields the same way as password changes. Requests that omit the username or password, send either with a type other than a string, or send a null body are rejected with HTTP 400 and the message username and password is required; a null body previously failed with an internal server error (HTTP 500), and the other cases reached the authentication plugin. Empty strings are still passed to the authentication plugin, which rejects them as before. The web UI always sends both fields, so signing in from it is unaffected.

  This release also updates the internal @verdaccio/* modules and the bundled verdaccio-htpasswd and verdaccio-audit plugins to their latest 6.x-compatible versions. The shared password validator now accepts input of any type and rejects anything that is not a string, and the webhook notification templates use Handlebars 4.7.10, which includes a security fix. proxy-addr, which Express uses to resolve client addresses when server.trustProxy is configured, is updated to 2.0.8, which includes a security fix for trusted-subnet matching of IPv4-mapped IPv6 addresses.

• abced78: npm whoami and any other request to /-/whoami now answer 401 Unauthorized when the request carries no credentials or a token Verdaccio does not recognise.

  Until now the endpoint answered 200 with an empty body {} for anonymous requests, so clients that check the status code, rather than the username field, treated an expired or wrong token as a valid login. The npm public registry and Verdaccio 7 answer 401 in that case, and this release aligns 6.x with them. Requests with a valid token are unchanged and still return { "username": "<name>" }. No configuration change is required.

  This release also updates the internal @verdaccio/* modules to their latest 8.x patches. @verdaccio/core 8.3.3 corrects the input type of the shared password validator, without changing which passwords are accepted. @verdaccio/hooks 8.1.7 brings handlebars 4.7.10, which fixes several template injection advisories in the library that renders notification templates.

  proxy-addr, used by Express to decide which proxies are trusted when X-Forwarded-For is read, is pinned to 2.0.8 to fix an IP spoofing issue with IPv4-mapped IPv6 trusted subnets (GHSA-jqcg-44mw-7w3h).

v6.10.5

Patch Changes

• 2ccbacf: Migrate the 6.x release workflow to Changesets action v2 and CLI v3.

• c159460: Improve validation of Search v1 query parameters.

  size and from now accept only plain string values; anything else falls back to the default page size and offset, as other non-numeric values already did. Only plain string parameters are forwarded to uplinks. An uplink search response that cannot be read now ends that uplink's results, and local results are still returned. Unexpected errors in the search endpoint are reported through the regular error handler. Registry configuration does not need to change.

• ec341ee: Validate Search v1 query text before starting a search.

  Search requests must provide a single, non-blank text string. Missing or invalid search text now receives HTTP 400 with the JSON error code ERR_TEXT_MISSING, before searching local packages or uplinks.

  Earlier 6.x releases could accept searches without text. Clients that call the search API directly must now supply a non-blank query. Valid query text is preserved, and searches with no matching packages continue to return HTTP 200 with an empty results array.

• 35e8373: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/auth: 8.1.4 → 8.1.5
  • @verdaccio/config: 8.3.1 → 8.3.2
  • @verdaccio/core: 8.3.1 → 8.3.2
  • @verdaccio/hooks: 8.1.5 → 8.1.6
  • @verdaccio/loaders: 8.1.4 → 8.1.5
  • @verdaccio/local-storage-legacy: 11.4.4 → 11.4.5
  • @verdaccio/logger: 8.1.4 → 8.1.5
  • @verdaccio/middleware: 8.1.5 → 8.1.6
  • @verdaccio/package-filter: 13.2.2 → 13.2.3
  • @verdaccio/signature: 8.1.4 → 8.1.5
  • @verdaccio/tarball: 13.1.4 → 13.1.5
  • @verdaccio/ui-theme: 9.0.0-next-9.31 → 9.0.0-next-9.33

... (truncated)

Changelog

Sourced from verdaccio's changelog.

6.10.6

Patch Changes

• 56b6a85: Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.

  The production installation now uses npm's --ignore-scripts and --min-release-age=3 options. Verdaccio and packages matching @verdaccio/* or verdaccio-* are excluded from the age restriction so new Verdaccio releases can be built immediately. The final stage updates npm to support these exclusions and disables installation audit and funding output. Image builds still fail if another required dependency has no eligible version. No configuration changes are required for operators.

• db47d78: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.34 → 9.0.0-next-9.36

• fdbfef9: Improve request validation when changing passwords and signing in through the web API.

  Password changes validate the supplied credential fields before invoking the authentication plugin. Existing passwords remain eligible for replacement even when they do not meet the current policy. The existing validation for new passwords and authentication plugin error handling remain unchanged. No configuration changes are required.

  Web sign-in requests now validate the supplied credential fields the same way as password changes. Requests that omit the username or password, send either with a type other than a string, or send a null body are rejected with HTTP 400 and the message username and password is required; a null body previously failed with an internal server error (HTTP 500), and the other cases reached the authentication plugin. Empty strings are still passed to the authentication plugin, which rejects them as before. The web UI always sends both fields, so signing in from it is unaffected.

  This release also updates the internal @verdaccio/* modules and the bundled verdaccio-htpasswd and verdaccio-audit plugins to their latest 6.x-compatible versions. The shared password validator now accepts input of any type and rejects anything that is not a string, and the webhook notification templates use Handlebars 4.7.10, which includes a security fix. proxy-addr, which Express uses to resolve client addresses when server.trustProxy is configured, is updated to 2.0.8, which includes a security fix for trusted-subnet matching of IPv4-mapped IPv6 addresses.

• abced78: npm whoami and any other request to /-/whoami now answer 401 Unauthorized when the request carries no credentials or a token Verdaccio does not recognise.

  Until now the endpoint answered 200 with an empty body {} for anonymous requests, so clients that check the status code, rather than the username field, treated an expired or wrong token as a valid login. The npm public registry and Verdaccio 7 answer 401 in that case, and this release aligns 6.x with them. Requests with a valid token are unchanged and still return { "username": "<name>" }. No configuration change is required.

  This release also updates the internal @verdaccio/* modules to their latest 8.x patches. @verdaccio/core 8.3.3 corrects the input type of the shared password validator, without changing which passwords are accepted. @verdaccio/hooks 8.1.7 brings handlebars 4.7.10, which fixes several template injection advisories in the library that renders notification templates.

  proxy-addr, used by Express to decide which proxies are trusted when X-Forwarded-For is read, is pinned to 2.0.8 to fix an IP spoofing issue with IPv4-mapped IPv6 trusted subnets (GHSA-jqcg-44mw-7w3h).

6.10.5

Patch Changes

• 2ccbacf: Migrate the 6.x release workflow to Changesets action v2 and CLI v3.

• c159460: Improve validation of Search v1 query parameters.

  size and from now accept only plain string values; anything else falls back to the default page size and offset, as other non-numeric values already did. Only plain string parameters are forwarded to uplinks. An uplink search response that cannot be read now ends that uplink's results, and local results are still returned. Unexpected errors in the search endpoint are reported through the regular error handler. Registry configuration does not need to change.

• ec341ee: Validate Search v1 query text before starting a search.

  Search requests must provide a single, non-blank text string. Missing or invalid search text now receives HTTP 400 with the JSON error code ERR_TEXT_MISSING, before searching local packages or uplinks.

  Earlier 6.x releases could accept searches without text. Clients that call the search API directly must now supply a non-blank query. Valid query text is preserved, and searches with no matching packages continue to return HTTP 200 with an empty results array.

• 35e8373: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/auth: 8.1.4 → 8.1.5
  • @verdaccio/config: 8.3.1 → 8.3.2
  • @verdaccio/core: 8.3.1 → 8.3.2
  • @verdaccio/hooks: 8.1.5 → 8.1.6
  • @verdaccio/loaders: 8.1.4 → 8.1.5
  • @verdaccio/local-storage-legacy: 11.4.4 → 11.4.5
  • @verdaccio/logger: 8.1.4 → 8.1.5
  • @verdaccio/middleware: 8.1.5 → 8.1.6
  • @verdaccio/package-filter: 13.2.2 → 13.2.3
  • @verdaccio/signature: 8.1.4 → 8.1.5

... (truncated)

Commits

• 64cecae chore: release 6.x (#6324)
• b6e582e chore: update verdaccio 6.x dependencies (#6357)
• fdbfef9 fix(6.x): validate web password change request body (#6333)
• 4f38b61 ci(6.x): stop labels and temp branches from cancelling runs (#6359)
• c95ef1b chore(deps): update @​verdaccio/e2e-cli to 4.0.0 and drop pnpm 10 from the e2e...
• abced78 fix(6.x): return 401 from whoami without a valid user (#6356)
• f48012e fix(deps): update dependency compression to v1.8.2 [security] (#6336)
• 56b6a85 fix(6.x): disable docker install scripts and require release age (#6325)
• db47d78 chore: update verdaccio 6.x dependencies (#6322)
• d942420 ci: remove the canary release workflow from 6.x
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (6.9.2) was attested. Review the package versions before updating.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	verdaccio@​6.9.2 ⏵ 6.10.6				+1

View full report