fix(deps): update handlebars to 4.7.10 to clear three critical advisories

[sonukapoor]

Three critical advisories against handlebars@4.7.9, all fixed in 4.7.10: GHSA-8r5x-fm3f-whwj, GHSA-p8wg-vrv2-v86f and GHSA-xw65-4hp5-5hc7. They were open on our own Security tab.

No version bump anywhere. ts-jest declares handlebars: ^4.7.9, which already permits 4.7.10, so only the lockfile moves. This is the within-range case our own output describes as ts-jest already permits handlebars@4.7.10.

They arrived with #1305, a Self Fix PR that cleared one medium ts-jest advisory and brought in three criticals with the newer version. Nothing flagged that trade at merge time, because a Self Fix PR is not scanned against its own result; the next scheduled self-scan found it.

Our own scan now reports zero critical and zero high. The one medium left is sprintf-js@1.0.3, transitive through jest and genuinely unfixable, since 1.1.3 is the newest published version and carries the same advisory.

Closes #1306

[cve-lite-cli-bot]

1 critical finding resolved by this PR

• handlebars@4.7.9 · CVE-2026-106446, CVE-2026-106445, CVE-2026-106444

_{Only findings this PR changed are listed. Nothing is posted when the set is unchanged.}

_{Scanned by CVE Lite CLI, a free and open source OWASP project.}

❤️ Share

If this caught something before it merged, a mention helps other maintainers find it.

• Post on X

• Share on LinkedIn

• Add the badge to your README:

  [![Protected by CVE Lite CLI](https://img.shields.io/badge/Protected_by-CVE_Lite_CLI-brightgreen)](https://github.com/OWASP/cve-lite-cli)