[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce?

Security fix. This change updates the lockfile only. It does not change the runtime of the published packages.

handlebars 4.7.9 -> 4.7.10

@jaredwray/fumanchu 4.7.4 already accepts handlebars ^4.7.9.
The lockfile now resolves handlebars 4.7.10.
This update fixes two critical findings:

• CVE-2026-106446, GHSA-8r5x-fm3f-whwj. JavaScript injection via AST type confusion.
• CVE-2026-106445, GHSA-p8wg-vrv2-v86f. JavaScript injection via an own-property check bypass.

path-to-regexp 8.2.0 -> 8.4.2

router 2.2.0 already accepts path-to-regexp ^8.0.0.
The lockfile now resolves path-to-regexp 8.4.2 for Express.
This update fixes CVE-2026-4926, GHSA-j3q9-mxjg-w52f.
The issue is a denial of service via sequential optional groups.
The advisory range is >= 8.0.0 < 8.4.0.
path-to-regexp 3.3.0 and 6.3.0 stay in the lockfile. Those versions are outside the advisory range.

liquidjs 10.29.0 -> 10.30.0

The scan reported liquidjs 10.24.0. Main already had 10.29.0.
ecto 5.1.1 already accepts liquidjs ^10.29.0.
The lockfile now resolves liquidjs 10.30.0.
10.30.0 is the latest 10.x that passes the 7 day release age rule.
This update covers three high findings:

• CVE-2026-30952, GHSA-wmfp-5q7x-987x. Path traversal. The patch release is 10.25.0.
• CVE-2026-33287, GHSA-6q5m-63h6-5x4v. Memory growth in replace_first. The patch release is 10.25.1.
• CVE-2026-33285, GHSA-9r5m-9576-7f6x. A negative range bypasses memoryLimit. The affected range is <= 10.24.0.

Already safe on main

These packages need no new override.

• undici resolves to 7.30.0 and 8.11.2. The lockfile has no 7.14.0 and no 7.16.0. The override undici@>=7.0.0 <8.0.0 pins 7.30.0. 7.30.1 exists, but the 7 day release age rule blocks it. This pin fixes CVE-2026-1526, CVE-2026-2229, and CVE-2026-1528.
• wrangler is a direct dev dependency at 4.143.0. That release is above 4.59.1. It fixes CVE-2026-0933, GHSA-36p8-mvp6-cv38.
• tar 6.2.1 is absent. pnpm why tar finds no package. A move from tar 6 to tar 7 is a major bump, and no parent needs it.
• axios 1.13.2 is absent. pnpm why axios finds no package.

Other lockfile change

@arethetypeswrong/core now uses lru-cache 11.5.3. The lockfile already contained 11.5.3. This package is a dev tool.

Test audit

This pull request adds no test. It changes no test. It deletes no test.
No new test is required. The change is only the lockfile.

Checks

pnpm build passed.
node scripts/test-build.mjs passed.
pnpm test:ci passed for the published packages.
cacheable-request passed 68 tests. Those tests use Express and path-to-regexp.
cache-manager passed 90 tests.
This environment has no Docker. The @cacheable/net DELETE tests call the public mock and receive status 500.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T14:15:03.753661Z	7e24679	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (0a977af) to head (7e24679).

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #1741   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           29        29           
  Lines         3612      3612           
  Branches       808       823   +15     
=========================================
  Hits          3612      3612           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.