Skip to content

Add Socket patch for CVE-2026-33937 in pkg:npm/handlebars@4.7.8 - #44

Closed
socket-security[bot] wants to merge 2 commits into
mainfrom
socket/autopatch-1782916215033-7c09406f
Closed

socket-security[bot] wants to merge 2 commits into
mainfrom
socket/autopatch-1782916215033-7c09406f

Conversation

@socket-security

Copy link
Copy Markdown

Summary

This PR updates Socket security patches for your dependencies.

Changes

  • ✅ Added: CVE-2026-33937 in pkg:npm/handlebars@4.7.8 (Socket Patch)
    • Severity: CRITICAL
    • Summary: Handlebars.js has JavaScript Injection via AST Type Confusion

📦 Package.json Updates

This PR automatically configures your postinstall script to apply Socket patches:

  • ✅ Updated: 1 file
    • example-app-sendgrid/package.json

After merging, patches will automatically apply on npm install.

Testing

Review the patches and test your application to ensure compatibility.


🔒 Powered by Socket Security

socket-security Bot added 2 commits July 1, 2026 14:30
Updates:
- 8 blob(s) added
- 0 blob(s) removed
- Manifest updated
Configures package.json postinstall scripts to automatically apply Socket security patches.
@socket-security
socket-security Bot requested a review from a team as a code owner July 1, 2026 14:30
@NyanKiyoshi NyanKiyoshi closed this Jul 1, 2026
@NyanKiyoshi
NyanKiyoshi deleted the socket/autopatch-1782916215033-7c09406f branch July 1, 2026 14:32
@NyanKiyoshi NyanKiyoshi added the invalid This doesn't seem right label Jul 1, 2026
@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown

Differences Found

✅ No packages or licenses were added.

Summary

Expand
License Name Package Count Packages
0BSD 1
Packages
  • tslib
AFL-2.1 1
Packages
  • json-schema
Apache 2.0 1
Packages
  • @mailchimp/mailchimp_marketing
CC-BY-3.0 1
Packages
  • spdx-exceptions
MIT (http://mootools.net/license.txt) 1
Packages
  • slick
MIT-0 1
Packages
  • nodemailer
Public Domain 1
Packages
  • jsonify
Python-2.0 1
Packages
  • argparse
SEE LICENSE IN LICENSE 1
Packages
  • spawndamnit
WTFPL 1
Packages
  • utf8-byte-length
CC-BY-4.0 2
Packages
  • @saleor/macaw-ui
  • caniuse-lite
CC0-1.0 3
Packages
  • language-subtag-registry
  • spdx-license-ids
  • type-fest
Unlicense 3
Packages
  • @zxing/text-encoding
  • big-integer
  • tweetnacl
<<missing>> 5
Packages
  • busboy
  • cycle
  • example-nextjs-sequra
  • eyes
  • streamsearch
BlueOak-1.0.0 5
Packages
  • chownr
  • jackspeak
  • package-json-from-dist
  • path-scurry
  • yallist
LGPL-3.0-or-later 11
Packages
  • @img/sharp-libvips-darwin-arm64
  • @img/sharp-libvips-darwin-x64
  • @img/sharp-libvips-linux-arm
  • @img/sharp-libvips-linux-arm64
  • @img/sharp-libvips-linux-s390x
  • @img/sharp-libvips-linux-x64
  • @img/sharp-libvips-linuxmusl-arm64
  • @img/sharp-libvips-linuxmusl-x64
  • @img/sharp-wasm32
  • @img/sharp-win32-ia32
  • @img/sharp-win32-x64
MPL-2.0 12
Packages
  • axe-core
  • lightningcss
  • lightningcss-darwin-arm64
  • lightningcss-darwin-x64
  • lightningcss-freebsd-x64
  • lightningcss-linux-arm-gnueabihf
  • lightningcss-linux-arm64-gnu
  • lightningcss-linux-arm64-musl
  • lightningcss-linux-x64-gnu
  • lightningcss-linux-x64-musl
  • lightningcss-win32-arm64-msvc
  • lightningcss-win32-x64-msvc
BSD-2-Clause 25
Packages
  • @typescript-eslint/parser
  • @typescript-eslint/typescript-estree
  • cheerio-select
  • css-select
  • css-what
  • damerau-levenshtein
  • domelementtype
  • domhandler
  • domutils
  • dotenv
  • entities
  • escodegen
  • eslint-scope
  • espree
  • esprima
  • esrecurse
  • estraverse
  • esutils
  • glob-to-regexp
  • normalize-package-data
  • And 5 more...
BSD-3-Clause 30
Packages
  • @humanwhocodes/object-schema
  • @saleor/app-sdk
  • @saleor/auth-sdk
  • @saleor/eslint-plugin-saleor-app
  • @sentry/cli
  • @xtuc/ieee754
  • abab
  • asn1js
  • bcrypt-pbkdf
  • diff
  • esquery
  • exenv
  • hoist-non-react-statics
  • hyphenate-style-name
  • ieee754
  • immutable
  • istanbul-lib-coverage
  • istanbul-lib-report
  • istanbul-lib-source-maps
  • istanbul-reports
  • And 10 more...
ISC 71
Packages
  • @isaacs/cliui
  • @isaacs/fs-minipass
  • @saleor/app-sdk
  • @saleor/json-schema-compiler
  • @ungap/structured-clone
  • abbrev
  • anymatch
  • ast-types-flow
  • authorizenet
  • boolbase
  • cli-color
  • cli-width
  • cliui
  • d
  • electron-to-chromium
  • es5-ext
  • es6-symbol
  • es6-weak-map
  • eslint-import-resolver-typescript
  • ext
  • And 51 more...
Apache-2.0 76
Packages
  • @ampproject/remapping
  • @humanwhocodes/config-array
  • @humanwhocodes/module-importer
  • @img/sharp-darwin-arm64
  • @img/sharp-darwin-x64
  • @img/sharp-linux-arm
  • @img/sharp-linux-arm64
  • @img/sharp-linux-s390x
  • @img/sharp-linux-x64
  • @img/sharp-linuxmusl-arm64
  • @img/sharp-linuxmusl-x64
  • @img/sharp-wasm32
  • @img/sharp-win32-ia32
  • @img/sharp-win32-x64
  • @opentelemetry/api
  • @opentelemetry/semantic-conventions
  • @pollyjs/adapter
  • @pollyjs/adapter-fetch
  • @pollyjs/adapter-node-http
  • @pollyjs/core
  • And 56 more...
MIT 1440
Packages
  • @0no-co/graphql.web
  • @aashutoshrathi/word-wrap
  • @adobe/css-tools
  • @alloc/quick-lru
  • @apidevtools/json-schema-ref-parser
  • @apollo/client
  • @ardatan/relay-compiler
  • @ardatan/sync-fetch
  • @babel/code-frame
  • @babel/compat-data
  • @babel/core
  • @babel/generator
  • @babel/helper-annotate-as-pure
  • @babel/helper-compilation-targets
  • @babel/helper-create-class-features-plugin
  • @babel/helper-environment-visitor
  • @babel/helper-function-name
  • @babel/helper-globals
  • @babel/helper-hoist-variables
  • @babel/helper-member-expression-to-functions
  • And 1420 more...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

invalid This doesn't seem right

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant