fix: [npm] Upgrade hbs from 4.0.4 to 4.3.0 (handlebars 4.0.14 → 4.7.9) to resolve CVE-2026-33938

[hannahhuh-cog]

Summary

Snyk SCA flagged handlebars@4.0.14 (transitive via hbs@4.0.4) with Critical SNYK-JS-HANDLEBARS-15803082 / CVE-2026-33938 — Type Confusion (CWE-843) in template compilation. Fixed in handlebars 4.7.9. app.js registers hbs.__express and routes/index.js renders account.hbs, so the vulnerable compiler runs in production.

Change: package.json "hbs": "^4.0.4" → "^4.3.0"; the lockfile now resolves hbs@4.3.0 → handlebars@4.7.9. Snyk's recommended remediation was hbs@4.2.1; 4.3.0 was used so the direct hbs XSS finding (SNYK-JS-HBS-19256914 / CVE-2026-16231, fixed in 4.3.0) is not left behind. The same bump incidentally clears the other handlebars criticals/highs (CVE-2026-33937, CVE-2026-33940, SNYK-JS-HANDLEBARS-534988, CVE-2021-23369, CVE-2019-19919, CVE-2019-20920, CVE-2019-20922, CVE-2026-33939, CVE-2026-33941) since they share the 4.7.9 fix. The nested nyc/node_modules/handlebars@4.0.11 (dev-only, via tap) is not touched.

Snyk reference: SNYK-JS-HANDLEBARS-15803082, severity critical, introduced through hbs@4.0.4 > handlebars@4.0.14.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/178f11f2b5e94e8f93f691287e1f1d60
Open in Devin Desktop: https://app.devin.ai/desktop/session/178f11f2b5e94e8f93f691287e1f1d60?variant=devin
Requested by: @hannahhuh-cog

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.