OKTA-1145322: upgrade courage handlebars underscore (#4020)

OKTA-1145322 Reapply "OKTA-1145322 : Upgrade courage, handlebar

This reverts commit c8c8377.

Author: shuowu-okta

.retireignore.json

@@ -4,11 +4,6 @@
     "version": "1.12.4",
     "justification": "CVE issues (CVE-2019-11358, CVE-2020-11023) have been mitigated with a patched version of jQuery (packages/@okta/courage-dist/esm/src/courage/vendor/lib/jquery-1.12.4.js)"
   },
-  {
-    "component": "underscore.js",
-    "version": "1.13.1",
-    "justification": "CVE-2026-27601: _.flatten and _.isEqual DoS via unbounded recursion. Mitigated - the widget does not pass untrusted external input to these functions. Upstream fix requires rebuilding courage-dist with underscore 1.13.8."
-  },
   {
     "component": "dompurify",
     "version": "2.5.8",
@@ -18,15 +13,5 @@
     "component": "DOMPurify",
     "version": "2.5.8",
     "justification": "CVE-2025-26791 has been patched locally within patches/dompurify+2.5.8.patch compared fix (https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02#diff-8e647ca2a1d9380f03114f7df5e6a70563c9cb40b03dca353a43ce84b974c2cdR6)"
-  },
-  {
-    "component": "handlebars",
-    "version": "4.7.7",
-    "justification": "CVE-2026-33937 (critical, NumberLiteral AST injection RCE): Not exploitable — the widget never passes user-supplied objects to Handlebars.compile(); templates are precompiled at build time via babel-plugin-handlebars-inline-precompile. CVE-2026-33916 (medium, prototype pollution via partial resolution XSS): Low risk — requires a separate prototype pollution vulnerability as prerequisite; the widget does not expose prototype pollution vectors. CVE-2026-33941 (medium, CLI precompiler argument injection): Not exploitable — the widget does not use the Handlebars CLI; precompilation is done via Babel plugin at build time. CVE-2026-33939 (medium, __lookupSetter__ blocklist omission): Not exploitable — the widget does not set allowProtoMethodsByDefault:true. Upgrade to handlebars 4.7.9 tracked in OKTA-1145322."
-  },
-  {
-    "component": "handlebars.js",
-    "version": "4.7.7",
-    "justification": "Same as handlebars 4.7.7 entry above. RetireJS may detect under alternate component name. Upgrade tracked in OKTA-1145322."
   }
 ]

jest.config.js

@@ -64,6 +64,9 @@ module.exports = {
     '^@okta/qtip$': '@okta/qtip2/dist/jquery.qtip.js',
     '^@okta/duo$': `${LOCAL_PACKAGES}/vendor/duo_web_sdk/index.js`,
     '^@okta/typingdna$': `${LOCAL_PACKAGES}/vendor/TypingDnaRecorder-JavaScript/typingdna`,
+    '^@okta/ui-libraries-oidc-auth-headers$':
+        `${LOCAL_PACKAGES}/@okta/courage-dist/esm/stubs/ui-libraries-oidc-auth-headers.js`,
+    '^@okta/ui-libraries-monolith$': `${LOCAL_PACKAGES}/@okta/courage-dist/esm/stubs/ui-libraries-monolith.js`,
     '^LoginRouter$': `${ROOT}/src/LoginRouter`,
   },
   setupFiles: [

package.json

@@ -258,7 +258,7 @@
     "chokidar": "^3.5.1",
     "clipboard": "^1.5.16",
     "cross-fetch": "^3.1.5",
-    "handlebars": "^4.7.7",
+    "handlebars": "^4.7.9",
     "jquery": "^3.6.0",
     "parse-ms": "^2.0.0",
     "q": "1.4.1",