[COVAL-4538] Remediate critical MCP dependencies

[callumreid]

Summary

Pins the two vulnerable transitive development dependencies so future installs keep the patched versions:

• handlebars 4.7.9 (GitHub Dependabot alert [COVAL-3905] Add ChatGPT app submission artifact #17)
• shell-quote 1.9.0 (GitHub Dependabot alert [COVAL-4212] Fix OpenAI MCP review inputs and tests #25)

The prior remediation was superseded when the 0.4.0 release regenerated the lockfile without the overrides; this restores and preserves the constraint.

Validation

• npm ci --ignore-scripts
• npm ls handlebars shell-quote (resolves 4.7.9 and 1.9.0)
• npm run typecheck
• npm test -- --runInBand (19 suites, 186 tests)
• npm run build

npm audit was attempted twice but npm's audit endpoint returned an empty/error response, so its result is not claimed here.

Greptile Summary

Pins patched versions of two transitive development dependencies to prevent future lockfile regeneration from restoring vulnerable releases.

• Adds npm overrides for handlebars 4.7.9 and shell-quote 1.9.0.
• Updates the corresponding lockfile resolutions and integrity hashes.

Confidence Score: 5/5

The PR appears safe to merge, with the patched development dependency versions consistently represented in both the manifest and lockfile.

The Handlebars override satisfies its consumer’s declared range, both updated packages remain development dependencies, and no concrete incompatibility or reachable failure was established for the updated Shell Quote release.

_{Reviews (1): Last reviewed commit: "[COVAL-4538] Remediate critical npm depe..." | Re-trigger Greptile}

[coderabbitai]

Walkthrough

Added package-manager overrides in package.json. The overrides pin handlebars to 4.7.9 and shell-quote to 1.9.0.

Suggested reviewers: borgesius

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies remediation of the vulnerable MCP dependencies, which is the main change.
Description check	✅ Passed	The description directly explains the dependency pins, affected packages, rationale, and validation steps.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}