Update dependencies

[nkbt]

That did not fix the build, since handlebars dependencies are not updated (but still good to have)

[ericelliott]

I don't see any way this would make our users vulnerable, but I hate broken builds. =)

Is Hogan vulnerable?

[nkbt]

https://circleci.com/gh/nkbt/cf-package/19

[ericelliott]

Any luck trying to swap out mustache for something that isn't breaking builds?

[nkbt]

I'll get down to this later today.

[ericelliott]

:+1:

[nkbt]

It is already fixed in handlebars https://github.com/wycats/handlebars.js/commit/9d4353c35cc93cbc44125efcb2c4d348cb51cf06

The new version is just not published yet.

I suggest to make audit always successfull in CircleCI checks, since it will be usually not our fault, and it actually does not break build. But it is still run, so we can see results of it.

It is my personal opinion of course and if you think otherwise - I'll revert CircleCI config

[nkbt]

Still runs, fails, but does not break the build

[nkbt]

Handlebars updated to 4.0, so the problem is fixed now.

[ericelliott]

I think we definitely need to make it fail the build. Our fault or not, we don't want to introduce upstream bugs into downstream users of our software.

[nkbt]

Done.

[ericelliott]

The correct fix if an upstream vendor breaks our build (in order of preference):

1. Submit an upstream PR & wait for a fix to land
2. Choose a different vendor
3. Fork the lib

=)