v1.3.1 | Docouture

A security patch for v1.3.0 and earlier. It raises the minimum handlebars version to 4.7.10 to close critical vulnerabilities, so you only need to update your docouture packages.

Do this

Update every @inditextech/docouture-* package, and the CLI if you install it, to 1.3.1. In a scaffolded site these are pinned in docs/package.json.
Run docouture upgrade if you use the CLI, then run your package manager’s install (for example pnpm install) to refresh the lockfile.
Check that your lockfile no longer contains handlebars@4.7.9.

No workflow, playbook or content changes are needed. If you are coming from before v1.3.0, also follow the checklist in v1.3.0.

Why this matters

Antora’s @antora/page-composer accepts any handlebars ~4.7, so a site that installed earlier keeps the vulnerable 4.7.9 through its existing lockfile, even though a fixed release exists. v1.3.0 and earlier do not stop that.

Fix. @inditextech/docouture-antora-extensions now depends on handlebars ~4.7.10. The package manager has to resolve one version that satisfies both ranges, so a fresh install, or an update of the docouture packages, moves to 4.7.10 or later.
Alerts closed. Three advisories, GHSA-xw65-4hp5-5hc7 (medium), GHSA-8r5x-fm3f-whwj (critical) and GHSA-p8wg-vrv2-v86f (critical), all affecting handlebars up to 4.7.9.
Development tooling. The UI bundle’s build-time handlebars is bumped to ~4.7.10, and the repository’s own development dependencies vite (7.3.7) and follow-redirects (1.16.1) are updated for their open alerts. These do not reach sites built with docouture.