build(package): bump package and package-lock

[jetersen]

hbs depends on handlebars which had a vulnerability of critical severity

bumped typedocs as it was not compatible with the typescript version defined in dev dependencies.

package-lock had a version reference to ansi-regex v4.0.1 which had a vulnerability of moderate severity.

[welcome]

Thanks for opening this pull request! A contributor should be by to give feedback soon. In the meantime, please check out the contributing guidelines and explore other ways you can get involved.

[jetersen]

tests are passing locally

[welcome]

Thanks for your contribution to probot! 🎉

[gr2m]

Thank you Joseph :)

[jetersen]

Thank you @gr2m ❤️

[jetersen]

I guess this should have been a fix commit to get a release 😢

[github-actions]

🎉 This PR is included in version 12.2.1 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀

[gr2m]

You should have been able to re-create your lock file and update dependencies get the latest version of hbs without a new Probot version needed, but I don't mind releasing out anyway in this case.

[jetersen]

Not according to dependabot or npm audit fix

on release drafter:

 Dependabot cannot update handlebars to a non-vulnerable version
The latest possible version that can be installed is 4.7.6 because of the following conflicting dependencies:

@probot/adapter-github-actions@3.1.0 requires handlebars@4.7.6 via a transitive dependency on hbs@4.1.1
probot@12.2.0 requires handlebars@4.7.6 via hbs@4.1.1
The earliest fixed version is 4.7.7.

same for ansi-regex:

Dependabot cannot update ansi-regex to a non-vulnerable version
The latest possible version that can be installed is 4.1.0 because of the following conflicting dependencies:

@probot/adapter-github-actions@3.1.0 requires ansi-regex@^4.1.0 via a transitive dependency on strip-ansi@5.2.0
probot@12.2.0 requires ansi-regex@^4.1.0 via a transitive dependency on strip-ansi@5.2.0
lint-staged@12.1.7 requires ansi-regex@^6.0.1 via a transitive dependency on strip-ansi@7.0.1
nodemon@2.0.15 requires ansi-regex@^4.1.0 via a transitive dependency on strip-ansi@5.2.0
The earliest fixed version is 5.0.1.

[jetersen]

Note that probot uses locked version for handlebars/hbs. No usage of ^

[gr2m]

Oh I see, thank you for the clarification