chore(deps): bump handlebars from 4.7.9 to 4.7.10 in /platforms/react-native

[dependabot]

Bumps handlebars from 4.7.9 to 4.7.10.

Release notes

Sourced from handlebars's releases.

v4.7.10

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Commits

• 45ce152 v4.7.10
• e47b236 Update release notes
• f37c599 Sanitize the source map URL when minifying
• 812c226 Iterate lazily in #each and strip whitespace in linear time
• 609d1b1 Escape <!-- and <script in precompiled output
• ceec388 Don't trust special properties on context data
• c28ee7a Only compile partials that are template strings
• 7d501a5 Only dispatch known node types in the Compiler and Visitor
• 703fdcc Validate AST values in the compiler instead of the parser
• 0fcf25c Clarify that --root does not restrict filesystem access
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Coverage Report

Status	Platform / target	Lines	Branches	Functions	Report
⏭️	Web	—	—	—	Not run for this change
⚠️	React Native	—	—	—	Coverage report unavailable
⏭️	Embedded Checkout Protocol (TS)	—	—	—	Not run for this change

[github-actions]

Bundle Size Budgets

Budget	Size	Limits	Result
React Native npm package (gzip)	121.23 KiB (0 B)	130 KiB soft / 150 KiB hard	✅ Within budget

Bundle and package size

Web bundle sizes cover shipped runtime JavaScript. Package sizes cover the full published archive, including any source maps, declarations, and documentation it contains.

Platform	Measurement	Compression	Base	Head	Delta
React Native	npm package (.tgz)	gzip	121.2 KiB	121.2 KiB	0 B

React Native package files (uncompressed)

These are uncompressed file sizes; they do not sum to the compressed package size above.

File	Base	Head	Delta
node_modules/@shopify/checkout-kit-protocol/src/generated/Models.ts	108.7 KiB	108.7 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/Models.d.ts	73.1 KiB	73.1 KiB	0 B
lib/index.cjs	52.8 KiB	52.8 KiB	0 B
lib/index.js	51.9 KiB	51.9 KiB	0 B
README.md	43.6 KiB	43.6 KiB	0 B
lib/index.cjs.map	28.1 KiB	28.1 KiB	0 B
lib/index.js.map	27.9 KiB	27.9 KiB	0 B
lib/index.d.ts	24.6 KiB	24.6 KiB	0 B
android/src/main/java/com/shopify/reactnative/checkoutkit/ShopifyCheckoutKitModule.java	17.7 KiB	17.7 KiB	0 B
ios/AcceleratedCheckoutButtons.swift	14.8 KiB	14.8 KiB	0 B
ios/ShopifyCheckoutKit.swift	14.8 KiB	14.8 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolNotifications.ts	9.5 KiB	9.5 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/protocol_codec_runtime.ts	7.9 KiB	7.9 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolRenameMap.ts	7.9 KiB	7.9 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolNotifications.d.ts	7.6 KiB	7.6 KiB	0 B
android/src/main/java/com/shopify/reactnative/checkoutkit/CustomCheckoutListener.java	6.2 KiB	6.2 KiB	0 B
ios/ShopifyCheckoutKit.mm	5.1 KiB	5.1 KiB	0 B
package.json	4.5 KiB	4.5 KiB	0 B
android/build.gradle	4.1 KiB	4.1 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/embedded_checkout_protocol.d.ts	3.9 KiB	3.9 KiB	0 B
…and 36 smaller files

How sizes are measured

Measured from the PR base SHA and PR head SHA. Web bundle rows sum shipped .js, .mjs, and .cjs files under dist/, excluding source maps and declarations. The gzip bundle size sums files compressed individually with gzip -n -9. npm package sizes are gzip-compressed .tgz archives; Android AAR sizes are ZIP archives. Package sizes are not final app binary sizes.

[bitrise]

Bitrise builds

E2E · iOS CI

Install this build

Open Tophat, select your target device, then click Install. Links open on the Mac running Tophat.

SDK	Install
React Native	Install with Tophat

Checkout Kit E2E results

Status	Tags	Target	Platform	OS version tag	Device
✅	launch, checkout-presentation, checkout-completion, buyer-identity	react-native	ios	latest	iPhone 15 iOS 27 Beta
✅	launch, checkout-presentation, checkout-completion, buyer-identity	react-native	android	latest	Google Pixel 9 Android 17.0

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.