chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #195 · Eyevinn/warp-player

dependabot · 2026-09-21T15:54:23Z

Bumps the development-dependencies group with 5 updates in the / directory:

Package	From	To
@types/node	`26.4.0`	`26.6.1`
eslint	`10.9.1`	`10.10.0`
jest	`30.5.0`	`30.5.2`
prettier	`3.9.6`	`3.9.8`
webpack	`5.110.1`	`5.111.1`

Updates @types/node from 26.4.0 to 26.6.1

Commits

See full diff in compare view

Updates eslint from 10.9.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)

c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)

5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)

427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)

9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)

87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)

8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)

9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

2417cad docs: Update README (GitHub Actions Bot)

9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)

8724829 docs: update compat table links (#21263) (fnx)

5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)

1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])

3c753f1 chore: update eslint (#21289) (renovate[bot])

1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)

08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)

77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])

007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)

0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

Commits

3f20a57 10.10.0
f4e5284 Build: changelog update for 10.10.0
bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
427ac0a fix: use format strings in debug calls (#21247)
b3d876b chore: disable npm audit in ecosystem tests (#21306)
9d81532 fix: support __proto__ in /* exported */ comments (#21261)
264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
1696682 ci: restore EMFILE test on Node.js 26 (#21297)
2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
Additional commits viewable in compare view

Updates jest from 30.5.0 to 30.5.2

Release notes

Sourced from jest's releases.

v30.5.2

Features

[@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

[jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)

[jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)

[@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

New Contributors

@winklemad made their first contribution in jestjs/jest#16345

Full Changelog: jestjs/jest@v30.5.1...v30.5.2

v30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

@HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

Changelog

Sourced from jest's changelog.

30.5.2

Features

[@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

[jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)

[jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)

[@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

Commits

202dd8a v30.5.2
9ab14fe v30.5.1
See full diff in compare view

Updates prettier from 3.9.6 to 3.9.8

Release notes

Sourced from prettier's releases.

3.9.8

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)

🔗 Changelog

3.9.7

Support Angular 22.2

Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by `@seiyab`)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by `@Austin1serb`, `@giaBaoJS`)

<!-- Input -->
- [x] short first line.
  second paragraph at six spaces that wraps
  onto another line here.

<!-- Prettier 3.9.6 -->

 
short first line.
second paragraph at six spaces that wraps
    onto another line here.



<!-- Prettier 3.9.7 -->

 
short first line.
second paragraph at six spaces that wraps
onto another line here.

JavaScript: Fix embedded template literal idempotency (#19725 by `@fisker`)

... (truncated)

Commits

4f2ab67 Release 3.9.8
3d82af8 Update Regex related dependencies (#20082)
5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
5b142ed Release Release @prettier/plugin-hermes@0.2.3, @prettier/plugin-oxc@0.2.3, an...
0df8eb8 Bump Prettier dependency to 3.9.7
3cf6c8c Clean changelog_unreleased
0449af3 Release 3.9.7
43cd5b0 Allow verify markdown test with mdx parser
ab8c911 Fix test on Node.js v26 (#19927)
4a5adf9 Fix tests
Additional commits viewable in compare view

Updates webpack from 5.110.1 to 5.111.1

Release notes

Sourced from webpack's releases.

v5.111.1

Patch Changes

Throw on a write to an imported binding without losing concatenation. (by @alexander-akait in #22141)

Keep the </html> a page was written with, whatever opened the element. (by @aryanraj45 in #22103)

Look an attribute up by what its value decodes to, not how it was spelled. (by @aryanraj45 in #22107)

Minify HTML by what a value says rather than how it was spelled. (by @alexander-akait in #22154)

Follow HTML template form and frameset rules during tree construction. (by @dependabot in #22129)

Keep the whitespace calc() needs around + and - in a custom property. (by @alexander-akait in #22150)

Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @alexander-akait in #22119)

Rewrite an attribute value the source spelled with character references. (by @aryanraj45 in #22110)

Unquote an HTML attribute value carrying a vertical tab. (by @alexander-akait in #22162)

Keep a shadow's spread and canonicalize a merged selector list. (by @alexander-akait in #22101)

Leave out an implied tag and merge adjacent runs on the first pass. (by @aryanraj45 in #22121)

Minify in one pass what a second pass of the CSS minifier used to find. (by @alexander-akait in #22106)

Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @aryanraj45 in #22126)

Keep initial where an engine reads the property's initial keyword apart. (by @aryanraj45 in #22128)

Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @alexander-akait in #22108)

Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @alexander-akait in #22111)

Run the printer equivalence suite against Firefox as well as Chrome. (by @aryanraj45 in #22151)

Finish in one CSS pass the joins, drops and collapses left to a second. (by @alexander-akait in #22117)

Move the context module sources into lib/context/. (by @alexander-akait in #22115)

Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @alexander-akait in #22116)

Emit a failing module's stack relative, and name what a tap failed with. (by @alexander-akait in #22122)

Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @alexander-akait in #22120)

Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @alexander-akait in #22142)

Record hoisted, module and block declarations while parsing, not by re-walking. (by @alexander-akait in #22147)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.111.1

Patch Changes

Throw on a write to an imported binding without losing concatenation. (by @alexander-akait in #22141)

Keep the </html> a page was written with, whatever opened the element. (by @aryanraj45 in #22103)

Look an attribute up by what its value decodes to, not how it was spelled. (by @aryanraj45 in #22107)

Minify HTML by what a value says rather than how it was spelled. (by @alexander-akait in #22154)

Follow HTML template form and frameset rules during tree construction. (by @dependabot in #22129)

Keep the whitespace calc() needs around + and - in a custom property. (by @alexander-akait in #22150)

Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @alexander-akait in #22119)

Rewrite an attribute value the source spelled with character references. (by @aryanraj45 in #22110)

Unquote an HTML attribute value carrying a vertical tab. (by @alexander-akait in #22162)

Keep a shadow's spread and canonicalize a merged selector list. (by @alexander-akait in #22101)

Leave out an implied tag and merge adjacent runs on the first pass. (by @aryanraj45 in #22121)

Minify in one pass what a second pass of the CSS minifier used to find. (by @alexander-akait in #22106)

Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @aryanraj45 in #22126)

Keep initial where an engine reads the property's initial keyword apart. (by @aryanraj45 in #22128)

Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @alexander-akait in #22108)

Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @alexander-akait in #22111)

Run the printer equivalence suite against Firefox as well as Chrome. (by @aryanraj45 in #22151)

Finish in one CSS pass the joins, drops and collapses left to a second. (by @alexander-akait in #22117)

Move the context module sources into lib/context/. (by @alexander-akait in #22115)

Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @alexander-akait in #22116)

Emit a failing module's stack relative, and name what a tap failed with. (by @alexander-akait in #22122)

Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @alexander-akait in #22120)

Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @alexander-akait in #22142)

... (truncated)

Commits

5a10675 chore(release): new release (#22105)
9c448c4 test: consolidate loose harness files under test/harness (#22163)
a947604 fix(html): unquote an attribute value carrying a vertical tab (#22162)
db556f3 test: run the printer equivalence suite against Gecko in CI (#22155)
d174cdf perf(css): drop a fallback every browserslist target reads past (#22158)
39f14f2 refactor(javascript): declare block bindings from the parse (#22161)
0835411 test: move suite drivers into test/templates (#22159)
b48cd77 fix(html): minify by what a value says rather than how it was spelled (#22154)
a774f10 test: define the webpack major instead of bundling package.json (#22160)
4b2eed0 docs: report only what needs a decision while watching a PR (#22156)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ectory with 5 updates Bumps the development-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.0` | `26.6.1` | | [eslint](https://github.com/eslint/eslint) | `10.9.1` | `10.10.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.5.0` | `30.5.2` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` | | [webpack](https://github.com/webpack/webpack) | `5.110.1` | `5.111.1` | Updates `@types/node` from 26.4.0 to 26.6.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.9.1 to 10.10.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.9.1...v10.10.0) Updates `jest` from 30.5.0 to 30.5.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.2/packages/jest) Updates `prettier` from 3.9.6 to 3.9.8 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.8) Updates `webpack` from 5.110.1 to 5.111.1 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.110.1...v5.111.1) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: eslint dependency-version: 10.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: jest dependency-version: 30.5.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: prettier dependency-version: 3.9.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: webpack dependency-version: 5.111.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-21T15:54:37Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@cacheable/memory

2.2.0

Unknown

npm/@cacheable/utils

2.5.0

Unknown

npm/@eslint/plugin-kit

0.7.3

Unknown

npm/@jest/console

30.5.2

Unknown

npm/@jest/core

30.5.2

Unknown

npm/@jest/environment

30.5.2

Unknown

npm/@jest/expect

30.5.2

Unknown

npm/@jest/expect-utils

30.5.2

Unknown

npm/@jest/fake-timers

30.5.2

Unknown

npm/@jest/globals

30.5.2

Unknown

npm/@jest/reporters

30.5.2

Unknown

npm/@jest/snapshot-utils

30.5.1

Unknown

npm/@jest/source-map

30.5.2

Unknown

npm/@jest/test-result

30.5.2

Unknown

npm/@jest/test-sequencer

30.5.2

Unknown

npm/@jest/transform

30.5.2

Unknown

npm/@jest/types

30.5.1

Unknown

npm/@keyv/bigmap

1.3.1

🟢 7.2

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ -1	internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.

npm/@keyv/serialize

1.1.1

🟢 7.2

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ -1	internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.

npm/@types/node

26.6.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 26/28 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/ajv-formats

3.0.1

🟢 3.5

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Code-Review	🟢 4	Found 8/20 approved changesets -- score normalized to 4
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/babel-jest

30.5.2

Unknown

npm/cacheable

2.5.0

Unknown

npm/enhanced-resolve

5.25.1

🟢 5.6

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 2/11 approved changesets -- score normalized to 1
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/eslint

10.10.0

🟢 6.4

Details

Check	Score	Reason
Code-Review	🟢 7	Found 21/27 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 9	SAST tool detected but not run on all commits

npm/expect

30.5.2

Unknown

npm/file-entry-cache

11.1.5

Unknown

npm/flat-cache

6.1.23

Unknown

npm/hashery

1.5.1

Unknown

npm/hookified

1.15.1

Unknown

npm/hookified

2.2.0

Unknown

npm/jest

30.5.2

Unknown

npm/jest-changed-files

30.5.1

Unknown

npm/jest-circus

30.5.2

Unknown

npm/jest-cli

30.5.2

Unknown

npm/jest-config

30.5.2

Unknown

npm/jest-diff

30.5.2

Unknown

npm/jest-each

30.5.2

Unknown

npm/jest-environment-node

30.5.2

Unknown

npm/jest-haste-map

30.5.1

Unknown

npm/jest-leak-detector

30.5.1

Unknown

npm/jest-matcher-utils

30.5.2

Unknown

npm/jest-message-util

30.5.1

Unknown

npm/jest-mock

30.5.2

Unknown

npm/jest-resolve

30.5.1

Unknown

npm/jest-resolve-dependencies

30.5.2

Unknown

npm/jest-runner

30.5.2

Unknown

npm/jest-runtime

30.5.2

Unknown

npm/jest-snapshot

30.5.2

Unknown

npm/jest-util

30.5.1

Unknown

npm/jest-validate

30.5.1

Unknown

npm/jest-watcher

30.5.2

Unknown

npm/jest-worker

30.5.1

Unknown

npm/keyv

5.6.0

🟢 7.2

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ -1	internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.

npm/prettier

3.9.8

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 4	Found 8/17 approved changesets -- score normalized to 4
Maintained	🟢 10	30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 7	SAST tool is not run on all commits -- score normalized to 7

npm/pretty-format

30.5.1

Unknown

npm/qified

0.10.1

Unknown

npm/schema-utils

4.5.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/27 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	15 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/undici-types

8.9.0

🟢 8.2

Details

Check	Score	Reason
Dependency-Update-Tool	🟢 10	update tool detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Binary-Artifacts	🟢 8	binaries present in source code
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Signed-Releases	⚠️ -1	no releases found
Fuzzing	🟢 10	project is fuzzed
Vulnerabilities	🟢 6	4 existing vulnerabilities detected
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 64 contributing companies or organizations

npm/webpack

5.111.1

🟢 5.8

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 4	Found 12/29 approved changesets -- score normalized to 4
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 10	all dependencies are pinned
Binary-Artifacts	⚠️ 0	binaries present in source code
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9

Scanned Files

package-lock.json

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 21, 2026

Navigation Menu

chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates - #195

chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates#195
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-ec30cc1038

dependabot Bot commented on behalf of github Sep 21, 2026

Uh oh!

github-actions Bot commented Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 21, 2026

v10.10.0

Features

Bug Fixes

Documentation

Chores

v30.5.2

Features

Fixes

New Contributors

v30.5.1

Fixes

Chore & Maintenance

New Contributors

30.5.2

Features

Fixes

30.5.1

Fixes

Chore & Maintenance

3.9.8

3.9.7

3.9.8

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

3.9.7

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

JavaScript: Fix embedded template literal idempotency (#19725 by @​fisker)

v5.111.1

Patch Changes

5.111.1

Patch Changes

Uh oh!

github-actions Bot commented Sep 21, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by `@seiyab`)

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by `@Austin1serb`, `@giaBaoJS`)

JavaScript: Fix embedded template literal idempotency (#19725 by `@fisker`)