chore(deps): update dependency cspell to v10.2.1 by renovate[bot] · Pull Request #1879 · leosuncin/nest-api-example

renovate · 2026-09-03T21:55:43Z

This PR contains the following updates:

Package	Change	Age	Confidence
cspell (source)	`10.0.1` → `10.2.1`

Release Notes

streetsidesoftware/cspell (cspell)

`v10.2.1`

Compare Source

Fixes

fix: support soft hyphens in the word splitter (#9144)

This pull request introduces several improvements and fixes to the word segmentation and word splitting logic, especially for Thai language support and symbol handling. The main changes include updating the Thai segmentation to use soft hyphens, enhancing the word splitting logic to handle more cases (including camelCase, symbols, and soft hyphens), and refactoring the code for better modularity and test coverage.

Word segmentation and Thai language improvements:

Updated Thai (th-TH) segmentation to use soft hyphens (\u00AD) instead of spaces, improving the accuracy of word breaks and ensuring better compatibility with spell checking and downstream processing. [1] [2] [3]
Added the @cspell/dict-th-th package to dependencies, enabling Thai dictionary support.
Adjusted tests and expectations for Thai segmentation to reflect the use of soft hyphens and to ensure no false positives in validation.

Word splitting and symbol handling enhancements:

Introduced a new generateWordBreaks utility that generates all possible word breaks in a string, including camelCase, symbols, numbers, and soft hyphens. Includes comprehensive tests and snapshot coverage for various edge cases. [1] [2] [3] [4]
Improved regular expressions for word splitting to support soft hyphens and better handle punctuation and symbols.

Refactoring and code organization:

Refactored imports to use the new wordSplitter/index.js entry point, improving modularity and future maintainability. [1] [2]
Added explicit exports for split, SplitOptions, and SplitResult in wordSplitter/index.ts to clarify and centralize the public API.

Other enhancements:

Exposed the softHyphen constant for consistent use throughout the codebase. [1] [2]

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#9143)

`v10.2.0`

Compare Source

Features

feat: Add `--force-check` cli option (#9080)

This pull request introduces a new --force-check option to the CLI, allowing users to force specific files to be checked even if they would normally be excluded. It also standardizes dependency configuration naming, improves error handling and reporting for the CLI, and updates TypeScript target versions in config files. The most important changes are grouped below.

New CLI Feature: Force Check

Added a --force-check option to the lint command, allowing files specified with --file, --files, or --file-list to be checked even if they would normally be excluded. This includes updates to the CLI interface, validation logic, and documentation/help output. [1] [2] [3] [4] [5]
Implemented logic in the file determination and processing flow to honor the forceCheck flag, ensuring excluded files can be checked when requested, and updated reporting of skipped files. [1] [2] [3] [4] [5] [6]

CLI Error Handling and Testing

Improved error handling for invalid combinations of CLI options (e.g., using --force-check without specifying files, or mixing globs and --file), with corresponding error messages and test cases. [1] [2]
Enhanced test coverage for the new --force-check option, including snapshot updates for help and error outputs. [1] [2] [3] [4] [5] [6] [7]

Dependency Configuration Standardization

Renamed the dependency configuration property from onlyAllowBundle to onlyBundle across all relevant config files and documentation for consistency. [1] [2] [3] [4]

Other Improvements

Updated TypeScript target version in default config from Node20 to Node22.
Improved CLI process exit code handling for error scenarios.
Minor improvement to CLI reporter logic to avoid emitting empty results.
Cleaned up and simplified the coverage collection script in package.json.

Fixes

fix: Updated package.json exports (#8965)

This fixes a few package exports that were wrong or inconsistent (e.g. exports["."] not the same path as main).

The pnpm test script was failing locally due to my ~/.npmrc having ignore-scripts=true, which prevented the preinstall script from running. I updated test:prep to call the preinstall script, which should be fast if you already have yarn installed.

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#9067)

`v10.1.1`

Compare Source

Fixes

fix: Do not load .pnp.js files when untrusted (#9064)

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#9055)

`v10.1.0`

Compare Source

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:

<testsuite tests="3">
  <testcase classname="File1" name"/>
  <testcase classname="File2" name="AnotherSuccessfulTest"/>
  <testcase classname="foo3" name="AFailingTest">
    <failure type="prohibited word"> zzz </failure>
  </testcase>
</testsuite>

This PR follows that shape but wraps it in a <testsuites> root and groups by file (one <testsuite> per file, suite name = file path), since that is the convention used by other widely-consumed JUnit reporters (for example ESLint's JUnit formatter) and is what most CI JUnit parsers expect. The package README documents the full mapping.

package.json, tsconfig.json, test framework, and files/exports/publishConfig shape are copied from cspell-json-reporter. Version pinned to 10.0.1 to match the monorepo's locked versioning.
No third-party XML library was added. The repo has no existing XML dependency, so a small escaping helper (src/utils/escapeXml.ts) and a pure XML-string builder (src/utils/buildJUnitXml.ts) were written in-repo, consistent with the monorepo's small-utility-file convention.
Unit tests (32) cover: no files, a clean file (single passing testcase), a file with issues, escaping of special characters in paths/words/messages, a skipped file, and non-issue processing errors (error emitter routed to a dedicated cspell-errors testsuite using <error>).

Assumptions the issue thread left ambiguous, called out for review:

One <testsuite> per file rather than one flat suite for the whole run. Matches common JUnit reporter convention and keeps per-file counts meaningful in CI UIs.
A clean file gets one synthetic passing <testcase name="no issues found"> so a suite is never reported with tests="0", which some JUnit consumers treat as suspicious.
Settings are intentionally slimmer than cspell-json-reporter's (outFile, suiteName only). JUnit XML has no natural place for arbitrary debug/progress log dumps.
cspell processing errors are reported as <error> elements, distinct from spelling <failure> elements, per the JUnit failure-vs-error distinction.

Verified locally: tsc -b clean, vitest 32/32, eslint and prettier clean, and the full monorepo build:prod succeeds with the package in the workspace. One environment note: the package's CLI smoke-test script wasn't runnable locally (repo requires Node >=22.18.0, local was 22.17.0 — the sibling json-reporter fails identically there), so CI is the first place it will run.

Fixes

fix: allow substitutions across ignored ranges (#9017)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-09-03T22:00:07Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	0.97s
✅ EDITORCONFIG	editorconfig-checker	2		0	0	0.01s
✅ JSON	jsonlint	1		0	0	0.16s
✅ JSON	npm-package-json-lint	yes		no	no	0.44s
⚠️ JSON	prettier	1	0	1	0	0.83s
✅ JSON	v8r	1		0	0	7.64s
❌ REPOSITORY	betterleaks	yes		2	no	0.98s
❌ REPOSITORY	checkov	yes		1	no	25.75s
❌ REPOSITORY	devskim	yes		45	no	6.32s
✅ REPOSITORY	dustilock	yes		no	no	1.88s
✅ REPOSITORY	git_diff	yes		no	no	0.03s
❌ REPOSITORY	grype	yes		119	no	73.46s
❌ REPOSITORY	kingfisher	yes		1	no	26.84s
❌ REPOSITORY	osv-scanner	yes		119	no	2.17s
❌ REPOSITORY	secretlint	yes		1	no	2.31s
✅ REPOSITORY	syft	yes		no	no	7.4s
⚠️ REPOSITORY	trivy	yes		1	no	10.28s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.74s
✅ REPOSITORY	trufflehog	yes		no	no	3.99s
✅ SPELL	cspell	3		0	0	3.89s
❌ SPELL	lychee	2		1	0	0.58s
✅ YAML	prettier	1	0	0	0	0.2s
✅ YAML	v8r	1		0	0	1.4s
❌ YAML	yamllint	1		8	0	3.92s

Detailed Issues

❌ REPOSITORY / betterleaks - 2 errors

+ ○
   ▾
 betterleaks 1.7.3

┌─generic-api-key──○
│
│ 63 │           POSTGRES_PASSWORD: REDACTED
│    │                              ^^^^^^^^
│
│ attributes:
│   path .......... .github/workflows/ci.yml
│   resource ...... fs.content
└○


┌─generic-api-key──○
│
│ 9 │ SECRET=REDACTED
│   │        ^^^^^^^^
│
│ attributes:
│   path .......... .env.example
│   resource ...... fs.content
└○


10:06PM INF scanned ~417614 bytes (417.61 KB) in 951ms
10:06PM WRN leaks found: 2

❌ REPOSITORY / checkov - 1 error

dockerfile scan results:

Passed checks: 77, Failed checks: 1, Skipped checks: 0

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /Dockerfile.
	File: /Dockerfile:1-47
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1  | ARG NODE_VERSION=lts-slim
		2  | 
		3  | FROM node:${NODE_VERSION} AS dependencies
		4  | 
		5  | WORKDIR /app
		6  | 
		7  | ENV PNPM_HOME="/pnpm"
		8  | ENV PATH="$PNPM_HOME:$PATH"
		9  | 
		10 | RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
		11 |     --mount=type=bind,source=package.json,target=/app/package.json \
		12 |     --mount=type=bind,source=pnpm-lock.yaml,target=/app/pnpm-lock.yaml \
		13 |     corepack enable && \
		14 |     pnpm install --frozen-lockfile --strict-peer-dependencies
		15 | 
		16 | FROM dependencies AS builder
		17 | 
		18 | COPY --chown=node:node src/ /app/src
		19 | 
		20 | RUN --mount=type=bind,source=package.json,target=/app/package.json \
		21 |     --mount=type=bind,source=nest-cli.json,target=/app/nest-cli.json \
		22 |     --mount=type=bind,source=tsconfig.json,target=/app/tsconfig.json \
		23 |     --mount=type=bind,source=tsconfig.build.json,target=/app/tsconfig.build.json \
		24 |     pnpm build
		25 | 
		26 | FROM builder AS pruner
		27 | 
		28 | RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
		29 |     --mount=type=bind,source=package.json,target=/app/package.json \
		30 |     --mount=type=bind,source=pnpm-lock.yaml,target=/app/pnpm-lock.yaml \
		31 |     pnpm prune --prod --ignore-scripts
		32 | 
		33 | FROM gcr.io/distroless/nodejs22-debian12:nonroot
		34 | 
		35 | WORKDIR /app
		36 | 
		37 | ENV PORT=3000
		38 | 
		39 | COPY --chown=nonroot:nonroot --from=pruner /app/node_modules ./node_modules
		40 | COPY --chown=nonroot:nonroot --from=builder /app/dist .
		41 | COPY --chown=nonroot:nonroot CHANGELOG.md LICENSE package.json /app/
		42 | 
		43 | EXPOSE ${PORT}
		44 | 
		45 | HEALTHCHECK --interval=30s --timeout=2s --start-period=10s --retries=2 CMD [ "/nodejs/bin/node", "bin/health-checker.js" ]
		46 | 
		47 | CMD ["main.js"]

❌ REPOSITORY / devskim - 45 errors

n Hash Algorithm"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":1261,"startColumn":109,"endLine":1261,"endColumn":112,"charOffset":59096,"charLength":3,"snippet":{"text":"mD4","rendered":{"text":"mD4","markdown":"`mD4`"}},"sourceLanguage":"yaml"}}}],"fixes":[],"properties":{"tags":["Cryptography.BannedHashAlgorithm"],"DevSkimSeverity":"Critical","DevSkimConfidence":"High"}},{"ruleId":"DS126858","level":"error","message":{"text":"Weak/Broken Hash Algorithm"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":954,"startColumn":91,"endLine":954,"endColumn":94,"charOffset":44802,"charLength":3,"snippet":{"text":"mD5","rendered":{"text":"mD5","markdown":"`mD5`"}},"sourceLanguage":"yaml"}}}],"fixes":[],"properties":{"tags":["Cryptography.BannedHashAlgorithm"],"DevSkimSeverity":"Critical","DevSkimConfidence":"High"}},{"ruleId":"DS126858","level":"error","message":{"text":"Weak/Broken Hash Algorithm"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":906,"startColumn":61,"endLine":906,"endColumn":64,"charOffset":42549,"charLength":3,"snippet":{"text":"Md5","rendered":{"text":"Md5","markdown":"`Md5`"}},"sourceLanguage":"yaml"}}}],"fixes":[],"properties":{"tags":["Cryptography.BannedHashAlgorithm"],"DevSkimSeverity":"Critical","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".devcontainer/docker-compose.yml"},"region":{"startLine":24,"startColumn":50,"endLine":24,"endColumn":59,"charOffset":717,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS197836","level":"error","message":{"text":"Do not take the hash of low-entropy content."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pnpm-lock.yaml"},"region":{"startLine":718,"startColumn":28,"endLine":718,"endColumn":53,"charOffset":33283,"charLength":25,"snippet":{"text":"sha512-hO+ga+uYZ/WA4OtiME","rendered":{"text":"sha512-hO+ga+uYZ/WA4OtiME","markdown":"`sha512-hO+ga+uYZ/WA4OtiME`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Cryptography.HashAlgorithm.InsufficientEntropy"],"DevSkimSeverity":"Important","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/auth/auth.module.spec.ts"},"region":{"startLine":250,"startColumn":20,"endLine":250,"endColumn":29,"charOffset":8053,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"typescript"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/auth.end2end.spec.ts"},"region":{"startLine":188,"startColumn":20,"endLine":188,"endColumn":29,"charOffset":5337,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"typescript"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}

(Truncated to last 3636 characters out of 313217)

❌ REPOSITORY / grype - 119 errors

Medium    0.3% (17th)  0.1    
brace-expansion       1.1.11     1.1.12    npm   GHSA-v6h2-p8h4-qcjw  Low       0.5% (42nd)  0.1    
brace-expansion       2.0.1      2.0.2     npm   GHSA-v6h2-p8h4-qcjw  Low       0.5% (42nd)  0.1    
body-parser           1.20.4     1.20.6    npm   GHSA-v422-hmwv-36x6  Low       0.4% (34th)  0.1    
undici                6.14.1     6.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
undici                6.23.0     6.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
undici                7.22.0     7.24.0    npm   GHSA-4992-7rv2-5pvq  Medium    0.3% (19th)  0.1    
@nestjs/core          10.4.22    11.1.18   npm   GHSA-36xv-jgw5-4q75  Medium    0.2% (14th)  0.1    
@faker-js/faker       8.4.1      10.5.0    npm   GHSA-qxc2-j82w-r537  High      0.2% (4th)   0.1    
@faker-js/faker       9.9.0      10.5.0    npm   GHSA-qxc2-j82w-r537  High      0.2% (4th)   0.1    
undici                6.14.1     6.19.2    npm   GHSA-3g92-w8c5-73pq  Low       0.5% (38th)  0.1    
undici                6.14.1     6.28.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (8th)   < 0.1  
tmp                   0.0.33     0.2.4     npm   GHSA-52f5-9888-hmc6  Low       0.3% (26th)  < 0.1  
undici                6.14.1     6.21.2    npm   GHSA-cxrh-j4jr-qwg3  Low       0.3% (22nd)  < 0.1  
undici                6.14.1     6.28.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (9th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (9th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (9th)   < 0.1  
undici                6.14.1     6.28.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                6.23.0     6.28.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                7.22.0     7.29.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici                6.14.1     6.27.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                6.23.0     6.27.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                7.22.0     7.28.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (14th)  < 0.1  
undici                6.14.1     6.27.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
undici                6.23.0     6.27.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
undici                7.22.0     7.28.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
webpack               5.97.1     5.104.0   npm   GHSA-38r7-794h-5758  Low       0.2% (9th)   < 0.1  
webpack               5.97.1     5.104.1   npm   GHSA-8fgc-7cc6-rx7x  Low       0.2% (9th)   < 0.1  
@babel/core           7.27.4     7.29.6    npm   GHSA-4x5r-pxfx-6jf8  Low       0.1% (2nd)   < 0.1  
js-yaml               3.14.1     3.15.1    npm   GHSA-5p4m-2wfm-xmqj  High      N/A          N/A    
js-yaml               4.1.0      4.3.1     npm   GHSA-5p4m-2wfm-xmqj  High      N/A          N/A    
serialize-javascript  6.0.1      7.0.3     npm   GHSA-5c6j-r48x-rmvq  High      N/A          N/A    
@humanfs/node         0.16.6     0.16.8    npm   GHSA-p498-v437-472g  Medium    N/A          N/A    
follow-redirects      1.15.9     1.16.0    npm   GHSA-r4q5-vmmm-2653  Medium    N/A          N/A
[0073] ERROR discovered vulnerabilities at or above the severity threshold

(Truncated to last 3636 characters out of 12335)

❌ REPOSITORY / kingfisher - 1 error

New Kingfisher release 2.1.0 available
 INFO kingfisher: Launching with 4 concurrent scan jobs. Use --jobs to override.
 INFO kingfisher::rule_loader: Loaded 1055 rules
 INFO kingfisher::scanner::runner: Using Vectorscan rule cache cache_dir=/github/home/.cache/kingfisher/rule-cache
 INFO kingfisher::scanner::runner: Starting secret validation phase...
POSTGRES URL WITH HARDCODED PASSWORD => [KINGFISHER.POSTGRES.1]
 |Finding.......: [REDACTED:159043db]
 |Fingerprint...: 2034115162828868254
 |Confidence....: medium
 |Entropy.......: 3.87
 |Validation....: Inactive Credential
 |__Response....: [REDACTED:7754f9ab]
 |Language......: YAML
 |Line Num......: 24
 |Path..........: ./.devcontainer/docker-compose.yml


==========================================
Scan Summary:
==========================================
 |Findings....................: 1
 |__Successful Validations....: 0
 |__Failed Validations........: 1
 |__Skipped Validations.......: 0
 |Rules Applied...............: 1,055
 |__Blobs Scanned.............: 157
 |Bytes Scanned...............: 888.92 KiB
 |Scan Duration...............: 81ms 101us 120ns
 |Scan Date...................: 2026-09-03 22:06:42 +00:00
 |Kingfisher Version..........: 1.112.0
 |__Latest Version............: 2.1.0
New Kingfisher release 2.1.0 available

❌ SPELL / lychee - 1 error

📝 Summary
---------------------
🔍 Total............7
🔗 Unique...........4
✅ Successful.......1
⏳ Timeouts.........0
🔀 Redirected.......1
👻 Excluded.........5
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1

Errors in pnpm-lock.yaml
[403] https://www.npmjs.com/support (at 2291:65) | Rejected status code: 403 Forbidden

Hint: Followed 1 redirect. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

❌ REPOSITORY / osv-scanner - 119 errors

lock.yaml |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici               | 6.23.0  | 6.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici               | 6.23.0  | 6.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v9p9-hfj2-hcw8 | 7.5  | npm       | undici               | 6.23.0  | 6.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vrm6-8vpv-qv8q | 7.5  | npm       | undici               | 6.23.0  | 6.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici               | 6.23.0  | 6.27.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-2mjp-6q6p-2qxm | 6.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-4992-7rv2-5pvq | 4.6  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-f269-vfmq-vjvj | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-phc3-fgpg-7m6h | 5.9  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-pr7r-676h-xcf6 | 5.9  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici               | 7.22.0  | 7.29.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-v9p9-hfj2-hcw8 | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vrm6-8vpv-qv8q | 7.5  | npm       | undici               | 7.22.0  | 7.24.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici               | 7.22.0  | 7.28.0        | pnpm-lock.yaml |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid                 | 9.0.1   | 11.1.1        | pnpm-lock.yaml |
| https://osv.dev/GHSA-38r7-794h-5758 | 3.7  | npm       | webpack              | 5.97.1  | 5.104.0       | pnpm-lock.yaml |
| https://osv.dev/GHSA-8fgc-7cc6-rx7x | 3.7  | npm       | webpack              | 5.97.1  | 5.104.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-58qx-3vcg-4xpx | 4.4  | npm       | ws                   | 8.18.1  | 8.20.1        | pnpm-lock.yaml |
| https://osv.dev/GHSA-96hv-2xvq-fx4p | 7.5  | npm       | ws                   | 8.18.1  | 8.21.0        | pnpm-lock.yaml |
+-------------------------------------+------+-----------+----------------------+---------+---------------+----------------+

(Truncated to last 3636 characters out of 15750)

❌ REPOSITORY / secretlint - 1 error

.github/workflows/ci.yml
  89:24  error  [PostgreSQLConnection] found PostgreSQL connection string: *************************************************  @secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-database-connection-string
  95:24  error  [PostgreSQLConnection] found PostgreSQL connection string: *************************************************  @secretlint/secretlint-rule-preset-recommend > @secretlint/secretlint-rule-database-connection-string

✖ 2 problems (2 errors, 0 warnings, 0 infos)

❌ YAML / yamllint - 8 errors

pnpm-lock.yaml
  1:1       warning  missing document start "---"  (document-start)
  40:501    error    line too long (629 > 500 characters)  (line-length)
  173:501   error    line too long (738 > 500 characters)  (line-length)
  10001:501 error    line too long (679 > 500 characters)  (line-length)
  10003:501 error    line too long (867 > 500 characters)  (line-length)
  10115:501 error    line too long (679 > 500 characters)  (line-length)
  10137:501 error    line too long (679 > 500 characters)  (line-length)
  10138:501 error    line too long (958 > 500 characters)  (line-length)

⚠️ JSON / prettier - 1 error

[error] Cannot find package 'prettier-plugin-toml' imported from noop.js

⚠️ REPOSITORY / trivy - 1 error

│                   │ 6.27.0, 7.28.0, 8.5.0      │ undici: undici: Weakening of cookie SameSite policy due to   │
│                │                │          │        │                   │                            │ incorrect parsing of...                                      │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-11525                   │
│                ├────────────────┤          │        │                   │                            ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2026-6733  │          │        │                   │                            │ undici: Undici: Response queue poisoning on reused           │
│                │                │          │        │                   │                            │ keep-alive sockets can lead to...                            │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-6733                    │
├────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ uuid           │ CVE-2026-41907 │ MEDIUM   │        │ 9.0.1             │ 11.1.1, 12.0.1, 13.0.1     │ uuid: uuid: Out-of-bounds write vulnerability impacts data   │
│                │                │          │        │                   │                            │ integrity and confidentiality                                │
│                │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2026-41907                   │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────────────────┴──────────────────────────────────────────────────────────────┘

.devcontainer/Dockerfile (dockerfile)
=====================================
Tests: 27 (SUCCESSES: 25, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds-0002
────────────────────────────────────────


DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile
════════════════════════════════════════
You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

See https://avd.aquasec.com/misconfig/ds-0026
────────────────────────────────────────



Dockerfile (dockerfile)
=======================
Tests: 27 (SUCCESSES: 26, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds-0002
────────────────────────────────────────



📣 Notices:
  - Version 0.74.0 of Trivy is now available, current version is 0.73.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 3636 characters out of 29877)

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Show us your support by starring ⭐ the repository

chore(deps): update dependency cspell to v10.2.1

e6de053

renovate Bot added the automerge Auto merge PR with Kodiak label Sep 3, 2026

renovate Bot enabled auto-merge (rebase) September 3, 2026 21:55

kodiakhq Bot approved these changes Sep 3, 2026

View reviewed changes

Navigation Menu

chore(deps): update dependency cspell to v10.2.1 - #1879

chore(deps): update dependency cspell to v10.2.1#1879
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/cspell-monorepo

renovate Bot commented Sep 3, 2026

fix: Do not load .pnp.js files when untrusted (#9064)

fix: Workflow Bot -- Update Dictionaries (main) (#9055)

`v10.1.0`

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Fixes

fix: allow substitutions across ignored ranges (#9017)

Configuration

Uh oh!

github-actions Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 3, 2026

Release Notes

v10.2.1

Fixes

fix: support soft hyphens in the word splitter (#​9144)

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#​9143)

v10.2.0

Features

feat: Add --force-check cli option (#​9080)

Fixes

fix: Updated package.json exports (#​8965)

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#​9067)

v10.1.1

Fixes

fix: Do not load .pnp.js files when untrusted (#​9064)

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#​9055)

v10.1.0

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#​8945)

Fixes

fix: allow substitutions across ignored ranges (#​9017)

Configuration

Uh oh!

github-actions Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v10.2.1`

fix: support soft hyphens in the word splitter (#9144)

fix: Workflow Bot -- Update Dictionaries (main) (#9143)

`v10.2.0`

feat: Add `--force-check` cli option (#9080)

fix: Updated package.json exports (#8965)

fix: Workflow Bot -- Update Dictionaries (main) (#9067)

`v10.1.1`

fix: Do not load .pnp.js files when untrusted (#9064)

fix: Workflow Bot -- Update Dictionaries (main) (#9055)

`v10.1.0`

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

fix: allow substitutions across ignored ranges (#9017)

github-actions Bot commented Sep 3, 2026 •

edited

Loading