Skip to content

build(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates - #206

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-48cb920a4c
Open

build(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates#206
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-48cb920a4c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 6 updates in the / directory:

Package From To
@playwright/test 1.61.1 1.62.0
@types/node 26.1.1 26.1.2
eslint 10.7.0 10.8.0
knip 6.26.0 6.29.0
lint-staged 17.0.8 17.2.0
typescript-eslint 8.64.0 8.65.0

Updates @playwright/test from 1.61.1 to 1.62.0

Release notes

Sourced from @​playwright/test's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

</tr></table>

... (truncated)

Commits
  • e3950d9 chore: mark v1.62.0 (#41981)
  • f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
  • 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
  • 2934858 fix: correct pending navigation log spacing (#41949)
  • 4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
  • bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
  • 15c4f55 fix(mcp): identify downloads explicitly (#41933)
  • f5fa967 fix(network): request.postData() returns null for empty string body override ...
  • 0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
  • 244a1ff feat(firefox): roll to r1538 (#41938)
  • Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

Updates eslint from 10.7.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

  • 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)
Commits

Updates knip from 6.26.0 to 6.29.0

Release notes

Sourced from knip's releases.

Release 6.29.0

  • fix(glob): do not follow symbolic links in async glob (#1900) (b7d5ce2f545d91953a97733aa1567e8728b20644) - thanks @​mogelbrod!
  • Add built-in compiler for tsrx (db05e0142a41fad2ad45d62ba5106e0d97c92b45)
  • Fix -u shortcut for --duration (932b9262af275d209923a5efab1b6f23067bb006)

Release 6.28.0

  • Update oxc-resolver (resolve #1889) (1444f6aaf04d42ad07ee0b88da4dfae0e116043a)
  • Keep entry-exported members public (resolve #1890) (94967c13a589a7e83408b1495c31323ac126fcab)
  • Don't un-ignore sibling paths on unrelated gitignore negations (resolve #1891) (5c026ba50c1e89804fc5094a52dc4c4c37d92bc2)
  • Memoize the gitignore shadowed-pattern check (a5fa3b0ebb7f84c107dba1c1ca9a9b73995f668f)
  • Ignore nested files under a gitignore dir/* pattern (404a53e3e49fa7c1f51b60bcb30ea50450f75aab)
  • Track types referenced by JSDoc imports (resolve #1888) (6ae48aadbe03952690c8608e6df42bd039cf6624)
  • Update oxc-parser (02ca17a72c3f0afa7df32297d2dd2f5463ac6e00)
  • feat: markdownlint-cli2 (#1887) (323b96f55b38b53f5e4648d72fecd968fae35147) - thanks @​Zamiell!
  • Update rolldown snapshot (009e509dee6a5013fd3937abb4ec81684601b023)
  • Resolve $GITHUB_ACTION_PATH in GHA composite actions (ead489f066733f701acfe5b81eac0a6c813fb5c5)
  • Don't report node: specifiers as unlisted dependencies (1a7114f0a159fe82328041e11fc61c5c1730cc01)
  • Discover tsdown CLI entries (0d47a45bfc518a7bf73a4b4878aeab236d6f9791)
  • Discover Convex function modules (e01f21c44773186e7ad74e7badf9fc81b82edfb5)
  • Ignore common system binaries (cd003065fda5422550a412bba07ebbb1f9bae126)
  • Add OpenClaw plugin (73a2d7dd45f65ea312fde38cb4fa4f5a4fc34bf2)
  • Discover Tailwind CLI input stylesheet (resolve #1551) (9ae5feed922ecb7e8c436545e9b45125bd73b457)
  • Discover Angular global stylesheets from angular.json (fb9e0488f6f21284714d0651fcf1dd2de02d425a)
  • Hint when project patterns exclude a compiled extension (74de516d3d73839536fc2a43c2c0ec38a6299631)
  • Ignore common global binaries (a99a206015fe414a4de12016cc62499910afaf6f)
  • Run multiple preprocessors in sequence (844358367e9d1939bbf47f8dcb97d810741f56c1)
  • fix(nuxt): resolve nuxt module paths (#1896) (3c8594f5ffc641b00575b6d7455990db1277ac75) - thanks @​danielroe!
  • Report unused re-exports when ignoreExportsUsedInFile is set (#1895) (a113a5f4eedc81ef56b00a3e488cc94febefede5) - thanks @​mlm20!
  • Pass -w to pnpm add in sentry ecosystem test (ea8c8ac6fe9519f00ca6a61131b345f5de521704)
  • Update sentry snapshot (b75768d544d9f869ebce8f8c6dd8490f3db87023)
  • Record all traversed dirs in glob cache (resolve #1897) (81be1d436eae15518df764cbcb443899e11a9569)
  • Invalidate glob cache when .gitignore changes (baff301f2dceda97bf8bf73809d811cc44c72c8c)
  • Improve Nuxt and Nitro plugin resolution (86ffab7bcdd095631d6b0b17254e8acd6b5022bc)
  • fix: don't treat [-]-c[heck] as config flag for prettier (#1902) (b7266ee8240a9b8686e91a44a4706d3605d094c4) - thanks @​davidkna-sap!
  • Use Entra ID to publish VS Code extension (4236253482f884d92cfde2ccf85c7fb9aca17f7e)
  • Remove obsolete trust policy exclusions (630d5f9835f4303ec9aa7d090ad40a177808c4fb)
  • Update dependencies (810147b5aa21bb57ad103fd19ba92844e42cd84c)
  • Migrate from typescript/native-preview to typescript (140a25a577a64273a7a77f2ff2c8f224118ac298)

Release 6.27.0

  • Add Temporal plugin (98191a04aad0572bead191b101bfecef75067b0c)
  • Handle -d alias for react-email dir argument (53d1fec3213db8d6a84dfa7a82050b122782e065)
  • Expand pnpm script references with forwarded arguments (33e9799df39450033061b9c4c07daf22f5d15721)
  • Treat path-shaped script tokens as file references, extend known global binaries (d9508c282ab81351beda4b2f859435b49f142c51)
  • Mark tsdown neverBundle dependencies as referenced (5fd863ba12e68842f91ab1a94e7e30d1e571da92)
  • Support TanStack Start in tanstack-router plugin (bd63cd8af88dac03a98aa17f1add322f7bdf4a94)
  • Mark vite ssr.external dependencies as referenced (91de938032062cb667bced0eadef9e67d1e20b1f)
  • Expand bun, npm, and yarn script references with forwarded arguments (b5a31767a83e2cec3fb20c3b146d94c0412a4fd6)
  • Add Latitude as sponsor (42676759cad5fb10ac96fd7c0457037e906f4b68)
  • Regenerate plugin list in docs (1d2cdffb4d4151f848c44e066eff43e9efbf44fe)

... (truncated)

Commits
  • d9a6fe0 Release knip@6.29.0
  • 932b926 Fix -u shortcut for --duration
  • db05e01 Add built-in compiler for tsrx
  • b7d5ce2 fix(glob): do not follow symbolic links in async glob (#1900)
  • fc16b38 Release knip@6.28.0
  • 140a25a Migrate from typescript/native-preview to typescript
  • 810147b Update dependencies
  • b7266ee fix: don't treat [-]-c[heck] as config flag for prettier (#1902)
  • 86ffab7 Improve Nuxt and Nitro plugin resolution
  • baff301 Invalidate glob cache when .gitignore changes
  • Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.2.0

Release notes

Sourced from lint-staged's releases.

v17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

    Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

    Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};

v17.1.1

Patch Changes

  • #1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

v17.1.0

Minor Changes

  • #1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

    Before:

    Size of node_modules/ after installing: 1561.7 kB with 29 packages.

    Fancy interactive spinners, but output dynamically changes:

    ✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...
✔ Staging changes from tasks...
✔ Cleaning up temporary files...

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

    Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

    Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};

17.1.1

Patch Changes

  • #1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

17.1.0

Minor Changes

  • #1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

    Before:

    Size of node_modules/ after installing: 1561.7 kB with 29 packages.

    Fancy interactive spinners, but output dynamically changes:

    ✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...

... (truncated)

Commits
  • fb540fb Merge pull request #1824 from lint-staged/changeset-release/main
  • dc0a738 chore(changeset): release
  • 60cbb88 Merge pull request #1823 from lint-staged/reimplement-chunk-files
  • 2354dc4 build(deps): update dependencies
  • 0516e7f docs: adjust debug logs
  • e22f6ed style: run oxfmt on README.md
  • 37e8e1a fix: restore chunking of git add command after running tasks
  • 2c75f1d chore: remove unused file
  • ee156cc feat: add improved lazy-chunking of command strings
  • baa7c98 feat: remove current chunkFiles implementation
  • Additional commits viewable in compare view

Updates typescript-eslint from 8.64.0 to 8.65.0

Release notes

Sourced from typescript-eslint's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
  • typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the dev-dependencies group across 1 directory w…
0f13b50 
…ith 6 updates

Bumps the dev-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` |
| [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.8.0` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.26.0` | `6.29.0` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.2.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.64.0` | `8.65.0` |



Updates `@playwright/test` from 1.61.1 to 1.62.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.0)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 10.7.0 to 10.8.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.7.0...v10.8.0)

Updates `knip` from 6.26.0 to 6.29.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.29.0/packages/knip)

Updates `lint-staged` from 17.0.8 to 17.2.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.0.8...v17.2.0)

Updates `typescript-eslint` from 8.64.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.62.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: knip
  dependency-version: 6.29.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: lint-staged
  dependency-version: 17.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 29, 2026
Copilot AI review requested due to automatic review settings July 29, 2026 01:15
@dependabot dependabot Bot added javascript Pull requests that update javascript code dependencies Pull requests that update a dependency file labels Jul 29, 2026
Copilot AI reviewed Jul 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates JavaScript/TypeScript tooling devDependencies to newer patch/minor versions.

Changes:

  • Bumped Playwright and Node type definitions versions
  • Updated ESLint, knip, lint-staged, and typescript-eslint versions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@emnapi/core 1.11.2 🟢 3.6
Details
CheckScoreReason
Maintained🟢 1018 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 6/30 approved changesets -- score normalized to 2
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/runtime 1.11.2 🟢 3.6
Details
CheckScoreReason
Maintained🟢 1018 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 6/30 approved changesets -- score normalized to 2
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@eslint/config-helpers 0.7.0 UnknownUnknown
npm/@oxc-parser/binding-android-arm-eabi 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-android-arm64 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-darwin-arm64 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-darwin-x64 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-freebsd-x64 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-arm-gnueabihf 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-arm-musleabihf 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-arm64-gnu 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-arm64-musl 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-ppc64-gnu 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-riscv64-gnu 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-riscv64-musl 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-s390x-gnu 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-x64-gnu 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-linux-x64-musl 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-openharmony-arm64 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-wasm32-wasi 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-win32-arm64-msvc 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-win32-ia32-msvc 0.140.0 UnknownUnknown
npm/@oxc-parser/binding-win32-x64-msvc 0.140.0 UnknownUnknown
npm/@oxc-project/types 0.140.0 UnknownUnknown
npm/@oxc-resolver/binding-android-arm-eabi 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-android-arm64 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-darwin-arm64 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-darwin-x64 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-freebsd-x64 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-arm-gnueabihf 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-arm-musleabihf 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-arm64-gnu 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-arm64-musl 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-ppc64-gnu 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-riscv64-gnu 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-riscv64-musl 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-s390x-gnu 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-x64-gnu 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-linux-x64-musl 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-openharmony-arm64 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-wasm32-wasi 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-win32-arm64-msvc 11.24.2 UnknownUnknown
npm/@oxc-resolver/binding-win32-x64-msvc 11.24.2 UnknownUnknown
npm/@playwright/test 1.62.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/@types/node 26.1.2 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 8Found 24/30 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
npm/@typescript-eslint/eslint-plugin 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/parser 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/project-service 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/scope-manager 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/tsconfig-utils 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/type-utils 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/types 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/typescript-estree 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/utils 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/visitor-keys 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/brace-expansion 5.0.8 🟢 7.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1022 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Code-Review🟢 4Found 7/16 approved changesets -- score normalized to 4
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/eslint 10.8.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 25/27 approved changesets -- score normalized to 9
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 9SAST tool detected but not run on all commits
npm/knip 6.29.0 UnknownUnknown
npm/lint-staged 17.2.0 UnknownUnknown
npm/minimatch 10.2.6 🟢 5.6
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 52 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 5
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/oxc-parser 0.140.0 UnknownUnknown
npm/oxc-resolver 11.24.2 UnknownUnknown
npm/playwright 1.62.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/playwright-core 1.62.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/smol-toml 1.7.1 UnknownUnknown
npm/typescript-eslint 8.65.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/unbash 4.0.4 UnknownUnknown

Scanned Files

  • package-lock.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant