Skip to content

Bump the npm group with 17 updates#2110

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-3d17b2ecc2
Jan 26, 2026
Merged

Bump the npm group with 17 updates#2110
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-3d17b2ecc2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jan 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 17 updates:

Package From To
@types/node 25.0.9 25.0.10
@vitest/coverage-v8 4.0.17 4.0.18
prettier 3.8.0 3.8.1
vitest 4.0.17 4.0.18
@typescript-eslint/types 8.53.0 8.53.1
@vitest/expect 4.0.17 4.0.18
@vitest/mocker 4.0.17 4.0.18
@vitest/pretty-format 4.0.17 4.0.18
@vitest/runner 4.0.17 4.0.18
@vitest/snapshot 4.0.17 4.0.18
@vitest/spy 4.0.17 4.0.18
@vitest/utils 4.0.17 4.0.18
baseline-browser-mapping 2.9.17 2.9.18
caniuse-lite 1.0.30001765 1.0.30001766
electron-to-chromium 1.5.267 1.5.278
lodash 4.17.21 4.17.23
rollup 4.55.3 4.56.0

Updates @types/node from 25.0.9 to 25.0.10

Commits

Updates @vitest/coverage-v8 from 4.0.17 to 4.0.18

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates prettier from 3.8.0 to 3.8.1

Release notes

Sourced from prettier's releases.

3.8.1

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.8.1

diff

Include available printers in plugin type declarations (#18706 by @​porada)

// Input
import * as prettierPluginEstree from "prettier/plugins/estree";
// Prettier 3.8.0
// Property 'printers' does not exist on type 'typeof import("prettier/plugins/estree")'. ts(2339)
prettierPluginEstree.printers.estree; //=> any
// Prettier 3.8.1
prettierPluginEstree.printers.estree; //=> Printer
prettierPluginEstree.printers["estree-json"]; //=> Printer

Commits

Updates vitest from 4.0.17 to 4.0.18

Release notes

Sourced from vitest's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @typescript-eslint/types from 8.53.0 to 8.53.1

Release notes

Sourced from @​typescript-eslint/types's releases.

v8.53.1

8.53.1 (2026-01-19)

🩹 Fixes

  • eslint-plugin: [consistent-indexed-object-style] skip fixer if interface is a default export (#11951)
  • utils: make RuleCreator root defaultOptions optional (#11956)

❤️ Thank You

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/types's changelog.

8.53.1 (2026-01-19)

This was a version bump only for types to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates @vitest/expect from 4.0.17 to 4.0.18

Release notes

Sourced from @​vitest/expect's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @vitest/mocker from 4.0.17 to 4.0.18

Release notes

Sourced from @​vitest/mocker's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @vitest/pretty-format from 4.0.17 to 4.0.18

Release notes

Sourced from @​vitest/pretty-format's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @vitest/runner from 4.0.17 to 4.0.18

Release notes

Sourced from @​vitest/runner's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @vitest/snapshot from 4.0.17 to 4.0.18

Release notes

Sourced from @​vitest/snapshot's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @vitest/spy from 4.0.17 to 4.0.18

Release notes

Sourced from @​vitest/spy's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @vitest/utils from 4.0.17 to 4.0.18

Release notes

Sourced from @​vitest/utils's releases.

v4.0.18

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates baseline-browser-mapping from 2.9.17 to 2.9.18

Release notes

Sourced from baseline-browser-mapping's releases.

v2.9.3 - remove process.loadEnvFile()

What's Changed

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

Commits

Updates caniuse-lite from 1.0.30001765 to 1.0.30001766

Commits

Updates electron-to-chromium from 1.5.267 to 1.5.278

Commits

Updates lodash from 4.17.21 to 4.17.23

Commits

Updates rollup from 4.55.3 to 4.56.0

Release notes

Sourced from rollup's releases.

v4.56.0

4.56.0

2026-01-22

Features

  • Track object property inclusions of dynamic namespace members (#6230)

Bug Fixes

  • Handle methods that access dynamically imported namespace members via this (#6230)

Pull Requests

Changelog

Sourced from rollup's changelog.

4.56.0

2026-01-22

Features

  • Track object property inclusions of dynamic namespace members (#6230)

Bug Fixes

  • Handle methods that access dynamically imported namespace members via this (#6230)

Pull Requests

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm group with 17 updates
1faa226 
Bumps the npm group with 17 updates:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.0.9` | `25.0.10` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.17` | `4.0.18` |
| [prettier](https://github.com/prettier/prettier) | `3.8.0` | `3.8.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.17` | `4.0.18` |
| [@typescript-eslint/types](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/types) | `8.53.0` | `8.53.1` |
| [@vitest/expect](https://github.com/vitest-dev/vitest/tree/HEAD/packages/expect) | `4.0.17` | `4.0.18` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.0.17` | `4.0.18` |
| [@vitest/pretty-format](https://github.com/vitest-dev/vitest/tree/HEAD/packages/pretty-format) | `4.0.17` | `4.0.18` |
| [@vitest/runner](https://github.com/vitest-dev/vitest/tree/HEAD/packages/runner) | `4.0.17` | `4.0.18` |
| [@vitest/snapshot](https://github.com/vitest-dev/vitest/tree/HEAD/packages/snapshot) | `4.0.17` | `4.0.18` |
| [@vitest/spy](https://github.com/vitest-dev/vitest/tree/HEAD/packages/spy) | `4.0.17` | `4.0.18` |
| [@vitest/utils](https://github.com/vitest-dev/vitest/tree/HEAD/packages/utils) | `4.0.17` | `4.0.18` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.9.17` | `2.9.18` |
| [caniuse-lite](https://github.com/browserslist/caniuse-lite) | `1.0.30001765` | `1.0.30001766` |
| [electron-to-chromium](https://github.com/kilian/electron-to-chromium) | `1.5.267` | `1.5.278` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [rollup](https://github.com/rollup/rollup) | `4.55.3` | `4.56.0` |


Updates `@types/node` from 25.0.9 to 25.0.10
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/coverage-v8)

Updates `prettier` from 3.8.0 to 3.8.1
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.0...3.8.1)

Updates `vitest` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/vitest)

Updates `@typescript-eslint/types` from 8.53.0 to 8.53.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/types/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.53.1/packages/types)

Updates `@vitest/expect` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/expect)

Updates `@vitest/mocker` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/mocker)

Updates `@vitest/pretty-format` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/pretty-format)

Updates `@vitest/runner` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/runner)

Updates `@vitest/snapshot` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/snapshot)

Updates `@vitest/spy` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/spy)

Updates `@vitest/utils` from 4.0.17 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/utils)

Updates `baseline-browser-mapping` from 2.9.17 to 2.9.18
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.9.17...v2.9.18)

Updates `caniuse-lite` from 1.0.30001765 to 1.0.30001766
- [Commits](browserslist/caniuse-lite@1.0.30001765...1.0.30001766)

Updates `electron-to-chromium` from 1.5.267 to 1.5.278
- [Changelog](https://github.com/Kilian/electron-to-chromium/blob/master/CHANGELOG.md)
- [Commits](Kilian/electron-to-chromium@v1.5.267...v1.5.278)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `rollup` from 4.55.3 to 4.56.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.55.3...v4.56.0)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.0.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.0.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: prettier
  dependency-version: 3.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 4.0.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@typescript-eslint/types"
  dependency-version: 8.53.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/expect"
  dependency-version: 4.0.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/mocker"
  dependency-version: 4.0.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/pretty-format"
  dependency-version: 4.0.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/runner"
  dependency-version: 4.0.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/snapshot"
  dependency-version: 4.0.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/spy"
  dependency-version: 4.0.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/utils"
  dependency-version: 4.0.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: baseline-browser-mapping
  dependency-version: 2.9.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: caniuse-lite
  dependency-version: 1.0.30001766
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: electron-to-chromium
  dependency-version: 1.5.278
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: rollup
  dependency-version: 4.56.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jan 26, 2026
@github-actions github-actions Bot enabled auto-merge (squash) January 26, 2026 01:54
@github-actions

github-actions Bot commented Jan 26, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 27 package(s) with unknown licenses.
See the Details below.

License Issues

pnpm-lock.yaml

PackageVersionLicenseIssue Type
@rollup/rollup-android-arm-eabi4.56.0NullUnknown License
@rollup/rollup-android-arm644.56.0NullUnknown License
@rollup/rollup-darwin-arm644.56.0NullUnknown License
@rollup/rollup-darwin-x644.56.0NullUnknown License
@rollup/rollup-freebsd-arm644.56.0NullUnknown License
@rollup/rollup-freebsd-x644.56.0NullUnknown License
@rollup/rollup-linux-arm-gnueabihf4.56.0NullUnknown License
@rollup/rollup-linux-arm-musleabihf4.56.0NullUnknown License
@rollup/rollup-linux-arm64-gnu4.56.0NullUnknown License
@rollup/rollup-linux-arm64-musl4.56.0NullUnknown License
@rollup/rollup-linux-loong64-gnu4.56.0NullUnknown License
@rollup/rollup-linux-loong64-musl4.56.0NullUnknown License
@rollup/rollup-linux-ppc64-gnu4.56.0NullUnknown License
@rollup/rollup-linux-ppc64-musl4.56.0NullUnknown License
@rollup/rollup-linux-riscv64-gnu4.56.0NullUnknown License
@rollup/rollup-linux-riscv64-musl4.56.0NullUnknown License
@rollup/rollup-linux-s390x-gnu4.56.0NullUnknown License
@rollup/rollup-linux-x64-gnu4.56.0NullUnknown License
@rollup/rollup-linux-x64-musl4.56.0NullUnknown License
@rollup/rollup-openbsd-x644.56.0NullUnknown License
@rollup/rollup-openharmony-arm644.56.0NullUnknown License
@rollup/rollup-win32-arm64-msvc4.56.0NullUnknown License
@rollup/rollup-win32-ia32-msvc4.56.0NullUnknown License
@rollup/rollup-win32-x64-gnu4.56.0NullUnknown License
@rollup/rollup-win32-x64-msvc4.56.0NullUnknown License
lodash4.17.23NullUnknown License
rollup4.56.0NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@rollup/rollup-android-arm-eabi 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-android-arm64 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-darwin-arm64 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-darwin-x64 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-freebsd-arm64 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-freebsd-x64 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-arm-gnueabihf 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-arm-musleabihf 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-arm64-gnu 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-arm64-musl 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-loong64-gnu 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-loong64-musl 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-ppc64-gnu 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-ppc64-musl 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-riscv64-gnu 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-riscv64-musl 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-s390x-gnu 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-x64-gnu 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-linux-x64-musl 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-openbsd-x64 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-openharmony-arm64 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-win32-arm64-msvc 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-win32-ia32-msvc 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-win32-x64-gnu 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@rollup/rollup-win32-x64-msvc 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/@vitest/coverage-v8 4.0.18 UnknownUnknown
npm/@vitest/expect 4.0.18 UnknownUnknown
npm/@vitest/mocker 4.0.18 UnknownUnknown
npm/@vitest/pretty-format 4.0.18 UnknownUnknown
npm/@vitest/runner 4.0.18 UnknownUnknown
npm/@vitest/snapshot 4.0.18 UnknownUnknown
npm/@vitest/spy 4.0.18 UnknownUnknown
npm/@vitest/utils 4.0.18 UnknownUnknown
npm/baseline-browser-mapping 2.9.18 UnknownUnknown
npm/caniuse-lite 1.0.30001766 🟢 4.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1013 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
SAST⚠️ 0no SAST tool detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy⚠️ 0security policy file not detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 91 existing vulnerabilities detected
npm/electron-to-chromium 1.5.278 UnknownUnknown
npm/lodash 4.17.23 🟢 6.8
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 715 out of 21 merged PRs checked by a CI test -- score normalized to 7
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 6Found 20/30 approved changesets -- score normalized to 6
Contributors🟢 10project has 88 contributing companies or organizations
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Maintained🟢 1021 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
SAST🟢 8SAST tool detected but not run on all commits
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Vulnerabilities⚠️ 077 existing vulnerabilities detected
npm/prettier 3.8.1 🟢 6.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 1/23 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/rollup 4.56.0 🟢 6.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/18 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 64 existing vulnerabilities detected
npm/vitest 4.0.18 UnknownUnknown

Scanned Files

  • pnpm-lock.yaml

@github-actions github-actions Bot merged commit 826c3a2 into main Jan 26, 2026
5 checks passed
@github-actions github-actions Bot deleted the dependabot/npm_and_yarn/npm-3d17b2ecc2 branch January 26, 2026 01:54
@github-actions github-actions Bot mentioned this pull request Feb 22, 2026
Closed
@my-pull-request-auto-merge my-pull-request-auto-merge Bot mentioned this pull request Feb 22, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

@poad poad

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@poad