Skip to content

Bump the npm group with 18 updates#2190

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-284f740512
May 29, 2026
Merged

Bump the npm group with 18 updates#2190
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-284f740512

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 18 updates:

Package From To
vite 8.0.13 8.0.14
@oxc-project/types 0.130.0 0.132.0
@rolldown/binding-android-arm64 1.0.1 1.0.2
@rolldown/binding-darwin-arm64 1.0.1 1.0.2
@rolldown/binding-darwin-x64 1.0.1 1.0.2
@rolldown/binding-freebsd-x64 1.0.1 1.0.2
@rolldown/binding-linux-arm-gnueabihf 1.0.1 1.0.2
@rolldown/binding-linux-arm64-gnu 1.0.1 1.0.2
@rolldown/binding-linux-arm64-musl 1.0.1 1.0.2
@rolldown/binding-linux-ppc64-gnu 1.0.1 1.0.2
@rolldown/binding-linux-s390x-gnu 1.0.1 1.0.2
@rolldown/binding-linux-x64-gnu 1.0.1 1.0.2
@rolldown/binding-linux-x64-musl 1.0.1 1.0.2
@rolldown/binding-openharmony-arm64 1.0.1 1.0.2
@rolldown/binding-wasm32-wasi 1.0.1 1.0.2
@rolldown/binding-win32-arm64-msvc 1.0.1 1.0.2
@rolldown/binding-win32-x64-msvc 1.0.1 1.0.2
rolldown 1.0.1 1.0.2

Updates vite from 8.0.13 to 8.0.14

Release notes

Sourced from vite's releases.

v8.0.14

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.14 (2026-05-21)

Features

Bug Fixes

  • deps: update all non-major dependencies (#22471) (98b8163)
  • dev: handle errors when sending messages to vite server (#22450) (e8e9a34)
  • html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)
  • optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

  • deps: update rolldown-related dependencies (#22470) (7cb728e)
  • remove irrelevant commits from changelog (2c69495)

Code Refactoring

  • glob: do not rewrite import path for absolute base (#22310) (0ae2844)

Tests

Commits
  • c917f1e release: v8.0.14
  • 5d94d1b fix(html): handle trailing slash paths in transformIndexHtml (#22480)
  • 98b8163 fix(deps): update all non-major dependencies (#22471)
  • 96efc88 feat: update rolldown to 1.0.2 (#22484)
  • ebf39a0 test(css): sass does not use main field (#22449)
  • 0ae2844 refactor(glob): do not rewrite import path for absolute base (#22310)
  • 7cb728e chore(deps): update rolldown-related dependencies (#22470)
  • b3132da fix(optimizer): pass oxc jsx options to transformSync in dependency scan ...
  • e8e9a34 fix(dev): handle errors when sending messages to vite server (#22450)
  • 2c69495 chore: remove irrelevant commits from changelog
  • See full diff in compare view

Updates @oxc-project/types from 0.130.0 to 0.132.0

Release notes

Sourced from @​oxc-project/types's releases.

oxc crates_v0.132.0

🐛 Bug Fixes

  • 0f26de6 ecmascript: Resolve identifier value type via tracked constants (#22234) (Alexander Lichter)
  • c27a8cf minifier: Normalize { x: x } shorthand so adjacent-if merge is idempotent (#22401) (Dunqing)
  • e431a0e parser: Break extends clause loop on fatal error (#22517) (Boshen)
  • e9ec7c6 minifier: Fold optional chains by base nullishness (#22236) (Alexander Lichter)
  • e6090e7 transformer: Keep enum IIFE when a non-inlinable value reference remains (#22501) (Dunqing)
  • 931b7d6 transformer: Inline const enum members through type-cast wrappers (#22500) (Dunqing)
  • b9615b2 codegen: Preserve string quotes in require() calls during minification (#22475) (zennnnnnn11)
  • c73c159 transformer/async-to-generator: Reparent parameter initializer scopes (#22507) (camc314)
  • ecfd3ca transformer/async-to-generator: Move only parameter bindings (#22503) (camc314)
  • 3ce3431 transformer/explicit-resource-managment: Preserve shadowed for-head block (#22451) (camc314)

⚡ Performance

  • ce92c6c semantic: #[inline] Scoping::get_binding (#22414) (Dunqing)
  • 98be95c regular_expression: Track regex flags via bitflags (#22427) (Boshen)
  • dbbc059 jsdoc: Skip should_attach_jsdoc when no remaining comments (#22409) (Boshen)
  • 217d7d8 minifier: Index SymbolValues by SymbolId (#22441) (Dunqing)
  • d782b78 minifier: Use BitSet for LiveUsageCollector live references (#22425) (Boshen)

oxc crates_v0.131.0

🚀 Features

  • bc91a17 codegen: Expose Codegen::with_source_type method (#22432) (camc314)

🐛 Bug Fixes

  • 703557c codegen: Keep exports[STR] = … key as plain string in minify (#22402) (Dunqing)
  • 5ac7e79 minifier: Drop unused-var-init pure IIFEs and preserve annotation for downstream (#22349) (Dunqing)
  • 4ab57eb allocator: Fixed-size allocators use VirtualAlloc on Windows (#22124) (overlookmotel)
  • 66d77eb allocator: Fix segfault on Linux MUSL with fixed-size allocators (#22388) (overlookmotel)
  • b8fbc1f transformer/object-rest-spread: Correct scope id when moving bindings (#22419) (camc314)
  • 18edc2c codegen: Keep Object.defineProperty property name as plain string in minify (#22400) (Dunqing)
  • dda33de transformer/explicit-resource-management: Align lexical binding scopes (#22320) (camc314)
  • 8e79de8 transformer: Preserve for-await statement bodies (#22361) (camc314)
  • 0cba210 transformer/class: Replace new.target in static blocks (#22360) (camc314)
  • 67ab1c9 transformer/es2018/for-await: Hoist for-await generated bindings (#22355) (camc314)
  • c3ceb4a transformer/object-rest-spread: Use hoisted scope for for-of temp refs (#22347) (camc314)

⚡ Performance

  • 73a9043 allocator/bitset: Avoid temp heap String allocation (#22403) (camc314)
  • 8b2f4f9 transformer/object-rest-spread: Collect Vec<SymbolId over Vec<BindingIdentifier> (#22418) (camc314)
  • 83679ea parser: Split TriviaBuilder::handle_token hot/cold paths (#22415) (Boshen)
  • 2c7d781 codegen: Inline identifier-name accessors (#22411) (Boshen)
  • 618bc76 diagnostics: Inline OxcDiagnosticInner to avoid heap allocation (#22406) (Boshen)
  • 0b4e158 parser: Reserve cap 2 for sequence expressions vec (#22374) (camc314)
  • 5f3bdd0 codegen: Add #[inline] to code, code_len (#22373) (camc314)
Commits

Updates @rolldown/binding-android-arm64 from 1.0.1 to 1.0.2

Release notes

Sourced from @​rolldown/binding-android-arm64's releases.

v1.0.2

[1.0.2] - 2026-05-20

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

... (truncated)

Changelog

Sourced from @​rolldown/binding-android-arm64's changelog.

[1.0.2] - 2026-05-20

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

... (truncated)

Commits
  • f2757ed release: v1.0.2 (#9478)
  • b88de34 docs(devtools): document @​rolldown/debug usage and package graph consumption ...
  • 0f811f4 fix(hash): keep chunk file names stable when an unrelated entry is added (#9444)
  • ed010fa feat(devtools): emit package size in PackageGraphReady (#9434)
  • 2b0bb7f feat(devtools): classify package dependency types (#9427)
  • ff6fff2 fix: call codeSplitting.groups[].name in deterministic order (#9457)
  • 81fcc89 feat(devtools): map packages to modules and chunks (#9426)
  • 98619dd feat(devtools): mark used packages (#9423)
  • 0c7ac80 feat(devtools): make duplicate packages discoverable (#9422)
  • 98e0620 feat(devtools): emit package metadata (#9421)
  • Additional commits viewable in compare view

Updates @rolldown/binding-darwin-arm64 from 1.0.1 to 1.0.2

Release notes

Sourced from @​rolldown/binding-darwin-arm64's releases.

v1.0.2

[1.0.2] - 2026-05-20

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

... (truncated)

Changelog

Sourced from @​rolldown/binding-darwin-arm64's changelog.

[1.0.2] - 2026-05-20

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

... (truncated)

Commits
  • f2757ed release: v1.0.2 (#9478)
  • b88de34 docs(devtools): document @​rolldown/debug usage and package graph consumption ...
  • 0f811f4 fix(hash): keep chunk file names stable when an unrelated entry is added (#9444)
  • ed010fa feat(devtools): emit package size in PackageGraphReady (#9434)
  • 2b0bb7f feat(devtools): classify package dependency types (#9427)
  • ff6fff2 fix: call codeSplitting.groups[].name in deterministic order (#9457)
  • 81fcc89 feat(devtools): map packages to modules and chunks (#9426)
  • 98619dd feat(devtools): mark used packages (#9423)
  • 0c7ac80 feat(devtools): make duplicate packages discoverable (#9422)
  • 98e0620 feat(devtools): emit package metadata (#9421)
  • Additional commits viewable in compare view

Updates @rolldown/binding-darwin-x64 from 1.0.1 to 1.0.2

Release notes

Sourced from @​rolldown/binding-darwin-x64's releases.

v1.0.2

[1.0.2] - 2026-05-20

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

... (truncated)

Changelog

Sourced from @​rolldown/binding-darwin-x64's changelog.

[1.0.2] - 2026-05-20

🚀 Features

Bumps the npm group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.13` | `8.0.14` |
| [@oxc-project/types](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxc-types) | `0.130.0` | `0.132.0` |
| [@rolldown/binding-android-arm64](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-darwin-arm64](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-darwin-x64](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-freebsd-x64](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-linux-arm-gnueabihf](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-linux-arm64-gnu](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-linux-arm64-musl](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-linux-ppc64-gnu](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-linux-s390x-gnu](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-linux-x64-gnu](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-linux-x64-musl](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-openharmony-arm64](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-wasm32-wasi](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-win32-arm64-msvc](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [@rolldown/binding-win32-x64-msvc](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |
| [rolldown](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.0.1` | `1.0.2` |


Updates `vite` from 8.0.13 to 8.0.14
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.14/packages/vite)

Updates `@oxc-project/types` from 0.130.0 to 0.132.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxc-types/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/crates_v0.132.0/npm/oxc-types)

Updates `@rolldown/binding-android-arm64` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-darwin-arm64` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-darwin-x64` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-freebsd-x64` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-linux-arm-gnueabihf` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-linux-arm64-gnu` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-linux-arm64-musl` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-linux-ppc64-gnu` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-linux-s390x-gnu` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-linux-x64-gnu` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-linux-x64-musl` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-openharmony-arm64` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-wasm32-wasi` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-win32-arm64-msvc` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `@rolldown/binding-win32-x64-msvc` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

Updates `rolldown` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.0.2/packages/rolldown)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.0.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@oxc-project/types"
  dependency-version: 0.132.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@rolldown/binding-android-arm64"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-darwin-arm64"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-darwin-x64"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-freebsd-x64"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-linux-arm-gnueabihf"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-linux-arm64-gnu"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-linux-arm64-musl"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-linux-ppc64-gnu"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-linux-s390x-gnu"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-linux-x64-gnu"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-linux-x64-musl"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-openharmony-arm64"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-wasm32-wasi"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-win32-arm64-msvc"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rolldown/binding-win32-x64-msvc"
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: rolldown
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 29, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@oxc-project/types 0.132.0 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.0.2 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.0.2 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.0.2 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.0.2 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.0.2 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.0.2 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.0.2 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.0.2 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.0.2 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.0.2 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.0.2 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.0.2 UnknownUnknown
npm/@rolldown/binding-wasm32-wasi 1.0.2 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.0.2 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.0.2 UnknownUnknown
npm/rolldown 1.0.2 UnknownUnknown
npm/vite 8.0.14 🟢 7
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 5detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Binary-Artifacts🟢 5binaries present in source code
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
SAST🟢 7SAST tool is not run on all commits -- score normalized to 7

Scanned Files

  • pnpm-lock.yaml

@github-actions github-actions Bot enabled auto-merge (squash) May 29, 2026 01:39
@github-actions github-actions Bot merged commit 965651a into main May 29, 2026
4 checks passed
@github-actions github-actions Bot deleted the dependabot/npm_and_yarn/npm-284f740512 branch May 29, 2026 01:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant