Bump the npm group across 3 directories with 22 updates by dependabot[bot] · Pull Request #149 · poad/aws-lambda-mcp-server

dependabot · 2026-03-23T18:52:27Z

Bumps the npm group with 6 updates in the / directory:

Package	From	To
hono	`4.12.8`	`4.12.9`
typescript	`5.9.3`	`6.0.2`
typescript-eslint	`8.57.1`	`8.57.2`
vitest	`4.1.0`	`4.1.1`
constructs	`10.5.1`	`10.6.0`
@vitest/coverage-v8	`4.1.0`	`4.1.1`

Bumps the npm group with 6 updates in the /example directory:

Package	From	To
hono	`4.12.8`	`4.12.9`
typescript	`5.9.3`	`6.0.2`
typescript-eslint	`8.57.1`	`8.57.2`
vitest	`4.1.0`	`4.1.1`
constructs	`10.5.1`	`10.6.0`
@vitest/coverage-v8	`4.1.0`	`4.1.1`

Bumps the npm group with 3 updates in the /package directory: typescript, typescript-eslint and vitest.

Updates hono from 4.12.8 to 4.12.9

Release notes

Sourced from hono's releases.

v4.12.9

What's Changed

fix(request): remove parseBody from bodyCache to prevent TypeError by @yusukebe in honojs/hono#4807

feat(client): add PickResponseByStatusCode type by @yusukebe in honojs/hono#4791

fix(ssg): pass SSG_CONTEXT to forGetInfoURLRequest by @yuintei in honojs/hono#4810

fix(service-worker): make fire() fallback behavior consistent with handle() by @yusukebe in honojs/hono#4821

fix(cors): reflect request origin when credentials is true with wildcard by @ctonneslan in honojs/hono#4813

New Contributors

@yuintei made their first contribution in honojs/hono#4810

@ctonneslan made their first contribution in honojs/hono#4813

Full Changelog: honojs/hono@v4.12.8...v4.12.9

Commits

e1ae0eb 4.12.9
66fe9fe fix(cors): reflect request origin when credentials is true with wildcard (#4813)
50e2611 fix(service-worker): make fire() fallback behavior consistent with `handle(...
be85106 fix(ssg): pass SSG_CONTEXT to forGetInfoURLRequest (#4810)
d1722e3 feat(client): add PickResponseByStatusCode type (#4791)
8bd9ddd fix(request): remove parseBody from bodyCache to prevent TypeError (#4807)
See full diff in compare view

Updates typescript from 5.9.3 to 6.0.2

Release notes

Sourced from typescript's releases.

TypeScript 6.0

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

npm

Commits

607a22a Bump version to 6.0.2 and LKG
9e72ab7 🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...
35ff23d 🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...
e175b69 Bump version to 6.0.1-rc and LKG
af4caac Update LKG
8efd7e8 Merge remote-tracking branch 'origin/main' into release-6.0
206ed1a Deprecate assert in import() (#63172)
e688ac8 Update dependencies (#63156)
29b300d Bump the github-actions group across 1 directory with 2 updates (#63205)
0c2c7a3 DOM update (#63183)
Additional commits viewable in compare view

Updates typescript-eslint from 8.57.1 to 8.57.2

Release notes

Sourced from typescript-eslint's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

Claude Opus 4.6

Kirk Waiblinger @kirkwaiblinger

Konv Suu

mdm317

Newton Yuan @NewtonYuan

RyoheiYamamoto

SungHyun627 @SungHyun627

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.57.2 (2026-03-23)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

be4d54d chore(release): publish 8.57.2
See full diff in compare view

Updates vitest from 4.1.0 to 4.1.1

Release notes

Sourced from vitest's releases.

v4.1.1

   🚀 Features

experimental:

Expose matchesTags to test if the current filter matches tags - by @sheremet-va in vitest-dev/vitest#9913 (eec53)

Introduce experimental.vcsProvider - by @sheremet-va in vitest-dev/vitest#9928 (56115)

   🐞 Bug Fixes

Mark TestProject.testFilesList internal properly - by @sapphi-red in vitest-dev/vitest#9867 (54f26)

Detect fixture that returns without calling use - by @oilater in vitest-dev/vitest#9831 and vitest-dev/vitest#9861 (633ae)

Drop vite 8.beta support - by @AriPerkkio in vitest-dev/vitest#9862 (b78f5)

Type regression in vi.mocked() static class methods - by @purepear and @hi-ogawa in vitest-dev/vitest#9857 (90926)

Properly re-evaluate actual modules of mocked external - by @hi-ogawa in vitest-dev/vitest#9898 (ae5ec)

Preserve coverage report when html reporter overlaps - by @hi-ogawa in vitest-dev/vitest#9889 (2d81a)

Provide vi.advanceTimers to the preview provider - by @sheremet-va in vitest-dev/vitest#9891 (1bc3e)

Don't leak event listener in playwright provider - by @sheremet-va in vitest-dev/vitest#9910 (d9355)

Open browser in --standalone mode without running tests - by @sheremet-va in vitest-dev/vitest#9911 (e78ad)

Guard disposable and optional body - by @sheremet-va in vitest-dev/vitest#9912 (6fdb2)

Resolve retry.condition RegExp serialization issue - by @nstepien and @hi-ogawa in vitest-dev/vitest#9942 (7b605)

collect:

Don't treat extra props on test return as tests - by @sheremet-va in vitest-dev/vitest#9871 (141e7)

coverage:

Simplify provider types - by @AriPerkkio in vitest-dev/vitest#9931 (aaf9f)

Load built-in provider without module runner - by @AriPerkkio in vitest-dev/vitest#9939 (bf892)

expect:

Soft assertions continue after .resolves/.rejects promise errors - by @mixelburg, Maks Pikov, Claude Opus 4.6 (1M context) and @hi-ogawa in vitest-dev/vitest#9843 (6d74b)

Fix sinon-chai style API - by @hi-ogawa in vitest-dev/vitest#9943 (0f08d)

pretty-format:

Limit output for large object - by @hi-ogawa and Claude Opus 4.6 (1M context) in vitest-dev/vitest#9949 (0d5f9)

    View changes on GitHub

Commits

1f2d318 chore: release v4.1.1
ebfde79 refactor: rename matchesTagsFilter to matchesTags (#9956)
5611500 feat(experimental): introduce experimental.vcsProvider (#9928)
eec53d9 feat(experimental): expose matchesTagsFilter to test if the current filter ...
bf89208 fix(coverage): load built-in provider without module runner (#9939)
5a60868 refactor: fix typos (#9950)
aaf9f18 fix(coverage): simplify provider types (#9931)
6fdb2ba fix: guard disposable and optional body (#9912)
e78adcf fix: open browser in --standalone mode without running tests (#9911)
ae5ec03 fix: properly re-evaluate actual modules of mocked external (#9898)
Additional commits viewable in compare view

Updates constructs from 10.5.1 to 10.6.0

Release notes

Sourced from constructs's releases.

v10.6.0

10.6.0 (2026-03-23)

Features

add stackTraceOverride option to MetadataOptions (#2853) (f1fd286)

Commits

f1fd286 feat: add stackTraceOverride option to MetadataOptions (#2853)
809d63a chore(deps): upgrade dev dependencies (#2852)
c2298f1 chore(deps): upgrade dev dependencies (#2851)
eb0d022 chore(deps): upgrade dev dependencies (#2850)
780040f chore(deps): upgrade dev dependencies (#2849)
See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.0 to 4.1.1

Release notes

Sourced from @vitest/coverage-v8's releases.

v4.1.1

   🚀 Features

experimental:

Expose matchesTags to test if the current filter matches tags - by @sheremet-va in vitest-dev/vitest#9913 (eec53)

Introduce experimental.vcsProvider - by @sheremet-va in vitest-dev/vitest#9928 (56115)

   🐞 Bug Fixes

Mark TestProject.testFilesList internal properly - by @sapphi-red in vitest-dev/vitest#9867 (54f26)

Detect fixture that returns without calling use - by @oilater in vitest-dev/vitest#9831 and vitest-dev/vitest#9861 (633ae)

Drop vite 8.beta support - by @AriPerkkio in vitest-dev/vitest#9862 (b78f5)

Type regression in vi.mocked() static class methods - by @purepear and @hi-ogawa in vitest-dev/vitest#9857 (90926)

Properly re-evaluate actual modules of mocked external - by @hi-ogawa in vitest-dev/vitest#9898 (ae5ec)

Preserve coverage report when html reporter overlaps - by @hi-ogawa in vitest-dev/vitest#9889 (2d81a)

Provide vi.advanceTimers to the preview provider - by @sheremet-va in vitest-dev/vitest#9891 (1bc3e)

Don't leak event listener in playwright provider - by @sheremet-va in vitest-dev/vitest#9910 (d9355)

Open browser in --standalone mode without running tests - by @sheremet-va in vitest-dev/vitest#9911 (e78ad)

Guard disposable and optional body - by @sheremet-va in vitest-dev/vitest#9912 (6fdb2)

Resolve retry.condition RegExp serialization issue - by @nstepien and @hi-ogawa in vitest-dev/vitest#9942 (7b605)

collect:

Don't treat extra props on test return as tests - by @sheremet-va in vitest-dev/vitest#9871 (141e7)

coverage:

Simplify provider types - by @AriPerkkio in vitest-dev/vitest#9931 (aaf9f)

Load built-in provider without module runner - by @AriPerkkio in vitest-dev/vitest#9939 (bf892)

expect:

Soft assertions continue after .resolves/.rejects promise errors - by @mixelburg, Maks Pikov, Claude Opus 4.6 (1M context) and @hi-ogawa in vitest-dev/vitest#9843 (6d74b)

Fix sinon-chai style API - by @hi-ogawa in vitest-dev/vitest#9943 (0f08d)

pretty-format:

Limit output for large object - by @hi-ogawa and Claude Opus 4.6 (1M context) in vitest-dev/vitest#9949 (0d5f9)

    View changes on GitHub

Commits

1f2d318 chore: release v4.1.1
aaf9f18 fix(coverage): simplify provider types (#9931)
See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.57.1 to 8.57.2

Release notes

Sourced from @typescript-eslint/eslint-plugin's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

Claude Opus 4.6

Kirk Waiblinger @kirkwaiblinger

Konv Suu

mdm317

Newton Yuan @NewtonYuan

RyoheiYamamoto

SungHyun627 @SungHyun627

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/eslint-plugin's changelog.

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

❤️ Thank You

Kirk Waiblinger @kirkwaiblinger

Konv Suu

mdm317

Newton Yuan @NewtonYuan

SungHyun627 @SungHyun627

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

be4d54d chore(release): publish 8.57.2
f68c8e4 fix(eslint-plugin): [prefer-readonly-parameter-types] preserve type alias inf...
73acd2e fix(eslint-plugin): [no-useless-default-assignment] skip reporting false posi...
3d21482 fix(eslint-plugin): [no-unsafe-return] false positive on unwrapping generic (...
e128548 fix(eslint-plugin): [no-restricted-types] flag banned generics in extends or ...
2b7f63f chore(eslint-plugin): correct tsutils.isTypeFlag usage post-merge
65175cd fix(eslint-plugin): [array-type] ignore Array and ReadonlyArray without type ...
9c9ab5e feat(eslint-plugin): [no-unnecessary-type-arguments] report inferred required...
42a1c89 fix(eslint-plugin): [prefer-optional-chain] remove dangling closing parenthes...
71855ff docs(eslint-plugin): [no-unnecessary-condition] add link to TS handbook (#12131)
See full diff in compare view

Updates @typescript-eslint/parser from 8.57.1 to 8.57.2

Release notes

Sourced from @typescript-eslint/parser's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

Claude Opus 4.6

Kirk Waiblinger @kirkwaiblinger

Konv Suu

mdm317

Newton Yuan @NewtonYuan

RyoheiYamamoto

SungHyun627 @SungHyun627

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/parser's changelog.

8.57.2 (2026-03-23)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

be4d54d chore(release): publish 8.57.2
See full diff in compare view

Updates @typescript-eslint/project-service from 8.57.1 to 8.57.2

Release notes

Sourced from @typescript-eslint/project-service's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

Claude Opus 4.6

Kirk Waiblinger @kirkwaiblinger

Konv Suu

mdm317

Newton Yuan @NewtonYuan

RyoheiYamamoto

SungHyun627 @SungHyun627

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/project-service's changelog.

8.57.2 (2026-03-23)

This was a version bump only for project-service to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

be4d54d chore(release): publish 8.57.2
See full diff in compare view

Updates @typescript-eslint/scope-manager from 8.57.1 to 8.57.2

Release notes

Sourced from @typescript-eslint/scope-manager's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

Claude Opus 4.6

Kirk Waiblinger @kirkwaiblinger

Konv Suu

mdm317

Newton Yuan @NewtonYuan

RyoheiYamamoto

SungHyun627 @SungHyun627

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/scope-manager's changelog.

8.57.2 (2026-03-23)

This was a version bump only for scope-manager to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

be4d54d chore(release): publish 8.57.2
a8bbe16 chore(scope-manager): refactor populateGlobalsFromLib with tests and benchmar...
See full diff in compare view

Updates @typescript-eslint/tsconfig-utils from 8.57.1 to 8.57.2

Release notes

Sourced from @typescript-eslint/tsconfig-utils's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

Claude Opus 4.6

Kirk Waiblinger @kirkwaiblinger

Konv Suu

mdm317

Newton Yuan @NewtonYuan

RyoheiYamamoto

SungHyun627 @SungHyun627

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/tsconfig-utils's changelog.

8.57.2 (2026-03-23)

This was a version bump only for tsconfig-utils to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

be4d54d chore(release): publish 8.57.2
See full diff in compare view

Updates @typescript-eslint/type-utils from 8.57.1 to 8.57.2

Release notes

Sourced from @typescript-eslint/type-utils's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

Claude Opus 4.6

Kirk Waiblinger @kirkwaiblinger

Konv Suu

mdm317

Newton Yuan @NewtonYuan

RyoheiYamamoto

SungHyun627 @SungHyun627

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/type-utils's changelog.

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)

❤️ Thank You

Kirk Waiblinger @kirkwaiblinger

Tamashoo @Tamashoo

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

be4d54d chore(release): publish 8.57.2
f68c8e4 fix(eslint-plugin): [prefer-readonly-parameter-types] preserve type alias inf...
See full diff in compare view

Updates @typescript-eslint/typescript-estree from 8.57.1 to 8.57.2

Release notes

Sourced from @typescript-eslint/typescript-estree's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)

eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)

eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)

eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (

github-actions · 2026-03-23T18:52:42Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 2 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA fc28f82.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

example/package.json

Package	Version	License	Issue Type
hono	^4.12.9	Null	Unknown License

package/package.json

Package	Version	License	Issue Type
hono	^4.12.9	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@vitest/coverage-v8

4.1.1

Unknown

npm/constructs

10.6.0

🟢 7.5

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	19 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	🟢 10	SAST tool is run on all commits

npm/esbuild

^0.27.4

Unknown

npm/hono

^4.12.9

Unknown

npm/typescript

6.0.2

🟢 8.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 10	all changesets reviewed
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Fuzzing	🟢 10	project is fuzzed
Branch-Protection	⚠️ -1	internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
SAST	🟢 10	SAST tool is run on all commits
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 35 contributing companies or organizations

npm/typescript-eslint

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/vitest

4.1.1

Unknown

npm/hono

^4.12.9

Unknown

npm/typescript

6.0.2

🟢 8.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 10	all changesets reviewed
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Fuzzing	🟢 10	project is fuzzed
Branch-Protection	⚠️ -1	internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
SAST	🟢 10	SAST tool is run on all commits
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 35 contributing companies or organizations

npm/typescript-eslint

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/vitest

4.1.1

Unknown

npm/@emnapi/core

1.9.1

🟢 3.8

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@emnapi/runtime

1.9.1

🟢 3.8

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/eslint-plugin

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/parser

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/project-service

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/scope-manager

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/tsconfig-utils

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/type-utils

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/types

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/typescript-estree

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/utils

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/visitor-keys

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@vitest/coverage-v8

4.1.1

Unknown

npm/@vitest/expect

4.1.1

Unknown

npm/@vitest/mocker

4.1.1

Unknown

npm/@vitest/pretty-format

4.1.1

Unknown

npm/@vitest/runner

4.1.1

Unknown

npm/@vitest/snapshot

4.1.1

Unknown

npm/@vitest/spy

4.1.1

Unknown

npm/@vitest/utils

4.1.1

Unknown

npm/balanced-match

1.0.2

🟢 5.7

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	12 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 2	Found 4/17 approved changesets -- score normalized to 2
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/brace-expansion

1.1.12

🟢 6.3

Details

Check	Score	Reason
Code-Review	⚠️ 2	Found 7/25 approved changesets -- score normalized to 2
Maintained	🟢 10	13 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/concat-map

0.0.1

🟢 4.6

Details

Check	Score	Reason
Maintained	⚠️ 0	0 commit(s) out of 17 and 0 issue activity out of 6 found in the last 90 days -- score normalized to 0
Code-Review	⚠️ 0	no reviews found
CII-Best-Practices	⚠️ 0	no badge detected
Vulnerabilities	🟢 10	no vulnerabilities detected
License	🟢 10	license file detected
Packaging	⚠️ -1	no published package detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	tokens are read-only in GitHub workflows
Pinned-Dependencies	🟢 10	all dependencies are pinned
SAST	⚠️ 0	no SAST tool detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Dependency-Update-Tool	⚠️ 0	no update tool detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected

npm/constructs

10.6.0

🟢 7.5

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	19 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	🟢 10	SAST tool is run on all commits

npm/get-tsconfig

4.13.7

Unknown

npm/hono

4.12.9

Unknown

npm/minimatch

3.1.5

🟢 6.2

Details

Check	Score	Reason
Maintained	🟢 10	23 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 1/28 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/picomatch

4.0.4

🟢 4.7

Details

Check	Score	Reason
Code-Review	🟢 4	Found 8/19 approved changesets -- score normalized to 4
Packaging	⚠️ -1	packaging workflow not detected
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
SAST	🟢 7	SAST tool detected but not run on all commits

npm/typescript

6.0.2

🟢 8.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 10	all changesets reviewed
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Fuzzing	🟢 10	project is fuzzed
Branch-Protection	⚠️ -1	internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
SAST	🟢 10	SAST tool is run on all commits
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 35 contributing companies or organizations

npm/typescript-eslint

8.57.2

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/vitest

4.1.1

Unknown

Scanned Files

.github/workflows/ci.yml
example/package.json
package/package.json
pnpm-lock.yaml

Bumps the npm group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [hono](https://github.com/honojs/hono) | `4.12.8` | `4.12.9` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.57.1` | `8.57.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.0` | `4.1.1` | | [constructs](https://github.com/aws/constructs) | `10.5.1` | `10.6.0` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.0` | `4.1.1` | Bumps the npm group with 6 updates in the /example directory: | Package | From | To | | --- | --- | --- | | [hono](https://github.com/honojs/hono) | `4.12.8` | `4.12.9` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.57.1` | `8.57.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.0` | `4.1.1` | | [constructs](https://github.com/aws/constructs) | `10.5.1` | `10.6.0` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.0` | `4.1.1` | Bumps the npm group with 3 updates in the /package directory: [typescript](https://github.com/microsoft/TypeScript), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `hono` from 4.12.8 to 4.12.9 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.8...v4.12.9) Updates `typescript` from 5.9.3 to 6.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.2) Updates `typescript-eslint` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/typescript-eslint) Updates `vitest` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/vitest) Updates `constructs` from 10.5.1 to 10.6.0 - [Release notes](https://github.com/aws/constructs/releases) - [Commits](aws/constructs@v10.5.1...v10.6.0) Updates `@vitest/coverage-v8` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/coverage-v8) Updates `@typescript-eslint/eslint-plugin` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/parser) Updates `@typescript-eslint/project-service` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/project-service/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/project-service) Updates `@typescript-eslint/scope-manager` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/scope-manager/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/scope-manager) Updates `@typescript-eslint/tsconfig-utils` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/tsconfig-utils/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/tsconfig-utils) Updates `@typescript-eslint/type-utils` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/type-utils/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/type-utils) Updates `@typescript-eslint/typescript-estree` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-estree/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/typescript-estree) Updates `@typescript-eslint/utils` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/utils/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/utils) Updates `@typescript-eslint/visitor-keys` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/visitor-keys/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/visitor-keys) Updates `@vitest/expect` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/expect) Updates `@vitest/mocker` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/mocker) Updates `@vitest/pretty-format` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/pretty-format) Updates `@vitest/runner` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/runner) Updates `@vitest/snapshot` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/snapshot) Updates `@vitest/spy` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/spy) Updates `@vitest/utils` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/utils) Updates `hono` from 4.12.8 to 4.12.9 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.8...v4.12.9) Updates `typescript` from 5.9.3 to 6.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.2) Updates `typescript-eslint` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/typescript-eslint) Updates `vitest` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/vitest) Updates `constructs` from 10.5.1 to 10.6.0 - [Release notes](https://github.com/aws/constructs/releases) - [Commits](aws/constructs@v10.5.1...v10.6.0) Updates `@vitest/coverage-v8` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/coverage-v8) Updates `typescript` from 5.9.3 to 6.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.2) Updates `typescript-eslint` from 8.57.1 to 8.57.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/typescript-eslint) Updates `vitest` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/vitest) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: typescript dependency-version: 6.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm - dependency-name: typescript-eslint dependency-version: 8.57.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: vitest dependency-version: 4.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: constructs dependency-version: 10.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/parser" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/project-service" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/scope-manager" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/tsconfig-utils" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/type-utils" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/typescript-estree" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/utils" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/visitor-keys" dependency-version: 8.57.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vitest/expect" dependency-version: 4.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vitest/mocker" dependency-version: 4.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vitest/pretty-format" dependency-version: 4.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vitest/runner" dependency-version: 4.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vitest/snapshot" dependency-version: 4.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vitest/spy" dependency-version: 4.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vitest/utils" dependency-version: 4.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: hono dependency-version: 4.12.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: typescript dependency-version: 6.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm - dependency-name: typescript-eslint dependency-version: 8.57.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: vitest dependency-version: 4.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: constructs dependency-version: 10.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: typescript dependency-version: 6.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm - dependency-name: typescript-eslint dependency-version: 8.57.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: vitest dependency-version: 4.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot assigned poad Mar 23, 2026

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 23, 2026

github-actions Bot approved these changes Mar 23, 2026

View reviewed changes

github-actions Bot enabled auto-merge (squash) March 23, 2026 18:52

poad force-pushed the dependabot/npm_and_yarn/npm-9bd30365cc branch from c26569c to d94540b Compare March 24, 2026 10:25