Skip to content

Bump the npm group across 3 directories with 6 updates - #206

Merged
github-actions[bot] merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-f3a0b10681
May 27, 2026
Merged

Bump the npm group across 3 directories with 6 updates#206
github-actions[bot] merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-f3a0b10681

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 27, 2026

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Bumps the npm group with 5 updates in the / directory:

Package From To
hono 4.12.19 4.12.21
@types/node 25.9.0 25.9.1
tsx 4.22.2 4.22.3
aws-cdk-lib 2.254.0 2.255.0
aws-cdk 2.1122.0 2.1123.0

Bumps the npm group with 5 updates in the /example directory:

Package From To
hono 4.12.19 4.12.21
@types/node 25.9.0 25.9.1
tsx 4.22.2 4.22.3
aws-cdk-lib 2.254.0 2.255.0
aws-cdk 2.1122.0 2.1123.0

Bumps the npm group with 2 updates in the /package directory: @types/node and tsx.

Updates hono from 4.12.19 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474


Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

Commits

Updates @types/node from 25.9.0 to 25.9.1

Commits

Updates tsx from 4.22.2 to 4.22.3

Release notes

Sourced from tsx's releases.

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

  • decode typed loader source (dce02fc)
  • preserve entrypoint with TypeScript preload hooks (68f72f3)

This release is also available on:

Commits
  • dce02fc fix: decode typed loader source
  • 68f72f3 fix: preserve entrypoint with TypeScript preload hooks
  • 69455cf test: cover package exports for ambiguous ESM reexports
  • See full diff in compare view

Updates aws-cdk-lib from 2.254.0 to 2.255.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.255.0

Features

  • aws-cdk-lib: emits performance counters if synthesis is slow (#37843) (ea33967)
  • bedrockagentcore: graduate to stable 🚀 (#37876) (00cf601)
  • core: builtin PropertyMergeStrategys are now compatible with deferred Box values (#37844) (ca4b722)
  • core: persist asset fingerprinting cache (#37822) (605a776)
  • ec2: add C8A instance type support (#36736) (0d088ca), closes #36722

Bug Fixes

  • core: cached Lazys use the Box API internally (#37889) (464fa3d)
  • core: default stack trace size adds unnecessary overhead (#37827) (0b1fb2b)
  • core: share a single IAM role across cross-account Fn::GetStackOutput consumers (#37871) (fee8b90)
  • dynamodb: remove deprecated scope for stream grants (#36680) (570d552), closes #36289
  • iam: validate PolicyStatement SID is alphanumeric for identity policies (#36150) (a7edd72), closes #34819 #34828 #34819

Alpha modules (2.255.0-alpha.0)

Features

  • bedrock-agentcore-alpha: Graduation of the library to stable. The Policy submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in aws-cdk-lib/aws-bedrockagentcore and we recommend migrating to the stable versions (#37876) (00cf601)
Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.257.0-alpha.0 (2026-05-21)

2.256.1-alpha.0 (2026-05-20)

2.256.0-alpha.0 (2026-05-19)

2.255.0-alpha.0 (2026-05-18)

Features

  • bedrock-agentcore-alpha: Graduation of the library to stable. The Policy submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in aws-cdk-lib/aws-bedrockagentcore and we recommend migrating to the stable versions (#37876) (00cf601)

2.254.0-alpha.0 (2026-05-13)

Features

  • bedrock-agentcore-alpha: add tags support to Evaluator and OnlineEvaluationConfig (#37804) (adbf88f)
  • bedrock-agentcore-alpha: add identity L2 constructs (#37610) (67c3af2)
  • mediapackagev2-alpha: add OAC integration between CloudFront and MediaPackageV2 (#37701) (654f59c)

Bug Fixes

  • bedrock-agentcore-alpha: fix cedar policy bug (#37782) (e678d5c), closes #37828
  • custom-resource-handlers: deployment fails when parameter already exists (#37852) (025c38c)

2.253.1-alpha.0 (2026-05-08)

2.253.0-alpha.0 (2026-05-06)

Features

  • bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
  • glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

  • bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

... (truncated)

Commits
  • 45b8157 chore: revert "feat(aws-cdk-lib): emits performance counters if synthesis is ...
  • beb0bf0 chore: update analytics metadata blueprints
  • 00cf601 feat(bedrockagentcore): graduate to stable 🚀 (#37876)
  • 0d088ca feat(ec2): add C8A instance type support (#36736)
  • 464fa3d fix(core): cached Lazys use the Box API internally (#37889)
  • ea33967 feat(aws-cdk-lib): emits performance counters if synthesis is slow (#37843)
  • 65a36c5 docs(ec2): remove developer preview mention (#37846)
  • fee8b90 fix(core): share a single IAM role across cross-account Fn::GetStackOutput co...
  • 0ca0835 docs: document new understanding of failing resource deletes (#37886)
  • ea769d4 Merge branch 'main' into merge-back/2.254.0
  • Additional commits viewable in compare view

Updates aws-cdk from 2.1122.0 to 2.1123.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1123.0

2.1123.0 (2026-05-19)

Features

Bug Fixes

Commits
  • de82699 fix(cloud-assembly-api): widen jsonschema range to fix npm ci on npm 11 (#1529)
  • abd4f4c feat(cli): warn on unrecognized CLI options (#1514)
  • 319e3a8 chore(deps): bump @​aws-sdk/client-appsync from 3.1041.0 to 3.1045.0 (#1520)
  • 9165482 chore(deps): upgrade dependencies (#1518)
  • ae2349b feat(cli): add --region as a global CLI option (#1506)
  • See full diff in compare view

Updates @aws-cdk/cloud-assembly-schema from 53.24.0 to 53.25.0

Release notes

Sourced from @​aws-cdk/cloud-assembly-schema's releases.

@​aws-cdk/cloud-assembly-schema@​v53.25.0

53.25.0 (2026-05-19)

Bug Fixes

Commits

Updates hono from 4.12.19 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474


Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

Commits

Updates @types/node from 25.9.0 to 25.9.1

Commits

Updates tsx from 4.22.2 to 4.22.3

Release notes

Sourced from tsx's releases.

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

  • decode typed loader source (dce02fc)
  • preserve entrypoint with TypeScript preload hooks (68f72f3)

This release is also available on:

Commits
  • dce02fc fix: decode typed loader source
  • 68f72f3 fix: preserve entrypoint with TypeScript preload hooks
  • 69455cf test: cover package exports for ambiguous ESM reexports
  • See full diff in compare view

Updates aws-cdk-lib from 2.254.0 to 2.255.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.255.0

Features

  • aws-cdk-lib: emits performance counters if synthesis is slow (#37843) (ea33967)
  • bedrockagentcore: graduate to stable 🚀 (#37876) (00cf601)
  • core: builtin PropertyMergeStrategys are now compatible with deferred Box values (#37844) (ca4b722)
  • core: persist asset fingerprinting cache (#37822) (605a776)
  • ec2: add C8A instance type support (#36736) (0d088ca), closes #36722

Bug Fixes

  • core: cached Lazys use the Box API internally (#37889) (464fa3d)
  • core: default stack trace size adds unnecessary overhead (#37827) (0b1fb2b)
  • core: share a single IAM role across cross-account Fn::GetStackOutput consumers (#37871) (fee8b90)
  • dynamodb: remove deprecated scope for stream grants (#36680) (570d552), closes #36289
  • iam: validate PolicyStatement SID is alphanumeric for identity policies (#36150) (a7edd72), closes #34819 #34828 #34819

Alpha modules (2.255.0-alpha.0)

Features

  • bedrock-agentcore-alpha: Graduation of the library to stable. The Policy submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in aws-cdk-lib/aws-bedrockagentcore and we recommend migrating to the stable versions (#37876) (00cf601)
Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.257.0-alpha.0 (2026-05-21)

2.256.1-alpha.0 (2026-05-20)

2.256.0-alpha.0 (2026-05-19)

2.255.0-alpha.0 (2026-05-18)

Features

  • bedrock-agentcore-alpha: Graduation of the library to stable. The Policy submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in aws-cdk-lib/aws-bedrockagentcore and we recommend migrating to the stable versions (#37876) (00cf601)

2.254.0-alpha.0 (2026-05-13)

Features

  • bedrock-agentcore-alpha: add tags support to Evaluator and OnlineEvaluationConfig (#37804) (adbf88f)
  • bedrock-agentcore-alpha: add identity L2 constructs (#37610) (67c3af2)
  • mediapackagev2-alpha: add OAC integration between CloudFront and MediaPackageV2 (#37701) (654f59c)

Bug Fixes

  • bedrock-agentcore-alpha: fix cedar policy bug (#37782) (e678d5c), closes #37828
  • custom-resource-handlers: deployment fails when parameter already exists (#37852) (025c38c)

2.253.1-alpha.0 (2026-05-08)

2.253.0-alpha.0 (2026-05-06)

Features

  • bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
  • glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

  • bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

... (truncated)

Commits
  • 45b8157 chore: revert "feat(aws-cdk-lib): emits performance counters if synthesis is ...
  • beb0bf0 chore: update analytics metadata blueprints
  • 00cf601 feat(bedrockagentcore): graduate to stable 🚀 (#37876)
  • 0d088ca feat(ec2): add C8A instance type support (#36736)
  • 464fa3d fix(core): cached Lazys use the Box API internally (#37889)
  • ea33967 feat(aws-cdk-lib): emits performance counters if synthesis is slow (#37843)
  • 65a36c5 docs(ec2): remove developer preview mention (#37846)
  • fee8b90 fix(core): share a single IAM role across cross-account Fn::GetStackOutput co...
  • 0ca0835 docs: document new understanding of failing resource deletes (#37886)
  • ea769d4 Merge branch 'main' into merge-back/2.254.0
  • Additional commits viewable in compare view

Updates aws-cdk from 2.1122.0 to 2.1123.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1123.0

2.1123.0 (2026-05-19)

Features

Bug Fixes

Commits
  • de82699 fix(cloud-assembly-api): widen jsonschema range to fix npm ci on npm 11 (#1529)
  • abd4f4c feat(cli): warn on unrecognized CLI options (#1514)
  • 319e3a8 chore(deps): bump @​aws-sdk/client-appsync from 3.1041.0 to 3.1045.0 (#1520)
  • 9165482 chore(deps): upgrade dependencies (#1518)
  • ae2349b feat(cli): add --region as a global CLI option (#1506)
  • See full diff in compare view

Updates @types/node from 25.9.0 to 25.9.1

Commits

Updates tsx from 4.22.2 to 4.22.3

Release notes

Sourced from tsx's releases.

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

  • decode typed loader source (dce02fc)
  • preserve entrypoint with TypeScript preload hooks (68f72f3)

This release is also available on:

Commits
  • dce02fc fix: decode typed loader source
  • 68f72f3 fix: preserve entrypoint with TypeScript preload hooks
  • 69455cf test: cover package exports for ambiguous ESM reexports
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.12.19` | `4.12.21` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.0` | `25.9.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.2` | `4.22.3` |
| [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.254.0` | `2.255.0` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1122.0` | `2.1123.0` |

Bumps the npm group with 5 updates in the /example directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.12.19` | `4.12.21` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.0` | `25.9.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.2` | `4.22.3` |
| [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.254.0` | `2.255.0` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1122.0` | `2.1123.0` |

Bumps the npm group with 2 updates in the /package directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [tsx](https://github.com/privatenumber/tsx).


Updates `hono` from 4.12.19 to 4.12.21
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.19...v4.12.21)

Updates `@types/node` from 25.9.0 to 25.9.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.22.2 to 4.22.3
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.2...v4.22.3)

Updates `aws-cdk-lib` from 2.254.0 to 2.255.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.255.0/packages/aws-cdk-lib)

Updates `aws-cdk` from 2.1122.0 to 2.1123.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1123.0/packages/aws-cdk)

Updates `@aws-cdk/cloud-assembly-schema` from 53.24.0 to 53.25.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/@aws-cdk/cloud-assembly-schema@v53.25.0/packages/@aws-cdk/cloud-assembly-schema)

Updates `hono` from 4.12.19 to 4.12.21
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.19...v4.12.21)

Updates `@types/node` from 25.9.0 to 25.9.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.22.2 to 4.22.3
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.2...v4.22.3)

Updates `aws-cdk-lib` from 2.254.0 to 2.255.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.255.0/packages/aws-cdk-lib)

Updates `aws-cdk` from 2.1122.0 to 2.1123.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1123.0/packages/aws-cdk)

Updates `@types/node` from 25.9.0 to 25.9.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.22.2 to 4.22.3
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.2...v4.22.3)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 25.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: tsx
  dependency-version: 4.22.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: aws-cdk-lib
  dependency-version: 2.255.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: aws-cdk
  dependency-version: 2.1123.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@aws-cdk/cloud-assembly-schema"
  dependency-version: 53.25.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: hono
  dependency-version: 4.12.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 25.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: tsx
  dependency-version: 4.22.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: aws-cdk-lib
  dependency-version: 2.255.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: aws-cdk
  dependency-version: 2.1123.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 25.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: tsx
  dependency-version: 4.22.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 27, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) May 27, 2026 00:02
@github-actions

github-actions Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/@types/node 25.9.1 🟢 6.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 25/29 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/aws-cdk 2.1123.0 UnknownUnknown
npm/aws-cdk-lib 2.255.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Pinned-Dependencies⚠️ -1internal error: internal error: invalid Dockerfile
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
SAST🟢 9SAST tool detected but not run on all commits
Binary-Artifacts⚠️ 0binaries present in source code
Fuzzing🟢 10project is fuzzed
npm/tsx 4.22.3 UnknownUnknown
npm/@types/node 25.9.1 🟢 6.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 25/29 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/tsx 4.22.3 UnknownUnknown
npm/@types/node 25.9.1 🟢 6.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 25/29 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/aws-cdk 2.1123.0 UnknownUnknown
npm/aws-cdk-lib 2.255.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Pinned-Dependencies⚠️ -1internal error: internal error: invalid Dockerfile
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
SAST🟢 9SAST tool detected but not run on all commits
Binary-Artifacts⚠️ 0binaries present in source code
Fuzzing🟢 10project is fuzzed
npm/tsx 4.22.3 UnknownUnknown

Scanned Files

  • example/package.json
  • package/package.json
  • pnpm-lock.yaml

@poad
poad disabled auto-merge May 27, 2026 14:04
@poad

poad commented May 27, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@github-actions
github-actions Bot enabled auto-merge (squash) May 27, 2026 14:14
@github-actions
github-actions Bot merged commit 8a0c30f into main May 27, 2026
4 checks passed
@github-actions
github-actions Bot deleted the dependabot/npm_and_yarn/npm-f3a0b10681 branch May 27, 2026 14:15
This was referenced Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant