Skip to content

Bump the npm group across 2 directories with 35 updates - #57

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-b6b2f88438
Dec 16, 2025
Merged

Bump the npm group across 2 directories with 35 updates#57
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-b6b2f88438

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Dec 16, 2025

Copy link
Copy Markdown
Contributor

Bumps the npm group with 4 updates in the / directory: @modelcontextprotocol/sdk, zod, vitest and @vitest/coverage-v8.
Bumps the npm group with 4 updates in the /example directory: @modelcontextprotocol/sdk, zod, vitest and @vitest/coverage-v8.

Updates @modelcontextprotocol/sdk from 1.25.0 to 1.25.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.25.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.25.0...1.25.1

Commits

Updates zod from 4.2.0 to 4.2.1

Release notes

Sourced from zod's releases.

v4.2.1

Commits:

  • 5b5b129315fbc94a3b0d6244185eaeefcbe438d1 4.2.1
Commits

Updates vitest from 4.0.15 to 4.0.16

Release notes

Sourced from vitest's releases.

v4.0.16

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • b46d744 chore: release v4.0.16
  • 84a3062 fix(browser): string formatting bug when including placeholders in console.lo...
  • f7f6aa8 fix: log deprecated test.poolOptions if it's set (#9226)
  • 568513c fix: allow inlining fully dynamic import (#9137)
  • 5d26b87 fix(experimental): export setupEnvironment for custom pools (#9187)
  • f17eb42 refactor: avoid using isFileServingAllowed from Vite (#9160)
  • 78cfbf9 fix: avoid crashing on process.versions stub (#9174)
  • da0ade2 fix: fix browser mode default testTimeout back to 15 seconds (#9167)
  • See full diff in compare view

Updates @vitest/coverage-v8 from 4.0.15 to 4.0.16

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.0.16

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @rollup/rollup-android-arm-eabi from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-android-arm-eabi's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-android-arm-eabi's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-android-arm64 from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-android-arm64's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-android-arm64's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-darwin-arm64 from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-darwin-arm64's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-darwin-arm64's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-darwin-x64 from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-darwin-x64's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-darwin-x64's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-freebsd-arm64 from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-freebsd-arm64's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-freebsd-arm64's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-freebsd-x64 from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-freebsd-x64's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-freebsd-x64's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-arm-gnueabihf from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-arm-gnueabihf's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-arm-gnueabihf's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-arm-musleabihf from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-arm-musleabihf's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-arm-musleabihf's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-arm64-gnu from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-arm64-gnu's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-arm64-gnu's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-arm64-musl from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-arm64-musl's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-arm64-musl's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-loong64-gnu from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-loong64-gnu's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-loong64-gnu's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-ppc64-gnu from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-ppc64-gnu's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-ppc64-gnu's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-riscv64-gnu from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-riscv64-gnu's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-riscv64-gnu's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-riscv64-musl from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-riscv64-musl's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-riscv64-musl's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-s390x-gnu from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-s390x-gnu's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-s390x-gnu's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-x64-gnu from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-linux-x64-musl from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-linux-x64-musl's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-x64-musl's changelog.

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

Commits

Updates @rollup/rollup-openharmony-arm64 from 4.53.4 to 4.53.5

Release notes

Sourced from @​rollup/rollup-openharmony-arm64's releases.

v4.53.5

4.53.5

2025-12-16

Bug Fixes

  • Fix wrong semicolon insertion position when using JSX (#6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#6196)

Pull Requests

  • #6196: fix: set sourcesContent to undefined instead of null when excluding sources content (@​TrickyPi)

@dependabot
Bump the npm group across 2 directories with 35 updates
3b5f748 
Bumps the npm group with 4 updates in the / directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [zod](https://github.com/colinhacks/zod), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8).
Bumps the npm group with 4 updates in the /example directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [zod](https://github.com/colinhacks/zod), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8).


Updates `@modelcontextprotocol/sdk` from 1.25.0 to 1.25.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.25.0...1.25.1)

Updates `zod` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.2.0...v4.2.1)

Updates `vitest` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/vitest)

Updates `@vitest/coverage-v8` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/coverage-v8)

Updates `@rollup/rollup-android-arm-eabi` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-android-arm64` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-darwin-arm64` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-darwin-x64` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-freebsd-arm64` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-freebsd-x64` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-arm-gnueabihf` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-arm-musleabihf` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-arm64-gnu` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-arm64-musl` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-loong64-gnu` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-ppc64-gnu` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-riscv64-gnu` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-riscv64-musl` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-s390x-gnu` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-x64-gnu` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-linux-x64-musl` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-openharmony-arm64` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-win32-arm64-msvc` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-win32-ia32-msvc` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-win32-x64-gnu` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@rollup/rollup-win32-x64-msvc` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@vitest/expect` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/expect)

Updates `@vitest/mocker` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/mocker)

Updates `@vitest/pretty-format` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/pretty-format)

Updates `@vitest/runner` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/runner)

Updates `@vitest/snapshot` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/snapshot)

Updates `@vitest/spy` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/spy)

Updates `@vitest/utils` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/utils)

Updates `ast-v8-to-istanbul` from 0.3.8 to 0.3.9
- [Release notes](https://github.com/AriPerkkio/ast-v8-to-istanbul/releases)
- [Commits](AriPerkkio/ast-v8-to-istanbul@v0.3.8...v0.3.9)

Updates `rollup` from 4.53.4 to 4.53.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.4...v4.53.5)

Updates `@modelcontextprotocol/sdk` from 1.25.0 to 1.25.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.25.0...1.25.1)

Updates `zod` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.2.0...v4.2.1)

Updates `vitest` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/vitest)

Updates `@vitest/coverage-v8` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/coverage-v8)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.25.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: zod
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 4.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-android-arm-eabi"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-android-arm64"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-darwin-arm64"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-darwin-x64"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-freebsd-arm64"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-freebsd-x64"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-arm-gnueabihf"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-arm-musleabihf"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-arm64-gnu"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-arm64-musl"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-loong64-gnu"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-ppc64-gnu"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-riscv64-gnu"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-riscv64-musl"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-s390x-gnu"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-x64-gnu"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-linux-x64-musl"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-openharmony-arm64"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-win32-arm64-msvc"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-win32-ia32-msvc"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-win32-x64-gnu"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@rollup/rollup-win32-x64-msvc"
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/expect"
  dependency-version: 4.0.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/mocker"
  dependency-version: 4.0.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/pretty-format"
  dependency-version: 4.0.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/runner"
  dependency-version: 4.0.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/snapshot"
  dependency-version: 4.0.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/spy"
  dependency-version: 4.0.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/utils"
  dependency-version: 4.0.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: ast-v8-to-istanbul
  dependency-version: 0.3.9
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: rollup
  dependency-version: 4.53.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.25.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: zod
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 4.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 16, 2025
@github-actions
github-actions Bot enabled auto-merge (squash) December 16, 2025 18:49
@github-actions

github-actions Bot commented Dec 16, 2025

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

pnpm-lock.yaml

PackageVersionLicenseIssue Type
ast-v8-to-istanbul0.3.9NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@modelcontextprotocol/sdk ^1.25.1 UnknownUnknown
npm/@vitest/coverage-v8 ^4.0.16 UnknownUnknown
npm/vitest ^4.0.16 UnknownUnknown
npm/zod ^4.2.1 🟢 4.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 013 existing vulnerabilities detected
npm/@modelcontextprotocol/sdk ^1.25.1 UnknownUnknown
npm/vitest ^4.0.16 UnknownUnknown
npm/zod ^4.2.1 🟢 4.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 013 existing vulnerabilities detected
npm/@modelcontextprotocol/sdk 1.25.1 UnknownUnknown
npm/@rollup/rollup-android-arm-eabi 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-android-arm64 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-darwin-arm64 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-darwin-x64 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-freebsd-arm64 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-freebsd-x64 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-arm-gnueabihf 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-arm-musleabihf 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-arm64-gnu 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-arm64-musl 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-loong64-gnu 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-ppc64-gnu 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-riscv64-gnu 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-riscv64-musl 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-s390x-gnu 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-x64-gnu 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-linux-x64-musl 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-openharmony-arm64 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-win32-arm64-msvc 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-win32-ia32-msvc 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-win32-x64-gnu 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@rollup/rollup-win32-x64-msvc 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/@vitest/coverage-v8 4.0.16 UnknownUnknown
npm/@vitest/expect 4.0.16 UnknownUnknown
npm/@vitest/mocker 4.0.16 UnknownUnknown
npm/@vitest/pretty-format 4.0.16 UnknownUnknown
npm/@vitest/runner 4.0.16 UnknownUnknown
npm/@vitest/snapshot 4.0.16 UnknownUnknown
npm/@vitest/spy 4.0.16 UnknownUnknown
npm/@vitest/utils 4.0.16 UnknownUnknown
npm/ast-v8-to-istanbul 0.3.9 UnknownUnknown
npm/rollup 4.53.5 🟢 6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/vitest 4.0.16 UnknownUnknown
npm/zod 4.2.1 🟢 4.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 013 existing vulnerabilities detected

Scanned Files

  • example/package.json
  • package/package.json
  • pnpm-lock.yaml

@github-actions
github-actions Bot merged commit d341b74 into main Dec 16, 2025
4 checks passed
@github-actions
github-actions Bot deleted the dependabot/npm_and_yarn/npm-b6b2f88438 branch December 16, 2025 18:50
@github-actions github-actions Bot mentioned this pull request Jan 8, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

@poad poad

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@poad