Bump the npm group across 3 directories with 12 updates by dependabot[bot] · Pull Request #88 · poad/aws-lambda-mcp-server

dependabot · 2026-01-26T20:21:27Z

Bumps the npm group with 3 updates in the / directory: pnpm, hono and typescript-eslint.
Bumps the npm group with 2 updates in the /example directory: hono and typescript-eslint.
Bumps the npm group with 2 updates in the /package directory: hono and typescript-eslint.

Updates pnpm from 10.28.1 to 10.28.2

Release notes

Sourced from pnpm's releases.

pnpm 10.28.2

Patch Changes

Security fix: prevent path traversal in directories.bin field.

When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.28.2

Patch Changes

Security fix: prevent path traversal in directories.bin field.

When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Commits

89a2c4e chore(release): 10.28.2
a484cea fix(npm-resolver): request full metadata for optional dependencies (#10455)
c908370 test: fix
See full diff in compare view

Updates hono from 4.11.5 to 4.11.6

Release notes

Sourced from hono's releases.

v4.11.6

What's Changed

refactor: use unique symbol for more accurate typing. by @usualoma in honojs/hono#4651

docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant by @sano-suguru in honojs/hono#4630

fix(sse): handle \r and \r\n line endings in writeSSE by @AprilNEA in honojs/hono#4644

feat(bun): export getBunServer by @artemtam in honojs/hono#4626

New Contributors

@sano-suguru made their first contribution in honojs/hono#4630

@AprilNEA made their first contribution in honojs/hono#4644

@artemtam made their first contribution in honojs/hono#4626

Full Changelog: honojs/hono@v4.11.5...v4.11.6

Commits

7343487 4.11.6
b6e5a97 feat(bun): export getBunServer (#4626)
2a9cd95 fix(sse): handle \r and \r\n line endings in writeSSE (#4644)
8078bbf docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant (#4630)
a5be555 refactor: use unique symbol for more accurate typing. (#4651)
See full diff in compare view

Updates typescript-eslint from 8.53.1 to 8.54.0

Release notes

Sourced from typescript-eslint's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.54.0 (2026-01-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/eslint-plugin's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/eslint-plugin's changelog.

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

deps: update dependency prettier to v3.8.0 (#11991)

scope-manager: fix catch clause scopes def.name (#11982)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

❤️ Thank You

Brad Zacher @bradzacher

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
80e33ff feat(eslint-plugin-internal): add prefer-tsutils-methods rule (#11974)
ec4f73a feat(typescript-estree): add shortcut methods to ParserServicesWithTypeInform...
d32f909 test(eslint-plugin): skip rules tests in windows ci (#11988)
17fa993 test(eslint-plugin): improve vitest performance with isolate: false (#11754)
1c66ab4 fix(eslint-plugin): [no-unnecessary-type-assertion] check both base constrain...
aaa7ca2 fix(deps): update dependency prettier to v3.8.0 (#11991)
d50aa18 fix(scope-manager): fix catch clause scopes def.name (#11982)
4c0b379 fix(eslint-plugin): [no-unused-private-class-members] private destructured cl...
See full diff in compare view

Updates @typescript-eslint/parser from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/parser's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/parser's changelog.

8.54.0 (2026-01-26)

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
See full diff in compare view

Updates @typescript-eslint/project-service from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/project-service's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/project-service's changelog.

8.54.0 (2026-01-26)

This was a version bump only for project-service to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
See full diff in compare view

Updates @typescript-eslint/scope-manager from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/scope-manager's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/scope-manager's changelog.

8.54.0 (2026-01-26)

🚀 Features

scope-manager: support ScopeManager#addGlobals (#11914)

🩹 Fixes

scope-manager: prevent misidentification of "use strict" directives (#11995)

scope-manager: fix catch clause scopes def.name (#11982)

❤️ Thank You

fnx @DMartens

Josh Goldberg

overlookmotel

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
836ff3d fix(scope-manager): prevent misidentification of "use strict" directives (#...
607c9c9 feat(scope-manager): support ScopeManager#addGlobals (#11914)
d50aa18 fix(scope-manager): fix catch clause scopes def.name (#11982)
See full diff in compare view

Updates @typescript-eslint/tsconfig-utils from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/tsconfig-utils's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/tsconfig-utils's changelog.

8.54.0 (2026-01-26)

This was a version bump only for tsconfig-utils to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
See full diff in compare view

Updates @typescript-eslint/type-utils from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/type-utils's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/type-utils's changelog.

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

❤️ Thank You

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
80e33ff feat(eslint-plugin-internal): add prefer-tsutils-methods rule (#11974)
See full diff in compare view

Updates @typescript-eslint/typescript-estree from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/typescript-estree's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/typescript-estree's changelog.

8.54.0 (2026-01-26)

🚀 Features

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

❤️ Thank You

MinJae @Ju-MINJAE

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
ec4f73a feat(typescript-estree): add shortcut methods to ParserServicesWithTypeInform...
See full diff in compare view

Updates @typescript-eslint/utils from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/utils's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/utils's changelog.

8.54.0 (2026-01-26)

🩹 Fixes

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Francesco Trotta

Josh Goldberg

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
f619374 fix(utils): handle missing FlatESLint and LegacyESLint (#11958)
See full diff in compare view

Updates @typescript-eslint/visitor-keys from 8.53.1 to 8.54.0

Release notes

Sourced from @typescript-eslint/visitor-keys's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/visitor-keys's changelog.

8.54.0 (2026-01-26)

This was a version bump only for visitor-keys to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

d423e57 chore(release): publish 8.54.0
See full diff in compare view

Updates hono from 4.11.5 to 4.11.6

Release notes

Sourced from hono's releases.

v4.11.6

What's Changed

refactor: use unique symbol for more accurate typing. by @usualoma in honojs/hono#4651

docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant by @sano-suguru in honojs/hono#4630

fix(sse): handle \r and \r\n line endings in writeSSE by @AprilNEA in honojs/hono#4644

feat(bun): export getBunServer by @artemtam in honojs/hono#4626

New Contributors

@sano-suguru made their first contribution in honojs/hono#4630

@AprilNEA made their first contribution in honojs/hono#4644

@artemtam made their first contribution in honojs/hono#4626

Full Changelog: honojs/hono@v4.11.5...v4.11.6

Commits

7343487 4.11.6
b6e5a97 feat(bun): export getBunServer (#4626)
2a9cd95 fix(sse): handle \r and \r\n line endings in writeSSE (#4644)
8078bbf docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant (#4630)
a5be555 refactor: use unique symbol for more accurate typing. (#4651)
See full diff in compare view

Updates typescript-eslint from 8.53.1 to 8.54.0

Release notes

Sourced from typescript-eslint's releases.

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

eslint-plugin-internal: add prefer-tsutils-methods rule (#11974, #11625)

scope-manager: support ScopeManager#addGlobals (#11914)

typescript-estree: add shortcut methods to ParserServicesWithTypeInformation (#11965, #11955)

🩹 Fixes

deps: update dependency prettier to v3.8.0 (#11991)

eslint-plugin: [no-unused-private-class-members] private destructured class member is defined but used (#11785)

eslint-plugin: [no-unnecessary-type-assertion] check both base constraint and actual type for non-null assertions (#11967, #11559)

scope-manager: fix catch clause scopes def.name (#11982)

scope-manager: prevent misidentification of "use strict" directives (#11995)

utils: handle missing FlatESLint and LegacyESLint (#11958)

❤️ Thank You

Brad Zacher @bradzacher

fnx @DMartens

Francesco Trotta

Josh Goldberg

MinJae @Ju-MINJAE

Minyeong Kim @minyeong981

overlookmotel

Yuya Yoshioka @YuyaYoshioka

김현수 @Kimsoo0119

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.54.0 (2026-01-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

<...

Description has been truncated

Bumps the npm group with 3 updates in the / directory: [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm), [hono](https://github.com/honojs/hono) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Bumps the npm group with 2 updates in the /example directory: [hono](https://github.com/honojs/hono) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Bumps the npm group with 2 updates in the /package directory: [hono](https://github.com/honojs/hono) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `pnpm` from 10.28.1 to 10.28.2 - [Release notes](https://github.com/pnpm/pnpm/releases) - [Changelog](https://github.com/pnpm/pnpm/blob/v10.28.2/pnpm/CHANGELOG.md) - [Commits](https://github.com/pnpm/pnpm/commits/v10.28.2/pnpm) Updates `hono` from 4.11.5 to 4.11.6 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.5...v4.11.6) Updates `typescript-eslint` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/typescript-eslint) Updates `@typescript-eslint/eslint-plugin` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/parser) Updates `@typescript-eslint/project-service` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/project-service/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/project-service) Updates `@typescript-eslint/scope-manager` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/scope-manager/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/scope-manager) Updates `@typescript-eslint/tsconfig-utils` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/tsconfig-utils/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/tsconfig-utils) Updates `@typescript-eslint/type-utils` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/type-utils/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/type-utils) Updates `@typescript-eslint/typescript-estree` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-estree/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/typescript-estree) Updates `@typescript-eslint/utils` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/utils/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/utils) Updates `@typescript-eslint/visitor-keys` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/visitor-keys/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/visitor-keys) Updates `hono` from 4.11.5 to 4.11.6 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.5...v4.11.6) Updates `typescript-eslint` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/typescript-eslint) Updates `hono` from 4.11.5 to 4.11.6 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.5...v4.11.6) Updates `typescript-eslint` from 8.53.1 to 8.54.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: pnpm dependency-version: 10.28.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: hono dependency-version: 4.11.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: typescript-eslint dependency-version: 8.54.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/parser" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/project-service" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/scope-manager" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/tsconfig-utils" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/type-utils" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/typescript-estree" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/utils" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/visitor-keys" dependency-version: 8.54.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: hono dependency-version: 4.11.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: typescript-eslint dependency-version: 8.54.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: hono dependency-version: 4.11.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: typescript-eslint dependency-version: 8.54.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-01-26T20:21:39Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/hono

4.11.6

Unknown

npm/typescript-eslint

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/eslint-plugin

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/parser

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/project-service

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/scope-manager

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/tsconfig-utils

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/type-utils

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/types

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/typescript-estree

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/utils

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/visitor-keys

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/hono

4.11.6

Unknown

npm/pnpm

10.28.2

🟢 6.6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 3	Found 11/29 approved changesets -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
License	🟢 10	license file detected
Branch-Protection	🟢 8	branch protection is not maximal on development and all release branches
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	⚠️ 0	129 existing vulnerabilities detected

npm/typescript-eslint

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/hono

4.11.6

Unknown

npm/typescript-eslint

8.54.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 16/19 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	41 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

example/package.json
package/package.json
pnpm-lock.yaml

dependabot Bot assigned poad Jan 26, 2026

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 26, 2026

github-actions Bot approved these changes Jan 26, 2026

View reviewed changes

github-actions Bot enabled auto-merge (squash) January 26, 2026 20:21

github-actions Bot merged commit 0bce71a into main Jan 26, 2026
4 checks passed

github-actions Bot deleted the dependabot/npm_and_yarn/npm-81e6c32645 branch January 26, 2026 20:23

This was referenced Feb 17, 2026

Release v1.1.2 #110

Closed

Release v1.1.2 #111

Closed

Release v1.1.2 #112

Closed

Release v1.1.2 #113

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm group across 3 directories with 12 updates - #88

Bump the npm group across 3 directories with 12 updates#88
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-81e6c32645

dependabot Bot commented on behalf of github Jan 26, 2026

Uh oh!

github-actions Bot commented Jan 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jan 26, 2026

pnpm 10.28.2

Patch Changes

Platinum Sponsors

Gold Sponsors

10.28.2

Patch Changes

v4.11.6

What's Changed

New Contributors

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

🚀 Features

❤️ Thank You

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

🚀 Features

❤️ Thank You

v8.54.0

8.54.0 (2026-01-26)

🚀 Features

🩹 Fixes

❤️ Thank You

8.54.0 (2026-01-26)

🩹 Fixes

❤️ Thank You

v8.54.0

8.54.0 (2026-01-26)

🚀 Features