chore: bump the development-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #187 · advanced-security/codeql-sarif-security-standard-annotator

dependabot · 2025-12-29T10:05:04Z

Bumps the development-dependencies group with 4 updates in the / directory: @types/node, eslint-plugin-jest, release-it and typescript-eslint.

Updates @types/node from 25.0.2 to 25.0.3

Commits

See full diff in compare view

Updates eslint-plugin-jest from 29.5.0 to 29.11.1

Release notes

Sourced from eslint-plugin-jest's releases.

v29.11.1

29.11.1 (2025-12-29)

Bug Fixes

unbound-method: ignore inline use of jest.mocked(...) (#1862) (3a50b97)

v29.11.0

29.11.0 (2025-12-23)

Features

create new prefer-mock-return-shorthand rule (#1897) (0eb94b6)

v29.10.1

29.10.1 (2025-12-22)

Bug Fixes

valid-expect-in-promise: don't crash on it.todo (#1896) (5511258)

v29.10.0

29.10.0 (2025-12-22)

Features

valid-title: ensure printf specifiers in .each titles are valid (#1892) (5db9b3b)

v29.9.0

29.9.0 (2025-12-22)

Features

no-unnecessary-assertion: support toBeNaN too (#1890) (1dd5e5d)

v29.8.0

29.8.0 (2025-12-22)

Features

create new valid-expect-with-promise rule (#1888) (753e5bb)

v29.7.0

29.7.0 (2025-12-22)

... (truncated)

Changelog

Sourced from eslint-plugin-jest's changelog.

29.11.1 (2025-12-29)

Bug Fixes

unbound-method: ignore inline use of jest.mocked(...) (#1862) (3a50b97)

29.11.0 (2025-12-23)

Features

create new prefer-mock-return-shorthand rule (#1897) (0eb94b6)

29.10.1 (2025-12-22)

Bug Fixes

valid-expect-in-promise: don't crash on it.todo (#1896) (5511258)

29.10.0 (2025-12-22)

Features

valid-title: ensure printf specifiers in .each titles are valid (#1892) (5db9b3b)

29.9.0 (2025-12-22)

Features

no-unnecessary-assertion: support toBeNaN too (#1890) (1dd5e5d)

29.8.0 (2025-12-22)

Features

create new valid-expect-with-promise rule (#1888) (753e5bb)

29.7.0 (2025-12-22)

Features

create new no-error-equal rule (#1886) (930edc4)

29.6.1 (2025-12-22)

... (truncated)

Commits

f020557 chore(release): 29.11.1 [skip ci]
3a50b97 fix(unbound-method): ignore inline use of jest.mocked(...) (#1862)
3d9a6a7 ci: disable rules that require typechecking in smoke test (#1900)
518756b test(prefer-mock-return-shorthand): adjust indenting (#1898)
c42bc74 chore(release): 29.11.0 [skip ci]
0eb94b6 feat: create new prefer-mock-return-shorthand rule (#1897)
37ad071 chore(release): 29.10.1 [skip ci]
5511258 fix(valid-expect-in-promise): don't crash on it.todo (#1896)
af94bf1 chore(release): 29.10.0 [skip ci]
5db9b3b feat(valid-title): ensure printf specifiers in .each titles are valid (#1892)
Additional commits viewable in compare view

Updates release-it from 19.1.0 to 19.2.2

Release notes

Sourced from release-it's releases.

Release 19.2.2

Improve getChangelog method (7a56364997d8ca4a640251bc9be37ed7cbf8568c)

Release 19.2.1

Improve commit prompt (b7aca7c159b3d34fe45f6fb722bb5f664c4bae9a)

Remedy potential edge case in template helper (5c0a6eeeddf7ed1ce0e4cfcffc1c2c72ab63a01b)

Release 19.2.0

Add option to exit gracefully (e1f825dce259118401f17c1d9de0002233e21e67)

Update dependencies (424c9f6c1d9681f4e4a3a37552dd2a99a750a3d2)

Auto-format docs (06f41bbb4b0cbb59ef39a6bd426ee9034b6f396e)

fix: add shell mode for npm commands on windows (#1266) (382e3464095628c23ef9c85c363933f3bf1db09e) - thanks @julienbenac!

Feat: Add publishPackageManager config option in NPM plugin to allow using different package manager for publishing (e.g. Bun) (#1169) (0dafc0b72159931f088e7232da6c34f0f1e8b06f) - thanks @chrispader!

Only use --workspaces=false with npm (12bb89ccaacdc2cbc0ba231f93d7bd389241d6a4)

Fix up docs/types a bit (05a59863648a0b4ce9186b65cd21225a8421e181)

Format (c9d6ebf0415d264e42945f967baae845401d016b)

Commits

3378faf Release 19.2.2
7a56364 Improve getChangelog method
6c58c96 Release 19.2.1
5c0a6ee Remedy potential edge case in template helper
b7aca7c Improve commit prompt
19daa7b Release 19.2.0
c9d6ebf Format
05a5986 Fix up docs/types a bit
12bb89c Only use --workspaces=false with npm
0dafc0b Feat: Add publishPackageManager config option in NPM plugin to allow using ...
Additional commits viewable in compare view

Updates typescript-eslint from 8.49.0 to 8.50.1

Release notes

Sourced from typescript-eslint's releases.

v8.50.1

8.50.1 (2025-12-22)

🩹 Fixes

eslint-plugin: [method-signature-style] ignore methods that return this (#11813)

eslint-plugin: [no-unnecessary-type-assertion] correct handling of undefined vs. void (#11826)

❤️ Thank You

Josh Goldberg ✨

Tamashoo @Tamashoo

You can read about our versioning strategy and releases on our website.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

Josh Goldberg ✨

Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.50.1 (2025-12-22)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

8.50.0 (2025-12-15)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

d520b88 chore(release): publish 8.50.1
c62e858 chore(release): publish 8.50.0
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…h 4 updates Bumps the development-dependencies group with 4 updates in the / directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest), [release-it](https://github.com/release-it/release-it) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `@types/node` from 25.0.2 to 25.0.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint-plugin-jest` from 29.5.0 to 29.11.1 - [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases) - [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md) - [Commits](jest-community/eslint-plugin-jest@v29.5.0...v29.11.1) Updates `release-it` from 19.1.0 to 19.2.2 - [Release notes](https://github.com/release-it/release-it/releases) - [Changelog](https://github.com/release-it/release-it/blob/main/CHANGELOG.md) - [Commits](release-it/release-it@19.1.0...19.2.2) Updates `typescript-eslint` from 8.49.0 to 8.50.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: eslint-plugin-jest dependency-version: 29.11.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: release-it dependency-version: 19.2.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: typescript-eslint dependency-version: 8.50.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2025-12-29T10:05:18Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@octokit/plugin-paginate-rest

14.0.0

🟢 7.6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	12 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 9	security policy file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits

npm/@octokit/plugin-rest-endpoint-methods

17.0.0

🟢 7.6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Security-Policy	🟢 9	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	11 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits

npm/@octokit/rest

22.0.1

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Security-Policy	🟢 9	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	10 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
Vulnerabilities	⚠️ 0	16 existing vulnerabilities detected
SAST	🟢 10	SAST tool is run on all commits

npm/@types/node

25.0.3

🟢 7

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/30 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 9	license file detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@typescript-eslint/eslint-plugin

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/parser

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/project-service

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/scope-manager

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/tsconfig-utils

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/type-utils

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/types

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/typescript-estree

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/utils

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/visitor-keys

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/c12

3.3.3

Unknown

npm/chokidar

5.0.0

🟢 5.5

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 3	Found 9/25 approved changesets -- score normalized to 3
Maintained	🟢 9	7 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 9
Pinned-Dependencies	🟢 10	all dependencies are pinned
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/eslint-plugin-jest

29.11.1

🟢 5.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/eta

4.5.0

Unknown

npm/iconv-lite

0.7.1

Unknown

npm/inquirer

12.11.1

🟢 6.2

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 3	Found 3/9 approved changesets -- score normalized to 3
Maintained	🟢 10	30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Vulnerabilities	🟢 8	2 existing vulnerabilities detected
SAST	🟢 9	SAST tool detected but not run on all commits
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0

npm/mime-types

3.0.2

🟢 8

Details

Check	Score	Reason
Dependency-Update-Tool	🟢 10	update tool detected
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Maintained	🟢 10	19 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 9	Found 17/18 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	🟢 9	SAST tool detected but not run on all commits
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
CI-Tests	🟢 10	29 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 26 contributing companies or organizations

npm/readdirp

5.0.0

🟢 4.3

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 0	Found 2/28 approved changesets -- score normalized to 0
Maintained	🟢 3	4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/release-it

19.2.2

🟢 4.8

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 3/30 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	27 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Branch-Protection	⚠️ 1	branch protection is not maximal on development and all release branches
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 7	SAST tool detected but not run on all commits
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities	🟢 8	2 existing vulnerabilities detected

npm/typescript-eslint

8.50.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 16/21 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	37 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/undici

6.22.0

🟢 8.3

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Security-Policy	🟢 9	security policy file detected
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 8	binaries present in source code
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	🟢 9	SAST tool detected but not run on all commits
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	🟢 10	project is fuzzed
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 79 contributing companies or organizations

Scanned Files

package-lock.json

dependabot · 2026-01-19T12:23:23Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added the dependencies Pull requests that update a dependency file label Dec 29, 2025

dependabot bot closed this Jan 19, 2026

dependabot bot deleted the dependabot/npm_and_yarn/main/development-dependencies-299db7cbc9 branch January 19, 2026 12:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump the development-dependencies group across 1 directory with 4 updates#187

chore: bump the development-dependencies group across 1 directory with 4 updates#187
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/main/development-dependencies-299db7cbc9

dependabot bot commented on behalf of github Dec 29, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 29, 2025

Uh oh!

dependabot bot commented on behalf of github Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v29.11.1

29.11.1 (2025-12-29)

Bug Fixes

v29.11.0

29.11.0 (2025-12-23)

Features

v29.10.1

29.10.1 (2025-12-22)

Bug Fixes

v29.10.0

29.10.0 (2025-12-22)

Features

v29.9.0

29.9.0 (2025-12-22)

Features

v29.8.0

29.8.0 (2025-12-22)

Features

v29.7.0

29.7.0 (2025-12-22)

29.11.1 (2025-12-29)

Bug Fixes

29.11.0 (2025-12-23)

Features

29.10.1 (2025-12-22)

Bug Fixes

29.10.0 (2025-12-22)

Features

29.9.0 (2025-12-22)

Features

29.8.0 (2025-12-22)

Features

29.7.0 (2025-12-22)

Features

29.6.1 (2025-12-22)

Release 19.2.2

Release 19.2.1

Release 19.2.0

v8.50.1

8.50.1 (2025-12-22)

🩹 Fixes

❤️ Thank You

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

❤️ Thank You

8.50.1 (2025-12-22)

8.50.0 (2025-12-15)

Uh oh!

github-actions bot commented Dec 29, 2025

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

dependabot bot commented on behalf of github Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Dec 29, 2025 •

edited

Loading