Skip to content

chore(dev)(deps-dev): bump the dev-deps group across 1 directory with 10 updates#53

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/dev-deps-18ca234696
Closed

chore(dev)(deps-dev): bump the dev-deps group across 1 directory with 10 updates#53
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/dev-deps-18ca234696

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 27, 2025 •
edited
Loading

Bumps the dev-deps group with 10 updates in the / directory:

Package From To
@types/node 24.5.1 24.9.1
eslint 9.36.0 9.38.0
eslint-plugin-react-hooks 5.2.0 7.0.1
eslint-plugin-storybook 9.1.6 9.1.15
eslint-plugin-unused-imports 4.2.0 4.3.0
prettier-plugin-tailwindcss 0.6.14 0.7.1
stylelint 16.24.0 16.25.0
stylelint-config-standard 39.0.0 39.0.1
typescript 5.9.2 5.9.3
vitest 3.2.4 4.0.3

Updates @types/node from 24.5.1 to 24.9.1

Commits

Updates eslint from 9.36.0 to 9.38.0

Release notes

Sourced from eslint's releases.

v9.38.0

Features

  • ce40f74 feat: update complexity rule to only highlight function header (#20048) (Atul Nair)
  • e37e590 feat: correct no-loss-of-precision false positives with e notation (#20187) (Francesco Trotta)

Bug Fixes

  • 50c3dfd fix: improve type support for isolated dependencies in pnpm (#20201) (Francesco Trotta)
  • a1f06a3 fix: correct SourceCode typings (#20114) (Pixel998)

Documentation

  • 462675a docs: improve web accessibility by hiding non-semantic character (#20205) (루밀LuMir)
  • c070e65 docs: correct formatting in no-irregular-whitespace rule documentation (#20203) (루밀LuMir)
  • b39e71a docs: Update README (GitHub Actions Bot)
  • cd39983 docs: move custom-formatters type descriptions to nodejs-api (#20190) (Percy Ma)

Chores

  • d17c795 chore: upgrade @​eslint/js@​9.38.0 (#20221) (Milos Djermanovic)
  • 25d0e33 chore: package.json update for @​eslint/js release (Jenkins)
  • c82b5ef refactor: Use types from @​eslint/core (#20168) (Nicholas C. Zakas)
  • ff31609 ci: add Node.js 25 to ci.yml (#20220) (루밀LuMir)
  • 004577e ci: bump github/codeql-action from 3 to 4 (#20211) (dependabot[bot])
  • eac71fb test: remove use of nodejsScope option of eslint-scope from tests (#20206) (Milos Djermanovic)
  • 4168a18 chore: fix typo in legacy-eslint.js (#20202) (Sweta Tanwar)
  • 205dbd2 chore: fix typos (#20200) (ntnyq)
  • dbb200e chore: use team member's username when name is not available in data (#20194) (Milos Djermanovic)
  • 8962089 chore: mark deprecated rules as available until v11.0.0 (#20184) (Pixel998)

v9.37.0

Features

  • 39f7fb4 feat: preserve-caught-error should recognize all static "cause" keys (#20163) (Pixel998)
  • f81eabc feat: support TS syntax in no-restricted-imports (#19562) (Nitin Kumar)

Bug Fixes

  • a129cce fix: correct no-loss-of-precision false positives for leading zeros (#20164) (Francesco Trotta)
  • 09e04fc fix: add missing AST token types (#20172) (Pixel998)
  • 861c6da fix: correct ESLint typings (#20122) (Pixel998)

Documentation

  • b950359 docs: fix typos across the docs (#20182) (루밀LuMir)
  • 42498a2 docs: improve ToC accessibility by hiding non-semantic character (#20181) (Percy Ma)
  • 29ea092 docs: Update README (GitHub Actions Bot)
  • 5c97a04 docs: show availableUntil in deprecated rule banner (#20170) (Pixel998)
  • 90a71bf docs: update README files to add badge and instructions (#20115) (루밀LuMir)
  • 1603ae1 docs: update references from master to main (#20153) (루밀LuMir)

Chores

  • afe8a13 chore: update @eslint/js dependency to version 9.37.0 (#20183) (Francesco Trotta)
  • abee4ca chore: package.json update for @​eslint/js release (Jenkins)
  • fc9381f chore: fix typos in comments (#20175) (overlookmotel)
  • e1574a2 chore: unpin jiti (#20173) (renovate[bot])

... (truncated)

Commits

Updates eslint-plugin-react-hooks from 5.2.0 to 7.0.1

Changelog

Sourced from eslint-plugin-react-hooks's changelog.

7.0.1

  • Disallowed passing inline useEffectEvent values as JSX props to guard against accidental propagation. (#34820 by @​jf-eirinha)
  • Switch to export = so eslint-plugin-react-hooks emits correct types for consumers in Node16 ESM projects. (#34949 by @​karlhorky)
  • Tightened the typing of configs.flat so the configs export is always defined. (#34950 by @​poteto)
  • Fix named import runtime errors. (#34951, #34953 by @​karlhorky)

7.0.0

This release slims down presets to just 2 configurations (recommended and recommended-latest), and all compiler rules are enabled by default.

  • Breaking: Removed recommended-latest-legacy and flat/recommended configs. The plugin now provides recommended (legacy and flat configs with all recommended rules), and recommended-latest (legacy and flat configs with all recommended rules plus new bleeding edge experimental compiler rules). (@​poteto in #34757)

6.1.1

Note: 6.1.0 accidentally allowed use of recommended without flat config, causing errors when used with ESLint v9's defineConfig() helper. This has been fixed in 6.1.1.

6.1.0

Note: Version 6.0.0 was mistakenly released and immediately deprecated and untagged on npm. This is the first official 6.x major release and includes breaking changes.

  • Breaking: Require Node.js 18 or newer. (@​michaelfaith in #32458)
  • Breaking: Flat config is now the default recommended preset. Legacy config moved to recommended-legacy. (@​michaelfaith in #32457)
  • New Violations: Disallow calling use within try/catch blocks. (@​poteto in #34040)
  • New Violations: Disallow calling useEffectEvent functions in arbitrary closures. (@​jbrown215 in #33544)
  • Handle React.useEffect in addition to useEffect in rules-of-hooks. (@​Ayc0 in #34076)
  • Added react-hooks settings config option that to accept additionalEffectHooks that are used across exhaustive-deps and rules-of-hooks rules. (@​jbrown215) in #34497

6.0.0

Accidentally released. See 6.1.0 for the actual changes.

Commits

Updates eslint-plugin-storybook from 9.1.6 to 9.1.15

Release notes

Sourced from eslint-plugin-storybook's releases.

v9.1.15

9.1.15

v9.1.14

9.1.14

v9.1.12

9.1.12

  • Maintenance: Hotfix for missing nextjs dts files, thanks @​ndelangen!

v9.1.11

9.1.11

v9.1.10

9.1.10

v9.1.9

9.1.9

  • Angular: Enable experimental zoneless detection on Angular v21 - #32580, thanks @​yannbf!
  • Svelte: Ignore inherited HTMLAttributes docgen when using utility types - #32173, thanks @​steciuk!

v9.1.8

9.1.8

v9.1.7

9.1.7

Changelog

Sourced from eslint-plugin-storybook's changelog.

9.1.15

9.1.14

9.1.13

9.1.12

  • Maintenance: Hotfix for missing nextjs dts files, thanks @​ndelangen!

9.1.11

9.1.10

9.1.9

  • Angular: Enable experimental zoneless detection on Angular v21 - #32580, thanks @​yannbf!
  • Svelte: Ignore inherited HTMLAttributes docgen when using utility types - #32173, thanks @​steciuk!

9.1.8

9.1.7

Commits
  • d0d17d9 Bump version from "9.1.14" to "9.1.15" [skip ci]
  • 5afb39f Bump version from "9.1.13" to "9.1.14" [skip ci]
  • c2483f0 Bump version from "9.1.12" to "9.1.13" [skip ci]
  • efe8a7c Bump version from "9.1.11" to "9.1.12" [skip ci]
  • 5b2e0ed Bump version from "9.1.10" to "9.1.11" [skip ci]
  • 642f0cf Bump version from "9.1.9" to "9.1.10" [skip ci]
  • 01867d0 Bump version from "9.1.8" to "9.1.9" [skip ci]
  • 28833d4 Bump version from "9.1.7" to "9.1.8" [skip ci]
  • 006b304 Bump version from "9.1.6" to "9.1.7" [skip ci]
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for eslint-plugin-storybook since your current version.


Updates eslint-plugin-unused-imports from 4.2.0 to 4.3.0

Commits

Updates prettier-plugin-tailwindcss from 0.6.14 to 0.7.1

Release notes

Sourced from prettier-plugin-tailwindcss's releases.

v0.7.1

Fixed

  • Match against correct name of dynamic attributes when using regexes (#410)

v0.7.0

Added

  • Format quotes in @source, @plugin, and @config (#387)
  • Sort in function calls in Twig (#358)
  • Sort in callable template literals (#367)
  • Sort in function calls mixed with property accesses (#367)
  • Support regular expression patterns for attributes (#405)
  • Support regular expression patterns for function names (#405)

Changed

  • Improved monorepo support by loading Tailwind CSS relative to the input file instead of prettier config file (#386)
  • Improved monorepo support by loading v3 configs relative to the input file instead of prettier config file (#386)
  • Fallback to Tailwind CSS v4 instead of v3 by default (#390)
  • Don't augment global Prettier ParserOptions and RequiredOptions types (#354)
  • Drop support for prettier-plugin-import-sort (#385)

Fixed

  • Handle quote escapes in LESS when sorting @apply (#392)
  • Fix whitespace removal inside nested concat and template expressions (#396)
Changelog

Sourced from prettier-plugin-tailwindcss's changelog.

[0.7.1] - 2025-10-17

Fixed

  • Match against correct name of dynamic attributes when using regexes (#410)

[0.7.0] - 2025-10-14

Added

  • Format quotes in @source, @plugin, and @config (#387)
  • Sort in function calls in Twig (#358)
  • Sort in callable template literals (#367)
  • Sort in function calls mixed with property accesses (#367)
  • Support regular expression patterns for attributes (#405)
  • Support regular expression patterns for function names (#405)

Changed

  • Improved monorepo support by loading Tailwind CSS relative to the input file instead of prettier config file (#386)
  • Improved monorepo support by loading v3 configs relative to the input file instead of prettier config file (#386)
  • Fallback to Tailwind CSS v4 instead of v3 by default (#390)
  • Don't augment global Prettier ParserOptions and RequiredOptions types (#354)
  • Drop support for prettier-plugin-import-sort (#385)

Fixed

  • Handle quote escapes in LESS when sorting @apply (#392)
  • Fix whitespace removal inside nested concat and template expressions (#396)
Commits

Updates stylelint from 16.24.0 to 16.25.0

Release notes

Sourced from stylelint's releases.

16.25.0

It adds 3 new features, including experimental support for bulk suppressions. It's also our first immutable release, with the package published to npm using trusted publishing and our dependencies updated on a cool down for improved supply chain security.

Changelog

Sourced from stylelint's changelog.

16.25.0 - 2025-10-03

It adds 3 new features, including experimental support for bulk suppressions. It's also our first immutable release, with the package published to npm using trusted publishing and our dependencies updated on a cool down for improved supply chain security.

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for stylelint since your current version.


Updates stylelint-config-standard from 39.0.0 to 39.0.1

Release notes

Sourced from stylelint-config-standard's releases.

39.0.1

  • Fixed: layer-name-pattern false positives for dot notation.
Changelog

Sourced from stylelint-config-standard's changelog.

39.0.1

  • Fixed: layer-name-pattern false positives for dot notation.
Commits
  • a2416d3 Release 39.0.1 (#374)
  • 9911899 Fix layer-name-pattern false positives for dot notation (#373)
  • 807ed8d Bump Stylelint (#371)
  • f6aea8b Introduce new release workflow (#370)
  • 5f6cc89 Bump stylelint/.github from 5c1fac886fb5f8f74e29e133f36d242770d03ed3 to 34f1c...
  • 939280e Bump the dev-deps group with 2 updates (#368)
  • 8cad224 Shorten dev dependencies group name for Dependabot (#367)
  • 552ca29 Sync CODEOWNERS (#366)
  • 6c540d2 Bump eslint from 9.34.0 to 9.35.0 in the development-dependencies group (#365)
  • bc321ef Introduce cooldown period for Dependabot updates (#364)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for stylelint-config-standard since your current version.


Updates typescript from 5.9.2 to 5.9.3

Release notes

Sourced from typescript's releases.

TypeScript 5.9.3

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

Commits
  • c63de15 Bump version to 5.9.3 and LKG
  • 8428ca4 🤖 Pick PR #62438 (Fix incorrectly ignored dts file fr...) into release-5.9 (#...
  • a131cac 🤖 Pick PR #62351 (Add missing Float16Array constructo...) into release-5.9 (#...
  • 0424333 🤖 Pick PR #62423 (Revert PR 61928) into release-5.9 (#62425)
  • bdb641a 🤖 Pick PR #62311 (Fix parenthesizer rules for manuall...) into release-5.9 (#...
  • 0d9b9b9 🤖 Pick PR #61978 (Restructure CI to prepare for requi...) into release-5.9 (#...
  • 2dce0c5 Intentionally regress one buggy declaration output to an older version (#62163)
  • See full diff in compare view

Updates vitest from 3.2.4 to 4.0.3

Release notes

Sourced from vitest's releases.

v4.0.3

   🐞 Bug Fixes

    View changes on GitHub

v4.0.2

   🐞 Bug Fixes

    View changes on GitHub

v4.0.1

   🐞 Bug Fixes

    View changes on GitHub

v4.0.0

Vitest 4.0 is out!

To stay updated, read our blog post and check the migration guide.

   🚨 Breaking Changes

... (truncated)

Commits
  • ca1766f chore: release v4.0.3
  • 155521a fix: preserve reporter options from config when CLI reporters override them (...
  • abc046f fix(init): use correct jsx/tsx extension (#8792)
  • 0fb74bd fix(happy-dom): support fetch globals (#8791)
  • 07bc56a chore: release v4.0.2
  • 2eedbce fix(spy): reset spies if both restoreMocks and mockReset is set in the co...
  • 26ce88d fix(pool): assign envs before running tests to keep in sync with process.env ...
  • 4a28faa chore: release v4.0.1
  • 3fae73e fix(pool): don't teardown the communication channel too soon if something is ...
  • 8100063 fix: move the getBuiltins check (#8765)
  • Additional commits viewa...

    Description has been truncated

@dependabot
chore(dev)(deps-dev): bump the dev-deps group across 1 directory with…
1412ab5 
… 10 updates

Bumps the dev-deps group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.5.1` | `24.9.1` |
| [eslint](https://github.com/eslint/eslint) | `9.36.0` | `9.38.0` |
| [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `5.2.0` | `7.0.1` |
| [eslint-plugin-storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/lib/eslint-plugin) | `9.1.6` | `9.1.15` |
| [eslint-plugin-unused-imports](https://github.com/sweepline/eslint-plugin-unused-imports) | `4.2.0` | `4.3.0` |
| [prettier-plugin-tailwindcss](https://github.com/tailwindlabs/prettier-plugin-tailwindcss) | `0.6.14` | `0.7.1` |
| [stylelint](https://github.com/stylelint/stylelint) | `16.24.0` | `16.25.0` |
| [stylelint-config-standard](https://github.com/stylelint/stylelint-config-standard) | `39.0.0` | `39.0.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.2` | `5.9.3` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `4.0.3` |



Updates `@types/node` from 24.5.1 to 24.9.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 9.36.0 to 9.38.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.36.0...v9.38.0)

Updates `eslint-plugin-react-hooks` from 5.2.0 to 7.0.1
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/HEAD/packages/eslint-plugin-react-hooks)

Updates `eslint-plugin-storybook` from 9.1.6 to 9.1.15
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v9.1.15/code/lib/eslint-plugin)

Updates `eslint-plugin-unused-imports` from 4.2.0 to 4.3.0
- [Commits](sweepline/eslint-plugin-unused-imports@v4.2.0...v4.3.0)

Updates `prettier-plugin-tailwindcss` from 0.6.14 to 0.7.1
- [Release notes](https://github.com/tailwindlabs/prettier-plugin-tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/prettier-plugin-tailwindcss/blob/main/CHANGELOG.md)
- [Commits](tailwindlabs/prettier-plugin-tailwindcss@v0.6.14...v0.7.1)

Updates `stylelint` from 16.24.0 to 16.25.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint@16.24.0...16.25.0)

Updates `stylelint-config-standard` from 39.0.0 to 39.0.1
- [Release notes](https://github.com/stylelint/stylelint-config-standard/releases)
- [Changelog](https://github.com/stylelint/stylelint-config-standard/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint-config-standard@39.0.0...39.0.1)

Updates `typescript` from 5.9.2 to 5.9.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release-publish.yml)
- [Commits](microsoft/TypeScript@v5.9.2...v5.9.3)

Updates `vitest` from 3.2.4 to 4.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.3/packages/vitest)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 24.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-deps
- dependency-name: eslint
  dependency-version: 9.38.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-deps
- dependency-name: eslint-plugin-react-hooks
  dependency-version: 7.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-deps
- dependency-name: eslint-plugin-storybook
  dependency-version: 9.1.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-deps
- dependency-name: eslint-plugin-unused-imports
  dependency-version: 4.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-deps
- dependency-name: prettier-plugin-tailwindcss
  dependency-version: 0.7.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-deps
- dependency-name: stylelint
  dependency-version: 16.25.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-deps
- dependency-name: stylelint-config-standard
  dependency-version: 39.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-deps
- dependency-name: typescript
  dependency-version: 5.9.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-deps
- dependency-name: vitest
  dependency-version: 4.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 27, 2025

Labels

The following labels could not be found: bot:dependabot, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from blackphoenix42 as a code owner October 27, 2025 02:49
@github-actions
Copy link

github-actions bot commented Oct 27, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@eslint/config-array 0.21.1 UnknownUnknown
npm/@eslint/config-helpers 0.4.1 UnknownUnknown
npm/@eslint/core 0.16.0 UnknownUnknown
npm/@eslint/js 9.38.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 6Found 18/28 approved changesets -- score normalized to 6
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
npm/@eslint/object-schema 2.1.7 UnknownUnknown
npm/@eslint/plugin-kit 0.4.0 UnknownUnknown
npm/@types/node 24.9.1 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 8Found 26/29 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/@vitest/expect 4.0.3 UnknownUnknown
npm/@vitest/mocker 4.0.3 UnknownUnknown
npm/@vitest/pretty-format 4.0.3 UnknownUnknown
npm/@vitest/runner 4.0.3 UnknownUnknown
npm/@vitest/snapshot 4.0.3 UnknownUnknown
npm/@vitest/spy 4.0.3 UnknownUnknown
npm/@vitest/utils 4.0.3 UnknownUnknown
npm/chai 6.2.0 🟢 5.5
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1022 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 13/18 approved changesets -- score normalized to 7
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 55 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/eslint 9.38.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 6Found 18/28 approved changesets -- score normalized to 6
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
npm/eslint-plugin-react-hooks 7.0.1 🟢 5.8
Details
CheckScoreReason
Code-Review🟢 8Found 25/30 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 2badge detected: InProgress
License🟢 10license file detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 0229 existing vulnerabilities detected
npm/eslint-plugin-storybook 9.1.15 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/eslint-plugin-unused-imports 4.3.0 🟢 3.2
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 56 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Code-Review⚠️ 2Found 7/29 approved changesets -- score normalized to 2
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities⚠️ 015 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/hermes-estree 0.25.1 🟢 4.8
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 9security policy file detected
SAST⚠️ 0no SAST tool detected
Binary-Artifacts🟢 7binaries present in source code
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
Vulnerabilities⚠️ 028 existing vulnerabilities detected
npm/hermes-parser 0.25.1 🟢 4.8
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 9security policy file detected
SAST⚠️ 0no SAST tool detected
Binary-Artifacts🟢 7binaries present in source code
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
Vulnerabilities⚠️ 028 existing vulnerabilities detected
npm/magic-string 0.30.21 🟢 3.6
Details
CheckScoreReason
Code-Review🟢 4Found 13/30 approved changesets -- score normalized to 4
Maintained🟢 89 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities⚠️ 011 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/prettier-plugin-tailwindcss 0.7.1 UnknownUnknown
npm/stylelint 16.25.0 🟢 7.7
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 9Found 14/15 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 8detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices⚠️ 2badge detected: InProgress
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Security-Policy🟢 4security policy file detected
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/stylelint-config-standard 39.0.1 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 7Found 11/15 approved changesets -- score normalized to 7
Maintained🟢 1016 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 8detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 4security policy file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
npm/tinyrainbow 3.0.3 UnknownUnknown
npm/typescript 5.9.3 🟢 8.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 91 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 10SAST tool is run on all commits
Branch-Protection⚠️ -1internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Fuzzing🟢 10project is fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 34 contributing companies or organizations
npm/undici-types 7.16.0 🟢 8.3
Details
CheckScoreReason
Security-Policy🟢 9security policy file detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
License🟢 10license file detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 76 contributing companies or organizations
npm/vitest 4.0.3 UnknownUnknown
npm/zod-validation-error 4.0.2 UnknownUnknown
npm/@types/node 24.9.1 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 8Found 26/29 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 9license file detected
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/eslint 9.38.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 6Found 18/28 approved changesets -- score normalized to 6
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
npm/eslint-plugin-react-hooks 7.0.1 🟢 5.8
Details
CheckScoreReason
Code-Review🟢 8Found 25/30 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 2badge detected: InProgress
License🟢 10license file detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 0229 existing vulnerabilities detected
npm/eslint-plugin-storybook 9.1.15 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/eslint-plugin-unused-imports 4.3.0 🟢 3.2
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 56 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Code-Review⚠️ 2Found 7/29 approved changesets -- score normalized to 2
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities⚠️ 015 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/prettier-plugin-tailwindcss 0.7.1 UnknownUnknown
npm/stylelint 16.25.0 🟢 7.7
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 9Found 14/15 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 8detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices⚠️ 2badge detected: InProgress
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Security-Policy🟢 4security policy file detected
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Vulnerabilities🟢 100 existing vulnerabilities detected
npm/stylelint-config-standard 39.0.1 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 7Found 11/15 approved changesets -- score normalized to 7
Maintained🟢 1016 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 8detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 4security policy file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
npm/typescript ^5.9.3 🟢 8.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 91 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 10SAST tool is run on all commits
Branch-Protection⚠️ -1internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Fuzzing🟢 10project is fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 34 contributing companies or organizations
npm/vitest 4.0.3 UnknownUnknown

Scanned Files

  • package-lock.json
  • package.json

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 3, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Nov 3, 2025
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/dev-deps-18ca234696 branch November 3, 2025 02:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@blackphoenix42 blackphoenix42 Awaiting requested review from blackphoenix42 blackphoenix42 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants