deps: update ncm-ng to 2.9.9

[santigimeno]

Addresses GHSA-ph9p-34f9-6g65.

Summary by CodeRabbit

• Chores
  • Bumped package version.
  • Updated a transitive utility dependency to a newer minor release to address maintenance and stability.
  • No functional or public API changes; user-facing behavior remains unchanged.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1a51428d-1d7a-41e5-851d-107f35d6e089

📥 Commits

Reviewing files that changed from the base of the PR and between e9aa793 and e9d6fc1.

📒 Files selected for processing (1)

• deps/ncm-ng/package.json

---

Walkthrough

This PR updates deps/ncm-ng/package.json: bumps the package version 2.9.8 → 2.9.9 and updates the tmp dependency ^0.2.1 → ^0.2.6.

Changes

Package and Dependency Update

Layer / File(s)	Summary
NCM-NG package version and tmp dependency bump deps/ncm-ng/package.json	Version incremented to 2.9.9 and tmp dependency updated to ^0.2.6.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• nodesource/nsolid#455: Previous version bump of @ns-private/ncm-ng in the same file, part of the same dependency update chain.

Suggested reviewers

• RafaelGSS

Poem

🐰 I hopped through JSON, neat and spry,
Pushed a tiny bump to catch the eye,
Two.nine.nine now leads the trail,
tmp updated — a little tale,
Cheers from the rabbit with a hop and a sigh.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'deps: update ncm-ng to 2.9.9' directly and clearly summarizes the main change in the pull request, which is updating the ncm-ng dependency version.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch santi/dep_updates

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​isaacs/​string-locale-compare@​1.1.0
	npm/​@​npmcli/​arborist@​9.7.0
	npm/​@​npmcli/​eslint-config@​5.1.0
	npm/​@​npmcli/​redact@​4.0.0
	npm/​@​npmcli/​metavuln-calculator@​9.0.3
	npm/​@​npmcli/​run-script@​10.0.4
	npm/​@​npmcli/​fs@​5.0.0
	npm/​@​npmcli/​promise-spawn@​9.0.1
	npm/​@​npmcli/​git@​7.0.2
	npm/​@​npmcli/​map-workspaces@​5.0.3
	npm/​@​npmcli/​template-oss@​4.29.0
	npm/​@​npmcli/​package-json@​7.0.5
	npm/​@​npmcli/​config@​10.10.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @mswjs/interceptors is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@mswjs/interceptors@0.41.9 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mswjs/interceptors@0.41.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

This PR updates the vendored deps/ncm-ng package metadata to address security advisory GHSA-ph9p-34f9-6g65 by bumping the package version and updating a vulnerable dependency.

Changes:

• Bump @ns-private/ncm-ng version from 2.9.8 to 2.9.9.
• Update tmp dependency from ^0.2.1 to ^0.2.6.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.