Skip to content

chore(deps): bump the frontend-compatible group across 1 directory with 14 updates - #3274

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/arcane/home/honeypot-dashboard/frontend-next/frontend-compatible-15806ba566
Closed

chore(deps): bump the frontend-compatible group across 1 directory with 14 updates#3274
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/arcane/home/honeypot-dashboard/frontend-next/frontend-compatible-15806ba566

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the frontend-compatible group with 14 updates in the /arcane/home/honeypot-dashboard/frontend-next directory:

Package From To
@tanstack/react-router 1.170.32 1.170.38
@tanstack/react-start 1.168.49 1.168.56
cytoscape 3.34.2 3.34.3
openid-client 6.8.7 6.8.8
react 19.2.8 19.3.0
@types/react 19.2.18 19.3.0
react-dom 19.2.8 19.3.0
@types/react-dom 19.2.5 19.3.0
undici 8.10.0 8.10.2
@playwright/test 1.62.1 1.63.0
@tanstack/router-cli 1.167.33 1.167.38
@types/node 26.4.0 26.6.1
@types/react 19.2.18 19.3.0
@types/react-dom 19.2.5 19.3.0
jsdom 30.0.1 30.1.0
vite 8.2.2 8.3.0

Updates @tanstack/react-router from 1.170.32 to 1.170.38

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.38

Patch Changes

@​tanstack/react-router@​1.170.37

Patch Changes

  • #8418 e561fa1 - deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.

  • #8419 a1c8d1a - resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.

  • #8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

    Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

    Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

    The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

    The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

    Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

    Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

    Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

    Static server functions decode cached RawStream values with the client deserializer plugins.

    SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

  • #8420 8e164d2 - useLinkProps no longer calls through an internal wrapper. The host element Link renders on is an @internal overload parameter that is stripped from the published declarations, so the public useLinkProps(options, forwardedRef?) signature is unchanged.

  • Updated dependencies [bc80866, e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, a0b2ad9, 1ca361b]:

    • @​tanstack/router-core@​1.171.31

@​tanstack/react-router@​1.170.36

Patch Changes

  • #8390 b747fb8 - Keep the Link location cache out of server bundles: buildLocation only creates, reads and writes it when isServer is false. Render React Links on the server without the extra prop copies and the forwarded-ref hook. Link SSR rendering is 20-40% faster in the Link benchmarks and the React Start SSR request loop about 7% faster.

    React activeProps and inactiveProps now follow one precedence rule on every link, including links whose destination is blocked for using a disallowed scheme: state props override element props, ref and event handlers, while href, disabled and target stay controlled by the router. Previously a blocked link ignored a ref or handler from its inactive props.

    React Link and useLinkProps split router options from element props with one key set on the client and the server. Element props pass through as given: external links forward them verbatim, falsy values included, and useLinkProps now returns children for router-controlled links as it already did for external ones.

  • #8324 6387d58 - Reuse hydration snapshot getters to avoid unnecessary store-instance effect updates when Links and other hydration-aware components rerender.

  • #8318 9b2adaf - Allow active and inactive Link props to override base element props in React and Solid while preserving class/style merging. Keep React's href, target, and disabled values controlled by routing options. Preserve Vue object and nested-array class bindings, including reactive updates and server rendering, without mutating cached bindings during VNode normalization.

... (truncated)

Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.38

Patch Changes

1.170.37

Patch Changes

  • #8418 e561fa1 - deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.

  • #8419 a1c8d1a - resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.

  • #8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

    Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

    Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

    The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

    The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

    Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

    Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

    Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

    Static server functions decode cached RawStream values with the client deserializer plugins.

    SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

  • #8420 8e164d2 - useLinkProps no longer calls through an internal wrapper. The host element Link renders on is an @internal overload parameter that is stripped from the published declarations, so the public useLinkProps(options, forwardedRef?) signature is unchanged.

  • Updated dependencies [bc80866, e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, a0b2ad9, 1ca361b]:

    • @​tanstack/router-core@​1.171.31

1.170.36

Patch Changes

  • #8390 b747fb8 - Keep the Link location cache out of server bundles: buildLocation only creates, reads and writes it when isServer is false. Render React Links on the server without the extra prop copies and the forwarded-ref hook. Link SSR rendering is 20-40% faster in the Link benchmarks and the React Start SSR request loop about 7% faster.

    React activeProps and inactiveProps now follow one precedence rule on every link, including links whose destination is blocked for using a disallowed scheme: state props override element props, ref and event handlers, while href, disabled and target stay controlled by the router. Previously a blocked link ignored a ref or handler from its inactive props.

    React Link and useLinkProps split router options from element props with one key set on the client and the server. Element props pass through as given: external links forward them verbatim, falsy values included, and useLinkProps now returns children for router-controlled links as it already did for external ones.

... (truncated)

Commits

Updates @tanstack/react-start from 1.168.49 to 1.168.56

Release notes

Sourced from @​tanstack/react-start's releases.

@​tanstack/react-start@​1.168.56

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-router@​1.170.38
    • @​tanstack/react-start-client@​1.168.36
    • @​tanstack/react-start-rsc@​0.1.55
    • @​tanstack/react-start-server@​1.167.43
    • @​tanstack/start-client-core@​1.170.32
    • @​tanstack/start-plugin-core@​1.171.46
    • @​tanstack/start-server-core@​1.169.37

@​tanstack/react-start@​1.168.55

Patch Changes

  • Updated dependencies [e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, 8e164d2]:
    • @​tanstack/react-router@​1.170.37
    • @​tanstack/start-plugin-core@​1.171.45
    • @​tanstack/start-client-core@​1.170.31
    • @​tanstack/start-server-core@​1.169.36
    • @​tanstack/react-start-client@​1.168.35
    • @​tanstack/react-start-rsc@​0.1.54
    • @​tanstack/react-start-server@​1.167.42

@​tanstack/react-start@​1.168.54

Patch Changes

  • Updated dependencies [ab99818]:
    • @​tanstack/start-plugin-core@​1.171.44
    • @​tanstack/react-start-rsc@​0.1.53

@​tanstack/react-start@​1.168.53

Patch Changes

Changelog

Sourced from @​tanstack/react-start's changelog.

1.168.56

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-router@​1.170.38
    • @​tanstack/react-start-client@​1.168.36
    • @​tanstack/react-start-rsc@​0.1.55
    • @​tanstack/react-start-server@​1.167.43
    • @​tanstack/start-client-core@​1.170.32
    • @​tanstack/start-plugin-core@​1.171.46
    • @​tanstack/start-server-core@​1.169.37

1.168.55

Patch Changes

  • Updated dependencies [e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, 8e164d2]:
    • @​tanstack/react-router@​1.170.37
    • @​tanstack/start-plugin-core@​1.171.45
    • @​tanstack/start-client-core@​1.170.31
    • @​tanstack/start-server-core@​1.169.36
    • @​tanstack/react-start-client@​1.168.35
    • @​tanstack/react-start-rsc@​0.1.54
    • @​tanstack/react-start-server@​1.167.42

1.168.54

Patch Changes

  • Updated dependencies [ab99818]:
    • @​tanstack/start-plugin-core@​1.171.44
    • @​tanstack/react-start-rsc@​0.1.53

1.168.53

Patch Changes

1.168.52

Patch Changes

... (truncated)

Commits

Updates cytoscape from 3.34.2 to 3.34.3

Release notes

Sourced from cytoscape's releases.

v3.34.3

Release version v3.34.3

Commits

Updates openid-client from 6.8.7 to 6.8.8

Release notes

Sourced from openid-client's releases.

v6.8.8

Fixes

  • apply the default HTTP request timeout (af32783)
  • calculate token lifetimes using elapsed time (e816bf0)
  • isolate lazy client authentication handler caches (d687796)
  • passport: handle rejected async verification callbacks (d730f80)
  • preserve clock settings across DCR nonce retries (5433d68)
  • release: separate changelog sections (57fcbc6)
  • retain polling abort signals through response processing (b26170e)
  • select a unique decryption key when kid is omitted (10ba026)

Refactor

  • share grant polling lifecycle and retry handling (b931c40)
Changelog

Sourced from openid-client's changelog.

6.8.8 (2026-09-05)

Fixes

  • apply the default HTTP request timeout (af32783)
  • calculate token lifetimes using elapsed time (e816bf0)
  • isolate lazy client authentication handler caches (d687796)
  • passport: handle rejected async verification callbacks (d730f80)
  • preserve clock settings across DCR nonce retries (5433d68)
  • release: separate changelog sections (57fcbc6)
  • retain polling abort signals through response processing (b26170e)
  • select a unique decryption key when kid is omitted (10ba026)

Refactor

  • share grant polling lifecycle and retry handling (b931c40)
Commits
  • 04c5982 chore(release): 6.8.8
  • 5eccf2e chore: bump packages
  • d730f80 fix(passport): handle rejected async verification callbacks
  • b931c40 refactor: share grant polling lifecycle and retry handling
  • d687796 fix: isolate lazy client authentication handler caches
  • e816bf0 fix: calculate token lifetimes using elapsed time
  • 10ba026 fix: select a unique decryption key when kid is omitted
  • b26170e fix: retain polling abort signals through response processing
  • af32783 fix: apply the default HTTP request timeout
  • 5433d68 fix: preserve clock settings across DCR nonce retries
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

@dependabot
chore(deps): bump the frontend-compatible group across 1 directory wi…
5a76f4c 
…th 14 updates

Bumps the frontend-compatible group with 14 updates in the /arcane/home/honeypot-dashboard/frontend-next directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.32` | `1.170.38` |
| [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.168.49` | `1.168.56` |
| [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.2` | `3.34.3` |
| [openid-client](https://github.com/panva/openid-client) | `6.8.7` | `6.8.8` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.3.0` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [@tanstack/router-cli](https://github.com/TanStack/router/tree/HEAD/packages/router-cli) | `1.167.33` | `1.167.38` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.0` | `26.6.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.3.0` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.0.1` | `30.1.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.0` |



Updates `@tanstack/react-router` from 1.170.32 to 1.170.38
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.38/packages/react-router)

Updates `@tanstack/react-start` from 1.168.49 to 1.168.56
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.56/packages/react-start)

Updates `cytoscape` from 3.34.2 to 3.34.3
- [Release notes](https://github.com/cytoscape/cytoscape.js/releases)
- [Commits](cytoscape/cytoscape.js@v3.34.2...v3.34.3)

Updates `openid-client` from 6.8.7 to 6.8.8
- [Release notes](https://github.com/panva/openid-client/releases)
- [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md)
- [Commits](panva/openid-client@v6.8.7...v6.8.8)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@types/react-dom` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `undici` from 8.10.0 to 8.10.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.10.0...v8.10.2)

Updates `@playwright/test` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `@tanstack/router-cli` from 1.167.33 to 1.167.38
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/router-cli/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/router-cli@1.167.38/packages/router-cli)

Updates `@types/node` from 26.4.0 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `jsdom` from 30.0.1 to 30.1.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.0.1...v30.1.0)

Updates `vite` from 8.2.2 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

---
updated-dependencies:
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-compatible
- dependency-name: "@tanstack/react-start"
  dependency-version: 1.168.56
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-compatible
- dependency-name: cytoscape
  dependency-version: 3.34.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-compatible
- dependency-name: openid-client
  dependency-version: 6.8.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-compatible
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: undici
  dependency-version: 8.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-compatible
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: "@tanstack/router-cli"
  dependency-version: 1.167.38
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-compatible
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: jsdom
  dependency-version: 30.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-compatible
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file frontend Frontend dependency updates (Dependabot npm scope) — not the dashboard product area labels Sep 21, 2026
@dependabot
dependabot Bot requested a review from Xore as a code owner September 21, 2026 02:37
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file frontend Frontend dependency updates (Dependabot npm scope) — not the dashboard product area labels Sep 21, 2026
@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@asamuzakjp/css-color 7.0.0 UnknownUnknown
npm/@asamuzakjp/dom-selector 9.1.4 UnknownUnknown
npm/@csstools/css-calc 3.4.0 🟢 7
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
SAST🟢 10SAST tool detected: CodeQL
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/@csstools/css-color-parser 4.2.3 UnknownUnknown
npm/@csstools/css-syntax-patches-for-csstree 1.1.14 🟢 7
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
SAST🟢 10SAST tool detected: CodeQL
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/@oxc-project/types 0.150.0 UnknownUnknown
npm/@playwright/test 1.63.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/@rolldown/binding-android-arm-eabi 1.2.9 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.2.9 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.2.9 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.2.9 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.2.9 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.2.9 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.2.9 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.2.9 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.2.9 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.2.9 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.2.9 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.2.9 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.2.9 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.2.9 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.2.9 UnknownUnknown
npm/@tanstack/history 1.162.4 UnknownUnknown
npm/@tanstack/react-router 1.170.38 UnknownUnknown
npm/@tanstack/react-start 1.168.56 UnknownUnknown
npm/@tanstack/react-start-client 1.168.36 UnknownUnknown
npm/@tanstack/react-start-rsc 0.1.55 UnknownUnknown
npm/@tanstack/react-start-server 1.167.43 UnknownUnknown
npm/@tanstack/react-store 0.11.1 UnknownUnknown
npm/@tanstack/router-cli 1.167.38 UnknownUnknown
npm/@tanstack/router-core 1.171.32 UnknownUnknown
npm/@tanstack/router-generator 1.167.38 UnknownUnknown
npm/@tanstack/router-plugin 1.168.40 UnknownUnknown
npm/@tanstack/router-utils 1.162.3 UnknownUnknown
npm/@tanstack/start-client-core 1.170.32 UnknownUnknown
npm/@tanstack/start-plugin-core 1.171.46 UnknownUnknown
npm/@tanstack/start-server-core 1.169.37 UnknownUnknown
npm/@tanstack/start-storage-context 1.167.34 UnknownUnknown
npm/@tanstack/store 0.11.1 UnknownUnknown
npm/@types/node 26.6.1 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 27/30 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@types/react 19.3.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 27/30 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@types/react-dom 19.3.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 27/30 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/bidi-js 1.1.0 🟢 3.5
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 6/25 approved changesets -- score normalized to 2
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/cytoscape 3.34.3 🟢 5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 2Found 2/7 approved changesets -- score normalized to 2
Security-Policy🟢 9security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/fsevents 2.3.3 🟢 3.1
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 3Found 7/22 approved changesets -- score normalized to 3
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/jose 6.2.12 🟢 7.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/28 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Signed-Releases🟢 42 out of the last 4 releases have a total of 2 signed artifacts.
SAST🟢 10SAST tool is run on all commits
npm/jsdom 30.1.0 🟢 7.1
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 4Found 12/27 approved changesets -- score normalized to 4
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/nanoid 3.3.19 🟢 6.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 3SAST tool is not run on all commits -- score normalized to 3
npm/oauth4webapi 3.8.8 UnknownUnknown
npm/openid-client 6.8.8 UnknownUnknown
npm/picomatch 4.0.7 🟢 6.8
Details
CheckScoreReason
Code-Review🟢 5Found 7/13 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 5SAST tool is not run on all commits -- score normalized to 5
npm/playwright 1.63.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/playwright-core 1.63.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/postcss 8.5.28 🟢 7.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 11/30 approved changesets -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/react 19.3.0 UnknownUnknown
npm/react-dom 19.3.0 UnknownUnknown
npm/rolldown 1.2.9 UnknownUnknown
npm/scheduler 0.28.0 UnknownUnknown
npm/undici 8.10.2 🟢 8.2
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Vulnerabilities🟢 64 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
SAST🟢 10SAST tool is run on all commits
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 63 contributing companies or organizations
npm/undici-types 8.9.0 🟢 8.2
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Vulnerabilities🟢 64 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
SAST🟢 10SAST tool is run on all commits
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 63 contributing companies or organizations
npm/unplugin 3.4.0 UnknownUnknown
npm/use-sync-external-store 1.7.0 UnknownUnknown
npm/vite 8.3.0 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 7detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts⚠️ 1binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
npm/whatwg-url 17.1.1 🟢 5
Details
CheckScoreReason
Maintained🟢 1020 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 0Found 2/28 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Packaging🟢 10packaging workflow detected
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/zod 4.6.5 🟢 5.4
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • arcane/home/honeypot-dashboard/frontend-next/package-lock.json

@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown

Not auto-merging: this lockfile does not install under node:22-alpine's npm (the Dockerfile's own image), the recurring #2741 failure mode. Regenerate it under that image before merging -- see #2741's canonical command.

@dependabot @github

dependabot Bot commented on behalf of github Sep 25, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 25, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/arcane/home/honeypot-dashboard/frontend-next/frontend-compatible-15806ba566 branch September 25, 2026 06:15
@Xore Xore mentioned this pull request Sep 27, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Xore Xore Awaiting requested review from Xore Xore is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file frontend Frontend dependency updates (Dependabot npm scope) — not the dashboard product area

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants