8000 deps: bump the production-dependencies group across 1 directory with 27 updates by dependabot[bot] · Pull Request #455 · dominicusin/dominicusin.github.io · GitHub
[go: up one dir, main page]
Skip to content

deps: bump the production-dependencies group across 1 directory with 27 updates - #455

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-b8f443c63c
Closed

deps: bump the production-dependencies group across 1 directory with 27 updates#455
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-b8f443c63c

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 27 updates in the / directory:

Package From To
@axe-core/playwright 4.13.0 4.14.0
balanced-match 4.0.4 5.0.0
baseline-browser-mapping 2.11.28 2.11.31
browserslist 4.29.3 4.29.4
camelcase 9.0.0 10.0.0
caniuse-lite 1.0.30001815 1.0.30001819
cssnano-utils 8.2.1 9.0.0
electron-to-chromium 1.5.452 1.5.463
emittery 2.1.0 2.2.0
execa 10.1.0 10.2.1
fast-uri 4.2.1 4.2.3
ignore 7.0.12 7.0.13
jsdom 30.1.2 30.1.3
lilconfig 3.1.3 3.1.4
markdown-it 15.0.2 15.0.3
marked 18.1.0 18.1.1
node-releases 2.0.58 2.0.60
postcss 8.5.29 8.5.31
postcss-calc 11.2.2 11.2.3
postcss-normalize-url 9.0.6 10.0.0
postcss-selector-parser 7.1.6 7.1.7
postcss-svgo 9.0.5 9.1.0
react-is 19.3.0 19.3.1
resolve.exports 2.0.3 2.0.4
sass 1.105.1 1.106.1
undici-types 8.11.2 8.12.3
whatwg-url 17.2.0 17.3.0

Updates @axe-core/playwright from 4.13.0 to 4.14.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.14.0

What's Changed

New Contributors

Full Changelog: dequelabs/axe-core-npm@v4.13.0...v4.14.0

Changelog

Sourced from @​axe-core/playwright's changelog.

4.14.0 (2026-10-06)

Bug Fixes

Features

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates balanced-match from 4.0.4 to 5.0.0

Commits

Updates baseline-browser-mapping from 2.11.28 to 2.11.31

Commits
  • 22ea69a Patch to 2.11.31 because browser or feature data changed
  • aac3917 Browser or feature data changed
  • 19670e7 Updating static site
  • 65822d6 Patch to 2.11.30 because browser or feature data changed
  • c074f56 Browser or feature data changed
  • 4517bea Updating static site
  • 4352208 Updating static site
  • 091495e build(deps-dev): Bump @​humanfs/node from 0.16.6 to 0.16.8 (#152)
  • c69aaba build(deps-dev): Bump js-yaml from 4.3.1 to 4.3.2 (#151)
  • 3fa5618 build(deps-dev): Bump proxy-addr from 2.0.7 to 2.0.8 (#150)
  • Additional commits viewable in compare view

Updates browserslist from 4.29.3 to 4.29.4

Release notes

Sourced from browserslist's releases.

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).
Changelog

Sourced from browserslist's changelog.

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).
Commits
  • f7a99b9 Release 4.29.4 version
  • 03fc702 Update dependencies
  • efe07e1 Merge pull request #956 from ybai08/fix-joined-range-bounds
  • ef50f5b Fix joined version bounds in version ray and range queries
  • 8219dd7 Merge pull request #954 from abhu85/fix-since-extends-whitespace
  • 893120b Allow arbitrary whitespaces in since, extends, config and not queries
  • See full diff in compare view

Updates camelcase from 9.0.0 to 10.0.0

Release notes

Sourced from camelcase's releases.

v10.0.0

Breaking

  • Require Node.js 22 27454cc

Fixes

  • Fix handling of letters outside the Basic Multilingual Plane (#117) 92d7f63
    • Letters that need a surrogate pair (for example, Deseret and Osage) are now handled as one character. pascalCase now uppercases such a first letter, and an uppercase letter of this type in the middle of a word is no longer lowercased.
  • Fix preserveConsecutiveUppercase when capitalizeAfterNumber is false 3433c29
    • An uppercase letter after a character such as ! or @ was lowercased. Now foo!Bar stays foo!Bar, the same as when capitalizeAfterNumber is true.
  • Treat decimal digits from all scripts as numbers for capitalizeAfterNumber 97e8e40
    • Before, only ASCII digits were numbers. Now foo١bar becomes foo١Bar, the same as foo1bar becomes foo1Bar.

sindresorhus/camelcase@v9.0.0...v10.0.0

Commits

Updates caniuse-lite from 1.0.30001815 to 1.0.30001819

Commits

Updates cssnano-utils from 8.2.1 to 9.0.0

Release notes

Sourced from cssnano-utils's releases.

v9.0.0

What's Changed

Breaking changes

Probably backward-compatible for most users. Some changes to configuration loading documented in migration guide.

Bug fixes

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.10...cssnano@9.0.0

v71.1.1

Bug Fixes

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.0...cssnano@7.1.1

Commits

Updates electron-to-chromium from 1.5.452 to 1.5.463

Commits

Updates emittery from 2.1.0 to 2.2.0

Release notes

Sourced from emittery's releases.

v2.2.0

  • Add ReadonlyEmittery type 0edab03

sindresorhus/emittery@v2.1.0...v2.2.0

Commits

Updates execa from 10.1.0 to 10.2.1

Release notes

Sourced from execa's releases.

v10.2.1

  • Fix types compatibility with exactOptionalPropertyTypes 2b6988b1

sindresorhus/execa@v10.2.0...v10.2.1

v10.2.0

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

  • Exceeding maxBuffer now terminates the subprocess with killSignal, instead of leaving it running and the promise pending f6de9be
  • maxBuffer: 0 now limits the output of synchronous methods, like asynchronous methods 224dd20
  • Options of $ set to undefined now use $'s defaults, such as inheriting stdin f61a6e9

Fixes

  • Fix invalid file descriptor objects, such as closed file handles, crashing the current process instead of throwing d0a5968
  • Fix synchronous transforms: errors being hidden, filtered output being returned on failure, mixed text and byte chunks being reordered, and final() being skipped without input 0ba2b6e ed80079 9c54833
  • Fix result.all changing objects when only stdout or stderr is buffered 8629132
  • Fix writing objects to a web WritableStream 5ea2900
  • Fix an invalid subprocess.duplex() option making later stream conversions hang 5e4345b
  • Fix execaNode() not running its file when the current process uses --print e747872

Types

  • Fix result and subprocess types when the options are a union, including IPC f5772f3 355d917 cb8aaf6
  • Fix result types when options bound with execa(options) are overridden or reset with undefined 708fed7
  • Fix subprocess.stdin types with the input and inputFile options 236c831
  • Fix chunk types of subprocess.iterable() with object-mode transforms a2912e5
  • Fix fd-specific option types, and execaNode() types with node: undefined 80b01e9 523cf9b

sindresorhus/execa@v10.1.1...v10.2.0

v10.1.1

  • Fix execaNode() and the node option missing IPC in their types 2633abb
  • Fix escapedCommand and verbose quoting arguments when using the shell option b2c3a54
  • Fix wrong-typed options and arguments being silently ignored or coerced b57d643
  • Fix the verbose option printing colors when stderr is not a terminal a2eda67
  • Fix stdin iterables and input transforms edge cases 6925cc3
  • Fix IPC edge cases 5f80cde
  • Fix .pipe() and stream conversion edge cases d3ec10d
  • Fix template strings, parseCommandString() and execaNode() edge cases fb92da1
  • Fix invalid timeout and forceKillAfterDelay values d9a5689
  • Fix errors, early errors and result.all edge cases c4262ff

... (truncated)

Commits
  • 247faa0 10.2.1
  • e375b0b Fix tests
  • 2b6988b Fix types compatibility with exactOptionalPropertyTypes
  • e7e0664 Fix flaky Windows test cleanup of copied executables
  • a605753 10.2.0
  • b87aab7 Fix link check in type tests
  • cb8aaf6 Fix IPC types for option unions
  • 80b01e9 Fix fd-specific option types
  • 355d917 Fix subprocess stream types for option unions
  • 523cf9b Fix execaNode() result types when the node option is undefined
  • Additional commits viewable in compare view

Updates fast-uri from 4.2.1 to 4.2.3

Release notes

Sourced from fast-uri's releases.

v4.2.3

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@4.2.3

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v4.2.2...v4.2.3

v4.2.2

What's Changed

Full Changelog: fastify/fast-uri@v4.2.1...v4.2.2

Commits
  • 00f4140 Bumped v4.2.3
  • 6d1dc6f test: generate only relative path references
  • 52774a5 fix: preserve relative paths in suffix and relative resolution
  • b6a75ea docs: note suffix-reference authority ambiguity
  • a9b8d67 fix: escape a first-segment colon in suffix references
  • bfeefaf test: cover first-segment colon in suffix references
  • f6d46df fix(SEC-03): reject non reg-name characters in domain hosts
  • f7fc8cc fix: keep a colon-first segment behind "./" in relative normalization
  • b6dda15 test: cover colon-first relative references in normalization
  • acc5c5d fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates ignore from 7.0.12 to 7.0.13

Commits
  • 4320083 bump version 7.0.13
  • 3fe0ab1 types: export TestResult, IgnoreRule, PatternParams and Pathname
  • d449c4a docs: say exactly when unignored is false although nothing is ignored
  • 5c4c3fb docs: say what a dot component in a Pathname does
  • 2d3959b refactor: drop backslash arithmetic wit 8000 h no reachable input
  • d13f340 tidy up how a quoted backslash compiles
  • 26b1d1a tidy up how a few characters compile
  • a8ce6f3 docs: describe the wildcard pin as it now works
  • 3ba88de Merge pull request #174 from Yuren0312/docs-issue-116-clarify-unignored
  • d132c50 docs: clarify the two meanings of {ignored: false, unignored: false} of .test()
  • Additional commits viewable in compare view

Updates jsdom from 30.1.2 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

  • Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
  • Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
  • Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
  • Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
  • Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
  • Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
  • Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
  • Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
  • Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
  • Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
  • Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
  • Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
  • Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
  • Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)
Commits
  • 058c0f5 30.1.3
  • fcd1fd1 Cascade parsed longhands independently
  • a3ee786 Cascade computed style properties on demand
  • f42dc15 Resolve colors before caching or using currentcolor
  • 074b1fb Compute background-position lengths against the final font size
  • d19598c Apply style rules nested in multiple @​media rules
  • 45d626c Rule out attribute selector subjects before matching
  • 3ff0a5b Upgrade Undici and remove abort workarounds
  • 8813bb1 Ignore CSS declarations with unparseable math functions
  • 63712d8 Fix XHR credentials across redirects
  • Additional commits viewable in compare view

Updates lilconfig from 3.1.3 to 3.1.4

Release notes

Sourced from lilconfig's releases.

v3.1.4

  • Fixes support for JSON configs with a UTF-8 BOM
  • Update development dependencies
  • Correct documentation typos
Commits

Updates markdown-it from 15.0.2 to 15.0.3

Changelog

Sourced from markdown-it's changelog.

[15.0.3] - 2026-10-16

Changed

  • Updated dependencies.

Fixed

  • Enforce the 999 Unicode code point limit for reference definition labels, partially addressing #1213.
  • Require whitespace before multiline reference titles.

Security

  • Fixed quadratic complexity when parsing multiline reference definitions.
  • Fixed quadratic complexity when parsing unclosed inline HTML comments, processing instructions, declarations and CDATA sections.
Commits

Updates marked from 18.1.0 to 18.1.1

Release notes

Sourced from marked's releases.

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

  • cli: honor an explicitly empty string input (#4113) (ec3a4e5)
  • end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
  • keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
  • keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
  • let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
  • make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
  • match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
  • preserve enclosing link state after parsing images (#4123) (cc07bb9)
  • respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

  • avoid repeated raw string copies in nested lists (#4082) (7e8754d)
Commits
  • cdbdc01 chore(release): 18.1.1 [skip ci]
  • 2134976 docs: add AGENTS.md (#4125)
  • 699a969 chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#4133)
  • 6a57018 fix: keep a backslash in a code span from hiding emphasis (#4117)
  • eaa1fff fix: let indented and type 3-5 html blocks interrupt a paragraph (#4124)
  • 7e8754d perf: avoid repeated raw string copies in nested lists (#4082)
  • cc07bb9 fix: preserve enclosing link state after parsing images (#4123)
  • 627d9ae fix: make walkTokens linear by appending values in place (#4121)
  • 4bd2528 fix: respect tab stops in list continuation indentation (#4119)
  • 9e64a6a fix: end blockquote before a lazy line after a heading, hr or html block (#4115)
  • Additional commits viewable in compare view

Updates node-releases from 2.0.58 to 2.0.60

Commits

Updates postcss from 8.5.29 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).
Changelog

Sourced from postcss's changelog.

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).
Commits

Updates postcss-calc from 11.2.2 to 11.2.3

Release notes

Sourced from postcss-calc's releases.

11.2.3

What's Changed

Full Changelog: postcss/postcss-calc@v11.2.2...v11.2.3

Changelog

Sourced from postcss-calc's changelog.

11.2.3 (2026-10-10)

Bug fixes

  • postcss-calc now emits -0 in some cases where it previously emitted calc(-1 * 0), in order to obtain some output size savings when a negative 0 appears
Commits
  • 9c0f059 Publish 11.2.3
  • 57c4aa7 refactor: replace closure with plain loop
  • 2aac1f5 test: refactor scripts
  • b54ac65 chore: add more lint rules
  • ff0ba13 test: reduce duplicated code and split large test files
  • ca3d479 docs: improve README
  • 94847b4 fix: improve negative zero serialization
  • 7eefefc chore: update postcss
  • eb7c9fb chore: update linters
  • e8ce5a6 chore: update pnpm to 12.10.1
  • Additional commits viewable in compare view

Updates postcss-normalize-url from 9.0.6 to 10.0.0

Release notes

Sourced from postcss-normalize-url's releases.

cssnano-preset-advanced 10.0.0

What's Changed

Major changes

The advanced preset no longer removes vendor prefixes or sorts declarations, and no longer depends on autoprefixer or css-declaration-sorter. This might be a breaking change if your build was relying on cssnano to apply browser prefixes for compatibility.

To keep removing outdated prefixes, install the autoprefixer npnm package and run the autoprefixer PostCSS plugin with add: false before cssnano. To keep sorting declaration, install the css-declaration-sorter npm package and run the css-declaration-sorter PostCSS plugin with keepOverrides: true. The autoprefixer and cssDeclarationSorter cssnano advanced preset options are gone; passing them has no effect.

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.8.0...cssnano-preset-advanced@10.0.0

v9.9.0

What's Changed

  • cssnano now ships its presets and plugins in a single package, so installing it adds one cssnano package to your dependency tree instead of about thirty, and you have fewer packages to review in audits and lockfile updates.

    preset: 'lite' and preset: 'advanced' now work without installing another package. An installed preset package still takes precedence over the built-in one and prints a one-time CSSNANO_INSTALLED_PRESET warning; pass the imported preset function to keep it without the warning. Full names such as cssnano-preset-default fall back to the built-in preset when no package is installed. Projects that require cssna...

    Description has been truncated

@dependabot
deps: bump the production-dependencies group across 1 directory with …
7e515fe 
…27 updates

Bumps the production-dependencies group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` |
| [balanced-match](https://github.com/juliangruber/balanced-match) | `4.0.4` | `5.0.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.11.28` | `2.11.31` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.29.3` | `4.29.4` |
| [camelcase](https://github.com/sindresorhus/camelcase) | `9.0.0` | `10.0.0` |
| [caniuse-lite](https://github.com/browserslist/caniuse-lite) | `1.0.30001815` | `1.0.30001819` |
| [cssnano-utils](https://github.com/cssnano/cssnano) | `8.2.1` | `9.0.0` |
| [electron-to-chromium](https://github.com/Kilian/electron-to-chromium) | `1.5.452` | `1.5.463` |
| [emittery](https://github.com/sindresorhus/emittery) | `2.1.0` | `2.2.0` |
| [execa](https://github.com/sindresorhus/execa) | `10.1.0` | `10.2.1` |
| [fast-uri](https://github.com/fastify/fast-uri) | `4.2.1` | `4.2.3` |
| [ignore](https://github.com/kaelzhang/node-ignore) | `7.0.12` | `7.0.13` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.2` | `30.1.3` |
| [lilconfig](https://github.com/antonk52/lilconfig) | `3.1.3` | `3.1.4` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.2` | `15.0.3` |
| [marked](https://github.com/markedjs/marked) | `18.1.0` | `18.1.1` |
| [node-releases](https://github.com/chicoxyzzy/node-releases) | `2.0.58` | `2.0.60` |
| [postcss](https://github.com/postcss/postcss) | `8.5.29` | `8.5.31` |
| [postcss-calc](https://github.com/postcss/postcss-calc) | `11.2.2` | `11.2.3` |
| [postcss-normalize-url](https://github.com/cssnano/cssnano) | `9.0.6` | `10.0.0` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.6` | `7.1.7` |
| [postcss-svgo](https://github.com/cssnano/cssnano) | `9.0.5` | `9.1.0` |
| [react-is](https://github.com/react/react/tree/HEAD/packages/react-is) | `19.3.0` | `19.3.1` |
| [resolve.exports](https://github.com/lukeed/resolve.exports) | `2.0.3` | `2.0.4` |
| [sass](https://github.com/sass/dart-sass) | `1.105.1` | `1.106.1` |
| [undici-types](https://github.com/nodejs/undici) | `8.11.2` | `8.12.3` |
| [whatwg-url](https://github.com/jsdom/whatwg-url) | `17.2.0` | `17.3.0` |



Updates `@axe-core/playwright` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0)

Updates `balanced-match` from 4.0.4 to 5.0.0
- [Release notes](https://github.com/juliangruber/balanced-match/releases)
- [Commits](juliangruber/balanced-match@v4.0.4...v5.0.0)

Updates `baseline-browser-mapping` from 2.11.28 to 2.11.31
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.11.28...v2.11.31)

Updates `browserslist` from 4.29.3 to 4.29.4
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.29.3...4.29.4)

Updates `camelcase` from 9.0.0 to 10.0.0
- [Release notes](https://github.com/sindresorhus/camelcase/releases)
- [Commits](sindresorhus/camelcase@v9.0.0...v10.0.0)

Updates `caniuse-lite` from 1.0.30001815 to 1.0.30001819
- [Commits](browserslist/caniuse-lite@1.0.30001815...1.0.30001819)

Updates `cssnano-utils` from 8.2.1 to 9.0.0
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/commits/cssnano@9.0.0)

Updates `electron-to-chromium` from 1.5.452 to 1.5.463
- [Changelog](https://github.com/Kilian/electron-to-chromium/blob/main/CHANGELOG.md)
- [Commits](Kilian/electron-to-chromium@v1.5.452...v1.5.463)

Updates `emittery` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/sindresorhus/emittery/releases)
- [Commits](sindresorhus/emittery@v2.1.0...v2.2.0)

Updates `execa` from 10.1.0 to 10.2.1
- [Release notes](https://github.com/sindresorhus/execa/releases)
- [Commits](sindresorhus/execa@v10.1.0...v10.2.1)

Updates `fast-uri` from 4.2.1 to 4.2.3
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v4.2.1...v4.2.3)

Updates `ignore` from 7.0.12 to 7.0.13
- [Release notes](https://github.com/kaelzhang/node-ignore/releases)
- [Commits](kaelzhang/node-ignore@7.0.12...7.0.13)

Updates `jsdom` from 30.1.2 to 30.1.3
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.2...v30.1.3)

Updates `lilconfig` from 3.1.3 to 3.1.4
- [Release notes](https://github.com/antonk52/lilconfig/releases)
- [Commits](antonk52/lilconfig@v3.1.3...v3.1.4)

Updates `markdown-it` from 15.0.2 to 15.0.3
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@15.0.2...15.0.3)

Updates `marked` from 18.1.0 to 18.1.1
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.1.0...v18.1.1)

Updates `node-releases` from 2.0.58 to 2.0.60
- [Commits](chicoxyzzy/node-releases@v2.0.58...v2.0.60)

Updates `postcss` from 8.5.29 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.29...8.5.31)

Updates `postcss-calc` from 11.2.2 to 11.2.3
- [Release notes](https://github.com/postcss/postcss-calc/releases)
- [Changelog](https://github.com/postcss/postcss-calc/blob/master/CHANGELOG.md)
- [Commits](postcss/postcss-calc@v11.2.2...v11.2.3)

Updates `postcss-normalize-url` from 9.0.6 to 10.0.0
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/commits/cssnano-preset-advanced@10.0.0)

Updates `postcss-selector-parser` from 7.1.6 to 7.1.7
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@7.1.6...7.1.7)

Updates `postcss-svgo` from 9.0.5 to 9.1.0
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/cssnano@9.0.5...cssnano@9.1.0)

Updates `react-is` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-is)

Updates `resolve.exports` from 2.0.3 to 2.0.4
- [Release notes](https://github.com/lukeed/resolve.exports/releases)
- [Commits](lukeed/resolve.exports@v2.0.3...v2.0.4)

Updates `sass` from 1.105.1 to 1.106.1
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.105.1...1.106.1)

Updates `undici-types` from 8.11.2 to 8.12.3
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.11.2...v8.12.3)

Updates `whatwg-url` from 17.2.0 to 17.3.0
- [Release notes](https://github.com/jsdom/whatwg-url/releases)
- [Commits](jsdom/whatwg-url@v17.2.0...v17.3.0)

---
updated-dependencies:
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: balanced-match
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: browserslist
  dependency-version: 4.29.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: camelcase
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: caniuse-lite
  dependency-version: 1.0.30001819
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cssnano-utils
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: electron-to-chromium
  dependency-version: 1.5.463
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: emittery
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: execa
  dependency-version: 10.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fast-uri
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ignore
  dependency-version: 7.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jsdom
  dependency-version: 30.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lilconfig
  dependency-version: 3.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: markdown-it
  dependency-version: 15.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: marked
  dependency-version: 18.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: node-releases
  dependency-version: 2.0.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group:
8BD0
 production-dependencies
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: postcss-calc
  dependency-version: 11.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: postcss-normalize-url
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: postcss-svgo
  dependency-version: 9.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-is
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: resolve.exports
  dependency-version: 2.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sass
  dependency-version: 1.106.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: undici-types
  dependency-version: 8.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: whatwg-url
  dependency-version: 17.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from dominicusin as a code owner October 26, 2026 10:27
@vercel
vercel Bot commented Oct 26, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
dominicusin-github-io Error Error Oct 26, 2026 10:37am UTC
3 Skipped Deployments
Project Deployment Actions Updated
dominicusin-dominicusin.github.io Ignored Ignored Preview Oct 26, 2026 10:37am UTC
dominicusin-dominicusin.github.io-lw64 Ignored Ignored Preview Oct 26, 2026 10:37am UTC
dominicusin-github-io-5612 Ignored Ignored Preview Oct 26, 2026 10:37am UTC

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@bolt-new-by-stackblitz
bolt-new-by-stackblitz Bot commented Oct 26, 2026
Copy link
Copy Markdown

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@github-actions
github-actions Bot commented Oct 26, 2026
Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@asamuzakjp/dom-selector 10.0.4 UnknownUnknown
npm/@axe-core/playwright 4.14.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST⚠️ -1internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/axe-core 4.14.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Packaging🟢 10packaging workflow detected
SAST⚠️ -1internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/balanced-match 5.0.0 🟢 5.3
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 3Found 4/11 approved changesets -- score normalized to 3
Maintained🟢 57 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/baseline-browser-mapping 2.11.31 UnknownUnknown
npm/browserslist 4.29.4 🟢 6.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 4Found 9/20 approved changesets -- score normalized to 4
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/camelcase 10.0.0 🟢 4.1
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 56 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 9security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/caniuse-lite 1.0.30001819 🟢 4.2
Details
CheckScoreReason
Maintained🟢 79 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Code-Review⚠️ 0Found 2/27 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/electron-to-chromium 1.5.463 UnknownUnknown
npm/emittery 2.2.0 🟢 4.4
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1013 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
SAST⚠️ 0no SAST tool detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
npm/execa 10.2.1 🟢 4.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
SAST⚠️ 0no SAST tool detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
npm/fast-uri 4.2.3 🟢 8.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 3Found 9/29 approved changesets -- score normalized to 3
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
Vulnerabilities🟢 100 existing vulnerabilities detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ -1no releases found
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1010 out of 10 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 33 contributing companies or organizations
npm/ignore 7.0.13 🟢 4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 2Found 6/24 approved changesets -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 9license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/jsdom 30.1.3 🟢 7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 3Found 10/30 approved changesets -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/lilconfig 3.1.4 🟢 3.6
Details
CheckScoreReason
Code-Review⚠️ 2Found 4/15 approved changesets -- score normalized to 2
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/markdown-it 15.0.3 🟢 6.5
Details
CheckScoreReason
Maintained🟢 103 commit(s) out of 30 and 13 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 3GitHub code reviews found for 10 commits out of the last 30 -- score normalized to 3
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
License🟢 10license file detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Fuzzing⚠️ 0project is not fuzzed
npm/marked 18.1.1 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 7Found 18/25 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
npm/node-releases 2.0.60 🟢 4
Details
CheckScoreReason
Maintained🟢 1016 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
SAST⚠️ 0no SAST tool detected
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
npm/postcss 8.5.31 🟢 7.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/postcss-calc 11.2.3 🟢 6.2
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/9 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/postcss-selector-parser 7.1.7 🟢 5
Details
CheckScoreReason
Maintained🟢 1017 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 3Found 8/25 approved changesets -- score normalized to 3
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/postcss-svgo 9.1.0 🟢 7.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/11 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 10SAST tool is run on all commits
npm/react-is 19.3.1 UnknownUnknown
npm/resolve.exports 2.0.4 🟢 3.1
Details
CheckScoreReason
Code-Review⚠️ 2Found 4/14 approved changesets -- score normalized to 2
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/sass 1.106.1 🟢 6.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST🟢 10SAST tool is run on all commits
npm/undici-types 8.12.3 🟢 7.9
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 6Found 14/22 approved changesets -- score normalized to 6
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Vulnerabilities🟢 73 existing vulnerabilities detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
CI-Tests🟢 1022 out of 22 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 58 contributing companies or organizations
npm/whatwg-url 17.3.0 🟢 5
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Maintained🟢 109 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • package-lock.json

@coderabbitai
coderabbitai Bot commented Oct 26, 2026
Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4203fba6-210b-46ec-af7c-36443a97acfa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot @github
dependabot Bot commented on behalf of github Nov 2, 2026
Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-b8f443c63c branch November 2, 2026 10:25

This branch had an error being deployed

1 failed deployment
Preview – dominicusin-github-io — 7e515fee Deployed Oct 26, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dominicusin dominicusin Awaiting requested review from dominicusin dominicusin is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size/S

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

0