8000 deps: bump the production-dependencies group across 1 directory with 32 updates by dependabot[bot] · Pull Request #458 · dominicusin/dominicusin.github.io · GitHub
[go: up one dir, main page]
Skip to content

deps: bump the production-dependencies group across 1 directory with 32 updates - #458

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-d96b20ad9d
Closed

deps: bump the production-dependencies group across 1 directory with 32 updates#458
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-d96b20ad9d

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 32 updates in the / directory:

Package From To
@axe-core/playwright 4.13.0 4.14.0
ansi-regex 6.4.0 6.5.0
argparse 3.0.3 3.0.4
balanced-match 4.0.4 5.0.0
baseline-browser-mapping 2.11.28 2.11.34
browserslist 4.29.3 4.29.5
camelcase 9.0.0 10.0.0
caniuse-lite 1.0.30001815 1.0.30001820
cssnano-utils 8.2.1 9.0.0
electron-to-chromium 1.5.452 1.5.468
emittery 2.1.0 2.2.0
entities 8.1.0 9.0.0
execa 10.1.0 10.2.1
fast-uri 4.2.1 4.2.3
glob 13.0.6 14.0.3
ignore 7.0.12 7.0.14
jsdom 30.1.2 30.1.3
lilconfig 3.1.3 3.1.4
markdown-it 15.0.2 15.0.3
marked 18.1.0 18.1.2
minimatch 10.2.6 11.0.3
node-releases 2.0.58 2.0.62
postcss 8.5.29 8.5.32
postcss-calc 11.2.2 11.2.3
postcss-normalize-url 9.0.6 10.0.0
postcss-selector-parser 7.1.6 7.1.7
postcss-svgo 9.0.5 9.1.0
react-is 19.3.0 19.3.1
resolve.exports 2.0.3 2.0.4
sass 1.105.1 1.107.0
undici-types 8.11.2 8.12.3
whatwg-url 17.2.0 17.3.0

Updates @axe-core/playwright from 4.13.0 to 4.14.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.14.0

What's Changed

New Contributors

Full Changelog: dequelabs/axe-core-npm@v4.13.0...v4.14.0

Changelog

Sourced from @​axe-core/playwright's changelog.

4.14.0 (2026-10-06)

Bug Fixes

Features

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates ansi-regex from 6.4.0 to 6.5.0

Release notes

Sourced from ansi-regex's releases.

v6.5.0

  • Strip a CSI with a private parameter marker as a whole f2b4c24
  • Never partially strip a sequence c8bbf69

chalk/ansi-regex@v6.4.0...v6.5.0

Commits

Updates argparse from 3.0.3 to 3.0.4

Changelog

Sourced from argparse's changelog.

[3.0.4] - 2026-10-24

Fixed

  • Kept UTF-16 surrogate pairs together when wrapping long help text, #195.
Commits

Updates balanced-match from 4.0.4 to 5.0.0

Commits

Updates baseline-browser-mapping from 2.11.28 to 2.11.34

Commits
  • 4a311c7 Patch to 2.11.34 because browser or feature data changed
  • cadd64d Browser or feature data changed
  • 7439261 Updating static site
  • 47dde6e Patch to 2.11.33 because browser or feature data changed
  • 7d23626 Browser or feature data changed
  • 107852a Updating static site
  • b010b39 Patch to 2.11.32 because browser or feature data changed
  • b41f5fb Browser or feature data changed
  • b1b7b47 Updating static site
  • 22ea69a Patch to 2.11.31 because browser or feature data changed
  • Additional commits viewable in compare view

Updates browserslist from 4.29.3 to 4.29.5

Release notes

Sourced from browserslist's releases.

4.29.5

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).
Changelog

Sourced from browserslist's changelog.

4.29.5

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).
Commits
  • 2e4b904 Release 4.29.5 version
  • 11a13ec Update dependencies
  • e80fabc Merge pull request #957 from nk-batman21/fix-coverage-custom-stats-versions
  • cac8029 Normalize custom statistics versions in coverage
  • f7a99b9 Release 4.29.4 version
  • 03fc702 Update dependencies
  • efe07e1 Merge pull request #956 from ybai08/fix-joined-range-bounds
  • ef50f5b Fix joined version bounds in version ray and range queries
  • 8219dd7 Merge pull request #954 from abhu85/fix-since-extends-whitespace
  • 893120b Allow arbitrary whitespaces in since, extends, config and not queries
  • See full diff in compare view

Updates camelcase from 9.0.0 to 10.0.0

Release notes

Sourced from camelcase's releases.

v10.0.0

Breaking

  • Require Node.js 22 27454cc

Fixes

  • Fix handling of letters outside the Basic Multilingual Plane (#117) 92d7f63
    • Letters that need a surrogate pair (for example, Deseret and Osage) are now handled as one character. pascalCase now uppercases such a first letter, and an uppercase letter of this type in the middle of a word is no longer lowercased.
  • Fix preserveConsecutiveUppercase when capitalizeAfterNumber is false 3433c29
    • An uppercase letter after a character such as ! or @ was lowercased. Now foo!Bar stays foo!Bar, the same as when capitalizeAfterNumber is true.
  • Treat decimal digits from all scripts as numbers for capitalizeAfterNumber 97e8e40
    • Before, only ASCII digits were numbers. Now foo١bar becomes foo١Bar, the same as foo1bar becomes foo1Bar.

sindresorhus/camelcase@v9.0.0...v10.0.0

Commits

Updates caniuse-lite from 1.0.30001815 to 1.0.30001820

Commits

Updates cssnano-utils from 8.2.1 to 9.0.0

Release notes

Sourced from cssnano-utils's releases.

v9.0.0

What's Changed

Breaking changes

Probably backward-compatible for most users. Some changes to configuration loading documented in migration guide.

Bug fixes

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.10...cssnano@9.0.0

v71.1.1

Bug Fixes

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.0...cssnano@7.1.1

Commits

Updates electron-to-chromium from 1.5.452 to 1.5.468

Commits

Updates emittery from 2.1.0 to 2.2.0

Release notes

Sourced from emittery's releases.

v2.2.0

  • Add ReadonlyEmittery type 0edab03

sindresorhus/emittery@v2.1.0...v2.2.0

Commits

Updates entities from 8.1.0 to 9.0.0

Release notes

Sourced from entities's releases.

v9.0.0

Full speed unlocked: This release features a faster approach to decoding entities based on cuckoo hashing, replacing the previous trie-based approach. Instead of walking a trie character by character, we now do a few lookups in a hash table.

I first looked into cuckoo hashing around 2015, and again when I adopted the trie approach that @​inikulin had pioneered for parse5, but could never make it work. This was a fun problem to throw AI models at for some time, but now Fable solved it quite well.

This feels like the last big speed boost for entities decoding in JS.

Breaking changes

  • Streaming decoders no longer take a decode table: new EntityDecoder(htmlDecodeTree, emit, errors) becomes new HtmlEntityDecoder(emit, errors), and XmlEntityDecoder replaces the XML variant. The htmlDecodeTree, xmlDecodeTree and determineBranch exports are removed. Synchronous decoding APIs are unchanged. #2336
  • Encoding emits decimal numeric references and the shortest named aliases: encodeXML("ü") yields &[#252](https://github.com/fb55/entities/issues/252); instead of ü, and encodeHTML("ℵ") yields ℵ instead of ℵ. #2355
  • escapeAttribute and EncodingMode.Attribute also escape < and >, matching the latest HTML spec. By @​ybai08 in #2398
  • The deprecated getCodePoint export of entities/escape is removed; use String.prototype.codePointAt instead. #2355

Improvements

  • HTML decoding: common named references 1.15–1.23×, a dense sweep of all 2,125 names 1.24–1.33×, attribute-heavy HTML 1.06–1.18× as fast. XML decoding with mixed named and numeric references is 1.06–1.09× as fast. #2336
  • Smaller decoders: the HTML bundle shrinks from 15.54 to 13.42 kB gzipped, the XML-only bundle from 0.92 to 0.84 kB gzipped, and 29–32 kB less memory is retained after import. #2336
  • The readme now compares entities with popular alternatives across a range of inputs. #2407

Compared with v8.1.0; ranges span Node 26.8 and Node 24.19 on a Ryzen 7 5800X3D. Results vary with input.

Full Changelog: fb55/entities@v8.1.0...v9.0.0

Commits
  • a007e72 9.0.0
  • 3e8e364 build(benchmark): compare popular libraries across inputs, update readme (#2407)
  • d1158bf feat(decode)!: hash-table decoder replacing the binary trie (#2336)
  • 914e397 fix(escape): escape \< and > in attribute values (#2398)
  • 12d4f06 build: bump the codeql group with 2 updates (#2405)
  • 0a6de5c build: bump markdown-it from 14.3.2 to 14.3.3 (#2402)
  • 9659d80 build: bump the codeql group with 2 updates (#2401)
  • 858a16b build: bump vitest from 5.0.4 to 5.0.5 (#2400)
  • 52cbad3 build: bump eslint from 10.12.0 to 10.13.0 (#2399)
  • ff0bad1 build: bump typescript-eslint from 8.71.1 to 8.71.2 (#2396)
  • Additional commits viewable in compare view

Updates execa from 10.1.0 to 10.2.1

Release notes

Sourced from execa's releases.

v10.2.1

  • Fix types compatibility with exactOptionalPropertyTypes 2b6988b1

sindresorhus/execa@v10.2.0...v10.2.1

v10.2.0

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

  • Exceeding maxBuffer now terminates the subprocess with killSignal, instead of leaving it running and the promise pending f6de9be
  • maxBuffer: 0 now limits the output of synchronous methods, like asynchronous methods 224dd20
  • Options of $ set to undefined now use $'s defaults, such as inheriting stdin f61a6e9

Fixes

  • Fix invalid file descriptor objects, such as closed file handles, crashing the current process instead of throwing d0a5968
  • Fix synchronous transforms: errors being hidden, filtered output being returned on failure, mixed text and byte chunks being reordered, and final() being skipped without input 0ba2b6e ed80079 9c54833
  • Fix result.all changing objects when only stdout or stderr is buffered 8629132
  • Fix writing objects to a web WritableStream 5ea2900
  • Fix an invalid subprocess.duplex() option making later stream conversions hang 5e4345b
  • Fix execaNode() not running its file when the current process uses --print e747872

Types

  • Fix result and subprocess types when the options are a union, including IPC f5772f3 355d917 cb8aaf6
  • Fix result types when options bound with execa(options) are overridden or reset with undefined 708fed7
  • Fix subprocess.stdin types with the input and inputFile options 236c831
  • Fix chunk types of subprocess.iterable() with object-mode transforms a2912e5
  • Fix fd-specific option types, and execaNode() types with node: undefined 80b01e9 523cf9b

sindresorhus/execa@v10.1.1...v10.2.0

v10.1.1

  • Fix execaNode() and the node option missing IPC in their types 2633abb
  • Fix escapedCommand and verbose quoting arguments when using the shell option b2c3a54
  • Fix wrong-typed options and arguments being silently ignored or coerced b57d643
  • Fix the verbose option printing colors when stderr is not a terminal a2eda67
  • Fix stdin iterables and input transforms edge cases 6925cc3
  • Fix IPC edge cases 5f80cde
  • Fix .pipe() and stream conversion edge cases d3ec10d
  • Fix template strings, parseCommandString() and execaNode() edge cases fb92da1
  • Fix invalid timeout and forceKillAfterDelay values d9a5689
  • Fix errors, early errors and result.all edge cases c4262ff

... (truncated)

Commits
  • 247faa0 10.2.1
  • e375b0b Fix tests
  • 2b6988b Fix types compatibility with exactOptionalPropertyTypes
  • e7e0664 Fix flaky Windows test cleanup of copied executables
  • a605753 10.2.0
  • b87aab7 Fix link check in type tests
  • cb8aaf6 Fix IPC types for option unions
  • 80b01e9 Fix fd-specific option types
  • 355d917 Fix subprocess stream types for option unions
  • 523cf9b Fix execaNode() result types when the node option is undefined
  • Additional commits viewable in compare view

Updates fast-uri from 4.2.1 to 4.2.3

Release notes

Sourced from fast-uri's releases.

v4.2.3

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@4.2.3

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v4.2.2...v4.2.3

v4.2.2

What's Changed

Full Changelog: fastify/fast-uri@v4.2.1...v4.2.2

Commits
  • 00f4140 Bumped v4.2.3
  • 6d1dc6f test: generate only relative path references
  • 52774a5 fix: preserve relative paths in suffix and relative resolution
  • b6a75ea docs: note suffix-reference authority ambiguity
  • a9b8d67 fix: escape a first-segment colon in suffix references
  • bfeefaf test: cover first-segment colon in suffix references
  • f6d46df fix(SEC-03): reject non reg-name characters in domain hosts
  • f7fc8cc fix: keep a colon-first segment behind "./" in relative normalization
  • b6dda15 test: cover colon-first relative references in normalization
  • acc5c5d fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates glob from 13.0.6 to 14.0.3

Changelog

Sourced from glob's changelog.

changeglob

14

  • Use minimatch 11. Each portion of a pattern with magic is now matched with a Matcher from @isaacs/nonrecursive-glob-match in place of a RegExp, so patterns can no longer cause ReDoS. Matching follows the minimatch 11 changes, which are closer to Bash in some edge cases.
  • Pattern#pattern() returns a Matcher for a portion with magic. The MMPattern type is now minimatch's ParseReturnFiltered, and the new MMMatcher type is the Matcher part of it.
  • Rename Pattern#isRegExp() to isMatcher(), and Processor#testRegExp() to testMatcher().
  • Remove the debug option, which minimatch no longer has.
  • Add the normalize option, to normalize unicode in the pattern and in the file names that it is matched against.
  • GlobWalker#walk() and walkSync() return arrays in place of sets, and MatchRecord#entries() is removed.
  • ignore patterns that start with / now start at the same place as other patterns that start with /: the root option if set, or else the root of the cwd, such as C:\ on Windows.
  • ignore patterns follow the windowsPathsNoEscape option, the same as other patterns.
  • On Windows, patterns that start with a long UNC root like //?/UNC/host/share/ walk that share, the same as //host/share/.
  • Faster ignore patterns (about 1.2 to 3 times faster), and less work for each entry in a walk (about 10% faster sync, and 15% to 30% faster async, for large trees).
  • Allow const string[] or readonly string[] as ignore option or pattern argument.
  • When the signal aborts an async walk, the walk stops. Before, it rejected, but continued to read directories.

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

... (truncated)

Commits

Updates ignore from 7.0.12 to 7.0.14

Commits
  • edbaa52 bump version 7.0.14
  • 92c4cb7 test: compare checkIgnore() with git check-ignore -v line for line
  • c0f0de9 fix: report the last rule to match, as git check-ignore -v does
  • e5151b3 fix: let checkIgnore("dir/") read "//" as "/" does
  • 6e6ce57 docs: say exactly what .checkIgnore() shares with git check-ignore -v
  • 3c36daa fix: let "/" match every path, as "" does
  • 8a910fc test: move [[:cntrl:]] into the fixtures, and drop a test git already covers
  • ed46624 test: compare the three skipped fixtures with git too
  • d990dc5 test: check #175's trailing run against git, through re-inclusion
  • 8b3466b docs, test: finish #175 -- say what git does with a run of asterisks
  • Additional commits viewable in compare view

Updates jsdom from 30.1.2 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

  • Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
  • Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
  • Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
  • Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
  • Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
  • Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
  • Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
  • Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
  • Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
  • Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
  • Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
  • Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
  • Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
  • Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)
Commits
  • 058c0f5 30.1.3
  • fcd1fd1 Cascade parsed longhands independently
  • a3ee786 Cascade computed style properties on demand
  • f42dc15 Resolve colors before caching or using currentcolor
  • 074b1fb Compute background-position lengths against the final font size
  • d19598c Apply style rules nested in multiple @​media rules
  • 45d626c Rule out attribute selector subjects before matching
  • 3ff0a5b Upgrade Undici and remove abort workarounds
  • 8813bb1 Ignore CSS declarations with unparseable math functions
  • 63712d8 Fix XHR credentials across redirects
  • Additional commits viewable in compare view

Updates lilconfig from 3.1.3 to 3.1.4

Release notes

Sourced from lilconfig's releases.

v3.1.4

  • Fixes support for JSON configs with a UTF-8 BOM
  • Update development dependencies
  • Correct documentation typos
Commits

Updates markdown-it from 15.0.2 to 15.0.3

Changelog

Sourced from markdown-it's changelog.

[15.0.3] - 2026-10-16

Changed

  • Updated dependencies.

Fixed

  • Enforce the 999 Unicode code point limit for reference definition labels, partially addressing #1213.
  • Require whitespace before multiline reference titles.

Security

  • Fixed quadratic complexity when parsing multiline reference definitions.
  • Fixed quadratic complexity when parsing unclosed inline HTML comments, processing instructions, declarations and CDATA sections.
Commits
  • a8c00d4 15.0.3 released
  • e9504a4 Skip pathological speed tests during coverage collection

@dependabot
deps: bump the production-dependencies group across 1 directory with …
3e85664 
…32 updates

Bumps the production-dependencies group with 32 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` |
| [ansi-regex](https://github.com/chalk/ansi-regex) | `6.4.0` | `6.5.0` |
| [argparse](https://github.com/nodeca/argparse) | `3.0.3` | `3.0.4` |
| [balanced-match](https://github.com/juliangruber/balanced-match) | `4.0.4` | `5.0.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.11.28` | `2.11.34` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.29.3` | `4.29.5` |
| [camelcase](https://github.com/sindresorhus/camelcase) | `9.0.0` | `10.0.0` |
| [caniuse-lite](https://github.com/browserslist/caniuse-lite) | `1.0.30001815` | `1.0.30001820` |
| [cssnano-utils](https://github.com/cssnano/cssnano) | `8.2.1` | `9.0.0` |
| [electron-to-chromium](https://github.com/Kilian/electron-to-chromium) | `1.5.452` | `1.5.468` |
| [emittery](https://github.com/sindresorhus/emittery) | `2.1.0` | `2.2.0` |
| [entities](https://github.com/fb55/entities) | `8.1.0` | `9.0.0` |
| [execa](https://github.com/sindresorhus/execa) | `10.1.0` | `10.2.1` |
| [fast-uri](https://github.com/fastify/fast-uri) | `4.2.1` | `4.2.3` |
| [glob](https://github.com/isaacs/node-glob) | `13.0.6` | `14.0.3` |
| [ignore](https://github.com/kaelzhang/node-ignore) | `7.0.12` | `7.0.14` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.2` | `30.1.3` |
| [lilconfig](https://github.com/antonk52/lilconfig) | `3.1.3` | `3.1.4` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.2` | `15.0.3` |
| [marked](https://github.com/markedjs/marked) | `18.1.0` | `18.1.2` |
| [minimatch](https://github.com/isaacs/minimatch) | `10.2.6` | `11.0.3` |
| [node-releases](https://github.com/chicoxyzzy/node-releases) | `2.0.58` | `2.0.62` |
| [postcss](https://github.com/postcss/postcss) | `8.5.29` | `8.5.32` |
| [postcss-calc](https://github.com/postcss/postcss-calc) | `11.2.2` | `11.2.3` |
| [postcss-normalize-url](https://github.com/cssnano/cssnano) | `9.0.6` | `10.0.0` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.6` | `7.1.7` |
| [postcss-svgo](https://github.com/cssnano/cssnano) | `9.0.5` | `9.1.0` |
| [react-is](https://github.com/react/react/tree/HEAD/packages/react-is) | `19.3.0` | `19.3.1` |
| [resolve.exports](https://github.com/lukeed/resolve.exports) | `2.0.3` | `2.0.4` |
| [sass](https://github.com/sass/dart-sass) | `1.105.1` | `1.107.0` |
| [undici-types](https://github.com/nodejs/undici) | `8.11.2` | `8.12.3` |
| [whatwg-url](https://github.com/jsdom/whatwg-url) | `17.2.0` | `17.3.0` |



Updates `@axe-core/playwright` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0)

Updates `ansi-regex` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/chalk/ansi-regex/releases)
- [Commits](chalk/ansi-regex@v6.4.0...v6.5.0)

Updates `argparse` from 3.0.3 to 3.0.4
- [Changelog](https://github.com/nodeca/argparse/blob/master/CHANGELOG.md)
- [Commits](nodeca/argparse@3.0.3...3.0.4)

Updates `balanced-match` from 4.0.4 to 5.0.0
- [Release notes](https://github.com/juliangruber/balanced-match/releases)
- [Commits](juliangruber/balanced-match@v4.0.4...v5.0.0)

Updates `baseline-browser-mapping` from 2.11.28 to 2.11.34
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.11.28...v2.11.34)

Updates `browserslist` from 4.29.3 to 4.29.5
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.29.3...4.29.5)

Updates `camelcase` from 9.0.0 to 10.0.0
- [Release notes](https://github.com/sindresorhus/camelcase/releases)
- [Commits](sindresorhus/camelcase@v9.0.0...v10.0.0)

Updates `caniuse-lite` from 1.0.30001815 to 1.0.30001820
- [Commits](browserslist/caniuse-lite@1.0.30001815...1.0.30001820)

Updates `cssnano-utils` from 8.2.1 to 9.0.0
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/commits/cssnano@9.0.0)

Updates `electron-to-chromium` from 1.5.452 to 1.5.468
- [Changelog](https://github.com/Kilian/electron-to-chromium/blob/main/CHANGELOG.md)
- [Commits](Kilian/electron-to-chromium@v1.5.452...v1.5.468)

Updates `emittery` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/sindresorhus/emittery/releases)
- [Commits](sindresorhus/emittery@v2.1.0...v2.2.0)

Updates `entities` from 8.1.0 to 9.0.0
- [Release notes](https://github.com/fb55/entities/releases)
- [Commits](fb55/entities@v8.1.0...v9.0.0)

Updates `execa` from 10.1.0 to 10.2.1
- [Release notes](https://github.com/sindresorhus/execa/releases)
- [Commits](sindresorhus/execa@v10.1.0...v10.2.1)

Updates `fast-uri` from 4.2.1 to 4.2.3
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v4.2.1...v4.2.3)

Updates `glob` from 13.0.6 to 14.0.3
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v13.0.6...v14.0.3)

Updates `ignore` from 7.0.12 to 7.0.14
- [Release notes](https://github.com/kaelzhang/node-ignore/releases)
- [Commits](kaelzhang/node-ignore@7.0.12...7.0.14)

Updates `jsdom` from 30.1.2 to 30.1.3
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.2...v30.1.3)

Updates `lilconfig` from 3.1.3 to 3.1.4
- [Release notes](https://github.com/antonk52/lilconfig/releases)
- [Commits](antonk52/lilconfig@v3.1.3...v3.1.4)

Updates `markdown-it` from 15.0.2 to 15.0.3
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@15.0.2...15.0.3)

Updates `marked` from 18.1.0 to 18.1.2
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.1.0...v18.1.2)

Updates `minimatch` from 10.2.6 to 11.0.3
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.2.6...v11.0.3)

Updates `node-releases` from 2.0.58 to 2.0.62
- [Commits](chicoxyzzy/node-releases@v2.0.58...v2.0.62)

Updates `postcss` from 8.5.29 to 8.5.32
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.29...8.5.32)

Updates `postcss-calc` from 11.2.2 to 11.2.3
- [Release notes](https://github.com/postcss/postcss-calc/releases)
- [Changelog](https://github.com/postcss/postcss-calc/blob/master/CHANGELOG.md)
- [Commits](postcss/postcss-calc@v11.2.2...v11.2.3)

Updates `postcss-normalize-url` from 9.0.6 to 10.0.0
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/commits/cssnano-preset-advanced@10.0.0)

Updates `postcss-selector-parser` from 7.1.6 to 7.1.7
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@7.1.6...7.1.7)

Updates `postcss-svgo` from 9.0.5 to 9.1.0
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/cssnano@9.0.5...cssnano@9.1.0)

Updates `react-is` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-is)

Updates `resolve.exports` from 2.0.3 to 2.0.4
- [Release notes](https://github.com/lukeed/resolve.exports/releases)
- [Commits](lukeed/resolve.exports@v2.0.3...v2.0.4)

Updates `sass` from 1.105.1 to 1.107.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.105.1...1.107.0)

Updates `undici-types` from 8.11.2 to 8.12.3
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.11.2...v8.12.3)

Updates `whatwg-url` from 17.2.0 to 17.3.0
- [Release notes](https://github.com/jsdom/whatwg-url/releases)
- [Commits](jsdom/whatwg-url@v17.2.0...v17.3.0)

---
updated-dependencies:
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ansi-regex
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: argparse
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: balanced-match
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: browserslist
  dependency-version: 4.29.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: camelcase
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: caniuse-lite
  dependency-version: 1.0.30001820
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cssnano-utils
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: electron-to-chromium
  dependency-version: 1.5.468
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: emittery
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: entities
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: execa
  dependency-version: 10.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fast-uri
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: glob
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: ignore
  dependency-version: 7.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jsdom
  dependency-version: 30.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lilconfig
  dependency-version: 3.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: markdown-it
  dependency-version: 15.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: marked
  dependency-version: 18.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: minimatch
  dependency-version: 11.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: node-releases
  dependency-version: 2.0.62
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: postcss
  dependency-version: 8.5.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: postcss-calc
  dependency-version: 11.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: postcss-normalize-url
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: postcss-svgo
  dependency-version: 9.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-is
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: resolve.exports
  dependency-version: 2.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sass
  dependency-version: 1.107.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: undici-types
  dependency-version: 8.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: whatwg-url
  dependency-version: 17.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel
vercel Bot commented Nov 2, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
dominicusin-github-io Error Error Nov 2, 2026 10:36am UTC
3 Skipped Deployments
Project Deployment Actions Updated
dominicusin-dominicusin.github.io Ignored Ignored Preview Nov 2, 2026 10:36am UTC
dominicusin-dominicusin.github.io-lw64 Ignored Ignored Preview Nov 2, 2026 10:36am UTC
dominicusin-github-io-5612 Ignored Ignored Preview Nov 2, 2026 10:36am UTC

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026
@dependabot
dependabot Bot requested a review from dominicusin as a code owner November 2, 2026 10:26
@bolt-new-by-stackblitz
bolt-new-by-stackblitz Bot commented Nov 2, 2026
Copy link
Copy Markdown

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@coderabbitai
coderabbitai Bot commented Nov 2, 2026
Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 81a6f1d8-4f2b-4f70-9872-dd0701731f9d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@github-actions
github-actions Bot commented Nov 2, 2026
Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/minimatch 10.2.6 🟢 5.5
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 42 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 4
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@asamuzakjp/dom-selector 10.0.5 UnknownUnknown
npm/@axe-core/playwright 4.14.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST⚠️ -1internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/@isaacs/nonrecursive-glob-match 1.0.3 UnknownUnknown
npm/ansi-regex 6.5.0 🟢 4
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy🟢 9security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/argparse 3.0.4 🟢 4.9
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Maintained🟢 68 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6
SAST⚠️ 0no SAST tool detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 4security policy file detected
npm/axe-core 4.14.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Packaging🟢 10packaging workflow detected
SAST⚠️ -1internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/balanced-match 5.0.0 🟢 5.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 4Found 4/10 approved changesets -- score normalized to 4
Maintained🟢 68 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/baseline-browser-mapping 2.11.34 UnknownUnknown
npm/browserslist 4.29.5 🟢 6.8
Details
CheckScoreReason
Code-Review🟢 4Found 9/22 approved changesets -- score normalized to 4
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangero 10BC8 us workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/camelcase 10.0.0 🟢 4.1
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 56 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 9security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/caniuse-lite 1.0.30001820 🟢 4.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 911 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 9
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
npm/electron-to-chromium 1.5.468 UnknownUnknown
npm/emittery 2.2.0 🟢 4.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0no SAST tool detected
Maintained🟢 1013 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
npm/entities 9.0.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/1 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
npm/execa 10.2.1 🟢 4.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
SAST⚠️ 0no SAST tool detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
npm/fast-uri 4.2.3 🟢 8.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 3Found 9/28 approved changesets -- score normalized to 3
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 33 contributing companies or organizations
npm/glob 14.0.3 🟢 5
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
SAST⚠️ 0no SAST tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 56 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
npm/ignore 7.0.14 🟢 3.9
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 1Found 4/26 approved changesets -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/jsdom 30.1.3 🟢 6.8
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/lilconfig 3.1.4 🟢 3.6
Details
CheckScoreReason
Code-Review⚠️ 2Found 4/15 approved changesets -- score normalized to 2
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Security-Policy⚠️ 0security policy file not detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/markdown-it 15.0.3 🟢 6.5
Details
CheckScoreReason
Maintained🟢 103 commit(s) out of 30 and 13 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 3GitHub code reviews found for 10 commits out of the last 30 -- score normalized to 3
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
License🟢 10license file detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Fuzzing⚠️ 0project is not fuzzed
npm/marked 18.1.2 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 7Found 18/25 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
npm/minimatch 11.0.3 🟢 5.5
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 42 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 4
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/node-releases 2.0.62 🟢 4
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1018 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0no SAST tool detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
npm/path-scurry 3.0.0 🟢 4.4
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/postcss 8.5.32 🟢 7.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/postcss-calc 11.2.3 🟢 6.2
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/9 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/postcss-selector-parser 7.1.7 🟢 5
Details
CheckScoreReason
Code-Review🟢 3Found 8/25 approved changesets -- score normalized to 3
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1017 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/postcss-svgo 9.1.0 🟢 7.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/10 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
npm/react-is 19.3.1 UnknownUnknown
npm/resolve.exports 2.0.4 🟢 3.1
Details
CheckScoreReason
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Code-Review⚠️ 2Found 4/14 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/sass 1.107.0 🟢 6.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST🟢 10SAST tool is run on all commits
npm/undici-types 8.12.3 🟢 8.2
Details
CheckScoreReason
Code-Review🟢 8Found 18/21 approved changesets -- score normalized to 8
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 8binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 82 existing vulnerabilities detected
License🟢 10license file detected
Packaging🟢 10packaging workflow detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1027 out of 27 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 58 contributing companies or organizations
npm/whatwg-url 17.3.0 🟢 5
Details
CheckScoreReason
Maintained🟢 109 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • package-lock.json

@github-actions github-actions Bot added the size/S label Nov 2, 2026
@dependabot @github
dependabot Bot commented on behalf of github Nov 9, 2026
Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 9, 2026
9915
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-d96b20ad9d branch November 9, 2026 10:19

This branch had an error being deployed

1 failed deployment
Preview – dominicusin-github-io — 3e856645 Deployed Nov 2, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dominicusin dominicusin Awaiting requested review from dominicusin dominicusin is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size/S

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

0