Bump the npm group across 3 directories with 10 updates by dependabot[bot] · Pull Request #302 · poad/aws-lambda-mcp-server

dependabot · 2026-10-18T18:08:31Z

Bumps the npm group with 4 updates in the / directory: zod, @types/node, aws-cdk-lib and oxlint-tsgolint.
Bumps the npm group with 10 updates in the /example directory:

Package	From	To
zod	`4.6.5`	`4.6.6`
@types/node	`26.6.4`	`26.6.5`
aws-cdk-lib	`2.272.0`	`2.273.0`
@oxlint-tsgolint/darwin-arm64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/darwin-x64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/linux-arm64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/linux-x64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/win32-arm64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/win32-x64	`7.0.2003`	`7.0.2004`
oxlint-tsgolint	`7.0.2003`	`7.0.2004`

Bumps the npm group with 10 updates in the /package directory:

Package	From	To
zod	`4.6.5`	`4.6.6`
@types/node	`26.6.4`	`26.6.5`
aws-cdk-lib	`2.272.0`	`2.273.0`
@oxlint-tsgolint/darwin-arm64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/darwin-x64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/linux-arm64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/linux-x64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/win32-arm64	`7.0.2003`	`7.0.2004`
@oxlint-tsgolint/win32-x64	`7.0.2003`	`7.0.2004`
oxlint-tsgolint	`7.0.2003`	`7.0.2004`

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

See full diff in compare view

Updates aws-cdk-lib from 2.272.0 to 2.273.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.273.0

⚠ BREAKING CHANGES

** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-appstream: AWS::AppStream::StackFleetAssociation: FleetName property is now immutable. aws-appstream: AWS::AppStream::StackFleetAssociation: StackName property is now immutable. aws-appsync: AWS::AppSync::ApiCache: AtRestEncryptionEnabled property is now immutable. aws-appsync: AWS::AppSync::ApiCache: TransitEncryptionEnabled property is now immutable. aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig: OutputConfig attribute removed. aws-cloud9: AWS::Cloud9::EnvironmentEC2: Id attribute removed. aws-config: AWS::Config::ConfigurationRecorder: Id attribute removed. aws-config: AWS::Config::OrganizationConfigRule: Id attribute removed. aws-datazone: AWS::DataZone::PolicyGrant: Detail property is now required. aws-datazone: AWS::DataZone::PolicyGrant: Principal property is now required. aws-directoryservice: AWS::DirectoryService::MicrosoftAD: Id attribute removed. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.NetworkProtocol property is now required. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.SecurityGroupIds property is now required.

Features

update L1 CloudFormation resource definitions (#38969) (ed0df78)

batch: add ConsumableResource L2 construct (#36971) (a12f3a1)

bedrockagentcore: support runtime platformVersion (#38924) (227423f)

cloudfront: default Distribution behaviors to redirect HTTP to HTTPS (#38721) (6ede006), closes #38599

opensearchservice: add useLatestServiceSoftwareForBlueGreen support (#38499) (6aa03e5), closes #38664 #38664

pipelines: add executionMode support in CodePipeline L3 construct (#35022) (7283d38), closes #35014

Bug Fixes

bump bundled brace-expansion to 5.0.12 (#38929) (ff25def), closes #38932

applicationautoscaling: target tracking silently ignores custom metric account and region (#36503) (5d10288), closes #36401

bedrockagentcore: accept aws-cn ECR image URIs in Runtime container URI validation (#38948) (49ac618), closes #38947

cloudfront-origins: missing OAC permissions for Function URL (#35919) (d213cc7), closes #35872 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-lambda/lib/function-base.ts#L577 #35725

core: validation E2001 inadvertently not enabled (#38920) (0b763a7)

eks: allow access policies on AccessEntryType.EC2 access entries (#38782) (e507e07), closes #37496

s3-deployment: Source.data objectKey can write outside the staging directory (#38921) (53439f9)

Alpha modules (2.273.0-alpha.0)

⚠ BREAKING CHANGES

redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.

redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.273.0-alpha.0 (2026-10-08)

⚠ BREAKING CHANGES

redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.

redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

Bug Fixes

redshift-alpha: reject PUBLIC user names (#38935) (3335407)

2.272.0-alpha.0 (2026-09-30)

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:

construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set

Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead

... (truncated)

Commits

22a8ee5 chore: update analytics metadata blueprints
f911ee4 chore(release): 2.273.0
ed0df78 feat: update L1 CloudFormation resource definitions (#38969)
07c059f docs(events): add examples for RuleTargetInput and EventField (#38470)
7292cc7 chore(bedrock): add Claude Opus 5, Mythos 5, and Fable 5 foundation models (#...
2915b0d chore(ec2): interface VPC endpoint for eks-proxy (#38385)
a12f3a1 feat(batch): add ConsumableResource L2 construct (#36971)
6aa03e5 feat(opensearchservice): add useLatestServiceSoftwareForBlueGreen support (#3...
6ede006 feat(cloudfront): default Distribution behaviors to redirect HTTP to HTTPS (#...
d615580 docs(core): correct arnFormat default description (#38888)
Additional commits viewable in compare view

Updates oxlint-tsgolint from 7.0.2003 to 7.0.2004

Release notes

Sourced from oxlint-tsgolint's releases.

v7.0.2004

What's Changed

chore(deps): update taiki-e/install-action action to v2.87.20 by @renovate[bot] in oxc-project/tsgolint#1246

chore(deps): update dependency dprint-json to v0.25.0 by @renovate[bot] in oxc-project/tsgolint#1247

fix(no-unsafe-return): preserve deferred indexed return type by @camc314 in oxc-project/tsgolint#1248

chore(deps): update crate-ci/typos action to v1.50.3 by @renovate[bot] in oxc-project/tsgolint#1250

fix(no-misused-promises): don't report comma expressions as conditionals by @geniusmonir in oxc-project/tsgolint#1254

chore(deps): update gomod by @renovate[bot] in oxc-project/tsgolint#1257

chore(deps): update dprint plugins by @renovate[bot] in oxc-project/tsgolint#1256

chore(deps): update taiki-e/install-action action to v2.87.22 by @renovate[bot] in oxc-project/tsgolint#1258

chore(deps): update npm packages by @renovate[bot] in oxc-project/tsgolint#1259

fix(no-floating-promises): respect safe-call declaration sources by @camc314 in oxc-project/tsgolint#1261

fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns by @camc314 in oxc-project/tsgolint#1264

fix(no-deprecated): include reasons for variable declarations by @camc314 in oxc-project/tsgolint#1266

fix(no-unnecessary-type-parameters): parenthesize constraint in optional tuple elements by @baevm in oxc-project/tsgolint#1267

chore(deps): update crate-ci/typos action to v1.51.0 by @renovate[bot] in oxc-project/tsgolint#1268

chore(deps): update crate-ci/typos action to v1.51.1 by @renovate[bot] in oxc-project/tsgolint#1269

fix: restore line disable comments for type-aware diagnostics by @camc314 in oxc-project/tsgolint#1271

New Contributors

@geniusmonir made their first contribution in oxc-project/tsgolint#1254

Full Changelog: oxc-project/tsgolint@v7.0.2003...v7.0.2004

Commits

a612891 fix: restore line disable comments for type-aware diagnostics (#1271)
fc7068f chore(deps): update crate-ci/typos action to v1.51.1 (#1269)
8d4c05c chore(deps): update crate-ci/typos action to v1.51.0 (#1268)
6d20f35 fix(no-unnecessary-type-parameters): parenthesize constraint in optional tupl...
322b385 fix(no-deprecated): include reasons for variable declarations (#1266)
db76296 fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns (#1264)
24b18b4 fix(no-floating-promises): respect safe-call declaration sources (#1261)
c8f5cbc chore(deps): update npm packages (#1259)
93fe3a5 chore(deps): update taiki-e/install-action action to v2.87.22 (#1258)
dd0a306 chore(deps): update dprint plugins (#1256)
Additional commits viewable in compare view

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

See full diff in compare view

Updates aws-cdk-lib from 2.272.0 to 2.273.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.273.0

⚠ BREAKING CHANGES

** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-appstream: AWS::AppStream::StackFleetAssociation: FleetName property is now immutable. aws-appstream: AWS::AppStream::StackFleetAssociation: StackName property is now immutable. aws-appsync: AWS::AppSync::ApiCache: AtRestEncryptionEnabled property is now immutable. aws-appsync: AWS::AppSync::ApiCache: TransitEncryptionEnabled property is now immutable. aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig: OutputConfig attribute removed. aws-cloud9: AWS::Cloud9::EnvironmentEC2: Id attribute removed. aws-config: AWS::Config::ConfigurationRecorder: Id attribute removed. aws-config: AWS::Config::OrganizationConfigRule: Id attribute removed. aws-datazone: AWS::DataZone::PolicyGrant: Detail property is now required. aws-datazone: AWS::DataZone::PolicyGrant: Principal property is now required. aws-directoryservice: AWS::DirectoryService::MicrosoftAD: Id attribute removed. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.NetworkProtocol property is now required. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.SecurityGroupIds property is now required.

Features

update L1 CloudFormation resource definitions (#38969) (ed0df78)

batch: add ConsumableResource L2 construct (#36971) (a12f3a1)

bedrockagentcore: support runtime platformVersion (#38924) (227423f)

cloudfront: default Distribution behaviors to redirect HTTP to HTTPS (#38721) (6ede006), closes #38599

opensearchservice: add useLatestServiceSoftwareForBlueGreen support (#38499) (6aa03e5), closes #38664 #38664

pipelines: add executionMode support in CodePipeline L3 construct (#35022) (7283d38), closes #35014

Bug Fixes

bump bundled brace-expansion to 5.0.12 (#38929) (ff25def), closes #38932

applicationautoscaling: target tracking silently ignores custom metric account and region (#36503) (5d10288), closes #36401

bedrockagentcore: accept aws-cn ECR image URIs in Runtime container URI validation (#38948) (49ac618), closes #38947

cloudfront-origins: missing OAC permissions for Function URL (#35919) (d213cc7), closes #35872 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-lambda/lib/function-base.ts#L577 #35725

core: validation E2001 inadvertently not enabled (#38920) (0b763a7)

eks: allow access policies on AccessEntryType.EC2 access entries (#38782) (e507e07), closes #37496

s3-deployment: Source.data objectKey can write outside the staging directory (#38921) (53439f9)

Alpha modules (2.273.0-alpha.0)

⚠ BREAKING CHANGES

redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.

redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.273.0-alpha.0 (2026-10-08)

⚠ BREAKING CHANGES

redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.

redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

Bug Fixes

redshift-alpha: reject PUBLIC user names (#38935) (3335407)

2.272.0-alpha.0 (2026-09-30)

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:

construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set

Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead

... (truncated)

Commits

22a8ee5 chore: update analytics metadata blueprints
f911ee4 chore(release): 2.273.0
ed0df78 feat: update L1 CloudFormation resource definitions (#38969)
07c059f docs(events): add examples for RuleTargetInput and EventField (#38470)
7292cc7 chore(bedrock): add Claude Opus 5, Mythos 5, and Fable 5 foundation models (#...
2915b0d chore(ec2): interface VPC endpoint for eks-proxy (#38385)
a12f3a1 feat(batch): add ConsumableResource L2 construct (#36971)
6aa03e5 feat(opensearchservice): add useLatestServiceSoftwareForBlueGreen support (#3...
6ede006 feat(cloudfront): default Distribution behaviors to redirect HTTP to HTTPS (#...
d615580 docs(core): correct arnFormat default description (#38888)
Additional commits viewable in compare view

Updates @oxlint-tsgolint/darwin-arm64 from 7.0.2003 to 7.0.2004

Release notes

Sourced from @oxlint-tsgolint/darwin-arm64's releases.

v7.0.2004

What's Changed

chore(deps): update taiki-e/install-action action to v2.87.20 by @renovate[bot] in oxc-project/tsgolint#1246

chore(deps): update dependency dprint-json to v0.25.0 by @renovate[bot] in oxc-project/tsgolint#1247

fix(no-unsafe-return): preserve deferred indexed return type by @camc314 in oxc-project/tsgolint#1248

chore(deps): update crate-ci/typos action to v1.50.3 by @renovate[bot] in oxc-project/tsgolint#1250

fix(no-misused-promises): don't report comma expressions as conditionals by @geniusmonir in oxc-project/tsgolint#1254

chore(deps): update gomod by @renovate[bot] in oxc-project/tsgolint#1257

chore(deps): update dprint plugins by @renovate[bot] in oxc-project/tsgolint#1256

chore(deps): update taiki-e/install-action action to v2.87.22 by @renovate[bot] in oxc-project/tsgolint#1258

chore(deps): update npm packages by @renovate[bot] in oxc-project/tsgolint#1259

fix(no-floating-promises): respect safe-call declaration sources by @camc314 in oxc-project/tsgolint#1261

fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns by @camc314 in oxc-project/tsgolint#1264

fix(no-deprecated): include reasons for variable declarations by @camc314 in oxc-project/tsgolint#1266

fix(no-unnecessary-type-parameters): parenthesize constraint in optional tuple elements by @baevm in oxc-project/tsgolint#1267

chore(deps): update crate-ci/typos action to v1.51.0 by @renovate[bot] in oxc-project/tsgolint#1268

chore(deps): update crate-ci/typos action to v1.51.1 by @renovate[bot] in oxc-project/tsgolint#1269

fix: restore line disable comments for type-aware diagnostics by @camc314 in oxc-project/tsgolint#1271

New Contributors

@geniusmonir made their first contribution in oxc-project/tsgolint#1254

Full Changelog: oxc-project/tsgolint@v7.0.2003...v7.0.2004

Commits

a612891 fix: restore line disable comments for type-aware diagnostics (#1271)
fc7068f chore(deps): update crate-ci/typos action to v1.51.1 (#1269)
8d4c05c chore(deps): update crate-ci/typos action to v1.51.0 (#1268)
6d20f35 fix(no-unnecessary-type-parameters): parenthesize constraint in optional tupl...
322b385 fix(no-deprecated): include reasons for variable declarations (#1266)
db76296 fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns (#1264)
24b18b4 fix(no-floating-promises): respect safe-call declaration sources (#1261)
c8f5cbc chore(deps): update npm packages (#1259)
93fe3a5 chore(deps): update taiki-e/install-action action to v2.87.22 (#1258)
dd0a306 chore(deps): update dprint plugins (#1256)
Additional commits viewable in compare view

Updates @oxlint-tsgolint/darwin-x64 from 7.0.2003 to 7.0.2004

Release notes

Sourced from @oxlint-tsgolint/darwin-x64's releases.

v7.0.2004

What's Changed

chore(deps): update taiki-e/install-action action to v2.87.20 by @renovate[bot] in oxc-project/tsgolint#1246

chore(deps): update dependency dprint-json to v0.25.0 by @renovate[bot] in oxc-project/tsgolint#1247

fix(no-unsafe-return): preserve deferred indexed return type by @camc314 in oxc-project/tsgolint#1248

chore(deps): update crate-ci/typos action to v1.50.3 by @renovate[bot] in oxc-project/tsgolint#1250

fix(no-misused-promises): don't report comma expressions as conditionals by @geniusmonir in oxc-project/tsgolint#1254

chore(deps): update gomod by @renovate[bot] in oxc-project/tsgolint#1257

chore(deps): update dprint plugins by @renovate[bot] in oxc-project/tsgolint#1256

chore(deps): update taiki-e/install-action action to v2.87.22 by @renovate[bot] in oxc-project/tsgolint#1258

chore(deps): update npm packages by @renovate[bot] in oxc-project/tsgolint#1259

fix(no-floating-promises): respect safe-call declaration sources by @camc314 in oxc-project/tsgolint#1261

fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns by @camc314 in oxc-project/tsgolint#1264

fix(no-deprecated): include reasons for variable declarations by @camc314 in oxc-project/tsgolint#1266

fix(no-unnecessary-type-parameters): parenthesize constraint in optional tuple elements by @baevm in oxc-project/tsgolint#1267

chore(deps): update crate-ci/typos action to v1.51.0 by @renovate[bot] in oxc-project/tsgolint#1268

chore(deps): update crate-ci/typos action to v1.51.1 by @renovate[bot] in oxc-project/tsgolint#1269

fix: restore line disable comments for type-aware diagnostics by @camc314 in oxc-project/tsgolint#1271

New Contributors

@geniusmonir made their first contribution in oxc-project/tsgolint#1254

Full Changelog: oxc-project/tsgolint@v7.0.2003...v7.0.2004

Commits

a612891 fix: restore line disable comments for type-aware diagnostics (#1271)
fc7068f chore(deps): update crate-ci/typos action to v1.51.1 (#1269)
8d4c05c chore(deps): update crate-ci/typos action to v1.51.0 (#1268)
6d20f35 fix(no-unnecessary-type-parameters): parenthesize constraint in optional tupl...
322b385 fix(no-deprecated): include reasons for variable declarations (#1266)
db76296 fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns (#1264)
24b18b4 fix(no-floating-promises): respect safe-call declaration sources (#1261)
c8f5cbc chore(deps): update npm packages (#1259)
93fe3a5 chore(deps): update taiki-e/install-action action to v2.87.22 (#1258)
dd0a306 chore(deps): update dprint plugins (#1256)
Additional commits viewable in compare view

Updates @oxlint-tsgolint/linux-arm64 from 7.0.2003 to 7.0.2004

Release notes

Sourced from @oxlint-tsgolint/linux-arm64's releases.

v7.0.2004

What's Changed

chore(deps): update taiki-e/install-action action to v2.87.20 by @renovate[bot] in oxc-project/tsgolint#1246

chore(deps): update dependency dprint-json to v0.25.0 by @renovate[bot] in oxc-project/tsgolint#1247

fix(no-unsafe-return): preserve deferred indexed return type by @camc314 in oxc-project/tsgolint#1248

chore(deps): update crate-ci/typos action to v1.50.3 by @renovate[bot] in oxc-project/tsgolint#1250

fix(no-misused-promi...
Description has been truncated

Bumps the npm group with 4 updates in the / directory: [zod](https://github.com/colinhacks/zod), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) and [oxlint-tsgolint](https://github.com/oxc-project/tsgolint). Bumps the npm group with 10 updates in the /example directory: | Package | From | To | | --- | --- | --- | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.6` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` | | [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.272.0` | `2.273.0` | | [@oxlint-tsgolint/darwin-arm64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/darwin-x64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/linux-arm64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/linux-x64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/win32-arm64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/win32-x64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | Bumps the npm group with 10 updates in the /package directory: | Package | From | To | | --- | --- | --- | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.6` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` | | [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.272.0` | `2.273.0` | | [@oxlint-tsgolint/darwin-arm64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/darwin-x64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/linux-arm64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/linux-x64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/win32-arm64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [@oxlint-tsgolint/win32-x64](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | Updates `zod` from 4.6.5 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.6) Updates `@types/node` from 26.6.4 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `aws-cdk-lib` from 2.272.0 to 2.273.0 - [Release notes](https://github.com/aws/aws-cdk/releases) - [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md) - [Commits](https://github.com/aws/aws-cdk/commits/v2.273.0/packages/aws-cdk-lib) Updates `oxlint-tsgolint` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `zod` from 4.6.5 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.6) Updates `@types/node` from 26.6.4 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `aws-cdk-lib` from 2.272.0 to 2.273.0 - [Release notes](https://github.com/aws/aws-cdk/releases) - [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md) - [Commits](https://github.com/aws/aws-cdk/commits/v2.273.0/packages/aws-cdk-lib) Updates `@oxlint-tsgolint/darwin-arm64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/darwin-x64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/linux-arm64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/linux-x64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/win32-arm64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/win32-x64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `oxlint-tsgolint` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `zod` from 4.6.5 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.6) Updates `@types/node` from 26.6.4 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `aws-cdk-lib` from 2.272.0 to 2.273.0 - [Release notes](https://github.com/aws/aws-cdk/releases) - [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md) - [Commits](https://github.com/aws/aws-cdk/commits/v2.273.0/packages/aws-cdk-lib) Updates `@oxlint-tsgolint/darwin-arm64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/darwin-x64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/linux-arm64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/linux-x64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/win32-arm64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `@oxlint-tsgolint/win32-x64` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `oxlint-tsgolint` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) --- updated-dependencies: - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: aws-cdk-lib dependency-version: 2.273.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: oxlint-tsgolint dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: aws-cdk-lib dependency-version: 2.273.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@oxlint-tsgolint/darwin-arm64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/darwin-x64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/linux-arm64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/linux-x64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/win32-arm64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/win32-x64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: oxlint-tsgolint dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: aws-cdk-lib dependency-version: 2.273.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@oxlint-tsgolint/darwin-arm64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/darwin-x64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/linux-arm64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/linux-x64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/win32-arm64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@oxlint-tsgolint/win32-x64" dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm - dependency-name: oxlint-tsgolint dependency-version: 7.0.2004 dependency-type: indirect update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-18T18:08:43Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

npm/@types/node

26.6.5

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 29/30 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/aws-cdk-lib

2.273.0

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ -1	internal error: internal error: invalid Dockerfile
License	🟢 10	license file detected
Signed-Releases	🟢 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy	🟢 10	security policy file detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Branch-Protection	🟢 8	branch protection is not maximal on development and all release branches
Fuzzing	🟢 10	project is fuzzed
SAST	🟢 9	SAST tool detected but not run on all commits

npm/zod

4.6.6

🟢 5.1

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches

npm/@types/node

26.6.5

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 29/30 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/zod

4.6.6

🟢 5.1

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches

Scanned Files

example/package.json
package/package.json

dependabot Bot assigned poad Oct 18, 2026

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 18, 2026

github-actions Bot approved these changes Oct 18, 2026

View reviewed changes

github-actions Bot enabled auto-merge (squash) October 18, 2026 18:08

github-actions Bot merged commit 99928ee into main Oct 18, 2026
4 checks passed

github-actions Bot deleted the dependabot/npm_and_yarn/npm-5009d2c7cf branch October 18, 2026 18:09

Navigation Menu

Repository navigation

Bump the npm group across 3 directories with 10 updates - #302

Bump the npm group across 3 directories with 10 updates#302
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-5009d2c7cf

dependabot Bot commented on behalf of github Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 18, 2026

v4.6.6

Commits:

v2.273.0

⚠ BREAKING CHANGES

Features

Bug Fixes

Alpha modules (2.273.0-alpha.0)

⚠ BREAKING CHANGES

Features

Changelog

2.273.0-alpha.0 (2026-10-08)

⚠ BREAKING CHANGES

Features

Bug Fixes

2.272.0-alpha.0 (2026-09-30)

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

v7.0.2004

What's Changed

New Contributors

v4.6.6

Commits:

v2.273.0

⚠ BREAKING CHANGES

Features

Bug Fixes

Alpha modules (2.273.0-alpha.0)

⚠ BREAKING CHANGES

Features

Changelog

2.273.0-alpha.0 (2026-10-08)

⚠ BREAKING CHANGES

Features

Bug Fixes

2.272.0-alpha.0 (2026-09-30)

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

v7.0.2004

What's Changed

New Contributors

v7.0.2004

What's Changed

New Contributors

v7.0.2004

What's Changed

Uh oh!

github-actions Bot commented Oct 18, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant