fix(deps): update all dependencies j:cdx-227

[renovate-coveo]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
@actions/core (source)	devDependencies	minor	1.10.0 → 1.11.1
@amplitude/analytics-types	devDependencies	minor	2.1.2 → 2.11.1
@amplitude/analytics-types	dependencies	minor	2.1.2 → 2.11.1
@babel/core (source)	devDependencies	minor	7.21.5 → 7.29.0
@babel/core (source)	dependencies	minor	7.21.5 → 7.29.0
@babel/preset-env (source)	dependencies	minor	7.21.5 → 7.29.0
@babel/preset-typescript (source)	dependencies	minor	7.21.5 → 7.28.5
@commitlint/config-conventional (source)	devDependencies	minor	17.6.1 → 17.8.1
@commitlint/lint (source)	devDependencies	minor	17.6.1 → 17.8.1
@coveo/headless (source)	dependencies	minor	2.13.1 → 2.80.7
@coveo/platform-client	devDependencies	minor	58.5.0 → 58.21.0
@coveo/platform-client	dependencies	minor	58.5.0 → 58.21.0
@coveo/push-api-client	dependencies	patch	4.0.1 → 4.0.24
@coveo/semantic-monorepo-tools	dependencies	minor	2.4.28 → 2.7.1
@coveo/semantic-monorepo-tools	devDependencies	minor	2.4.28 → 2.7.1
@emotion/react (source)	devDependencies	minor	11.10.8 → 11.14.0
@emotion/styled (source)	devDependencies	minor	11.10.8 → 11.14.1
@mui/material (source)	devDependencies	minor	5.12.2 → 5.18.0
@npmcli/arborist (source)	devDependencies	minor	6.2.8 → 6.5.1
@testing-library/jest-dom	devDependencies	minor	5.16.5 → 5.17.0
@testing-library/react	devDependencies	minor	14.0.0 → 14.3.1
@types/archiver (source)	devDependencies	patch	5.3.2 → 5.3.4
@types/async-retry (source)	devDependencies	patch	1.4.5 → 1.4.9
@types/cli-progress (source)	devDependencies	patch	3.11.0 → 3.11.6
@types/cookie-session (source)	devDependencies	patch	2.0.44 → 2.0.49
@types/cors (source)	devDependencies	patch	2.8.13 → 2.8.19
@types/csurf (source)	devDependencies	patch	1.11.2 → 1.11.5
@types/folder-hash (source)	devDependencies	patch	4.0.2 → 4.0.4
@types/fs-extra (source)	devDependencies	patch	11.0.1 → 11.0.4
@types/inquirer (source)	devDependencies	patch	8.2.6 → 8.2.12
@types/is-ci (source)	devDependencies	patch	3.0.0 → 3.0.4
@types/is-running (source)	devDependencies	patch	2.1.0 → 2.1.2
@types/jest (source)	devDependencies	patch	29.5.1 → 29.5.14
@types/json2csv (source)	devDependencies	patch	5.0.3 → 5.0.7
@types/node (source)	devDependencies	minor	18.16.3 → 18.19.130
@types/npm-package-arg (source)	devDependencies	patch	6.1.1 → 6.1.4
@types/react (source)	devDependencies	minor	18.2.0 → 18.3.28
@types/react-dom (source)	devDependencies	minor	18.2.1 → 18.3.7
@types/semver (source)	devDependencies	minor	7.3.13 → 7.7.1
@types/supertest (source)	devDependencies	patch	2.0.12 → 2.0.16
@types/tmp (source)	devDependencies	patch	0.2.3 → 0.2.6
@types/wait-on (source)	devDependencies	patch	5.3.1 → 5.3.4
@typescript-eslint/eslint-plugin (source)	devDependencies	minor	5.59.1 → 5.62.0
@typescript-eslint/parser (source)	devDependencies	minor	5.59.1 → 5.62.0
abortcontroller-polyfill	dependencies	patch	1.7.5 → 1.7.8
abortcontroller-polyfill	devDependencies	patch	1.7.5 → 1.7.8
actions/checkout	action	digest	8e5e7e5 → f43a0e5
actions/setup-node	action	digest	64ed1c7 → 3235b87
actions/setup-python	action	digest	57ded4d → 7f4fc3e
actions/upload-artifact	action	digest	0b7f8ab → ff15f03
aws-sdk	devDependencies	minor	2.1368.0 → 2.1693.0
babel-jest (source)	dependencies	minor	29.5.0 → 29.7.0
chai (source)	devDependencies	minor	4.3.7 → 4.5.0
devtools-protocol	dependencies	patch	0.0.1137730 → 0.0.1587613
dotenv	devDependencies	minor	16.0.3 → 16.6.1
dotenv	dependencies	minor	16.0.3 → 16.6.1
eslint (source)	devDependencies	minor	8.39.0 → 8.57.1
eslint-config-prettier	devDependencies	minor	8.8.0 → 8.10.2
eslint-plugin-prettier	devDependencies	patch	4.2.1 → 4.2.5
exponential-backoff	devDependencies	patch	3.1.1 → 3.1.3
fancy-test	devDependencies	patch	2.0.21 → 2.0.42
fancy-test	dependencies	patch	2.0.21 → 2.0.42
folder-hash	devDependencies	minor	4.0.4 → 4.1.1
fs-extra	dependencies	minor	11.1.1 → 11.3.3
fs-extra	devDependencies	minor	11.1.1 → 11.3.3
github/codeql-action	action	digest	9e8d078 → f5c2471
inquirer (source)	dependencies	patch	8.2.5 → 8.2.7
jest (source)	devDependencies	minor	29.5.0 → 29.7.0
jest (source)	dependencies	minor	29.5.0 → 29.7.0
jest-config (source)	dependencies	minor	29.5.0 → 29.7.0
jsonschema	dependencies	minor	1.4.1 → 1.5.0
jsonschema	devDependencies	minor	1.4.1 → 1.5.0
lint-staged	devDependencies	minor	13.2.2 → 13.3.0
moment (source)	devDependencies	minor	2.29.4 → 2.30.1
node (source)		minor	22.18.0 → 22.22.0
npm (source)	dependencies	minor	9.3.0 → 9.9.4
octokit	dependencies	minor	2.0.14 → 2.1.0
octokit	devDependencies	minor	2.0.14 → 2.1.0
pacote	devDependencies	minor	15.1.3 → 15.2.0
python	uses-with	minor	3.10 → 3.14
react (source)	devDependencies	minor	18.2.0 → 18.3.1
react-dom (source)	devDependencies	minor	18.2.0 → 18.3.1
react-router-dom (source)	devDependencies	minor	6.11.0 → 6.30.3
semver	dependencies	minor	7.5.2 → 7.7.4
semver	devDependencies	minor	7.5.2 → 7.7.4
step-security/harden-runner	action	minor	v2.13.1 → v2.14.2
supertest	devDependencies	patch	6.3.3 → 6.3.4
ts-jest (source)	devDependencies	minor	29.1.0 → 29.4.6
ts-node (source)	dependencies	patch	10.9.1 → 10.9.2
ts-node (source)	devDependencies	patch	10.9.1 → 10.9.2
tslib (source)	devDependencies	minor	2.5.0 → 2.8.1
tslib (source)	dependencies	minor	2.5.0 → 2.8.1
verdaccio (source)	dependencies	minor	5.24.1 → 5.33.0
verdaccio (source)	devDependencies	minor	5.24.1 → 5.33.0
wait-on	devDependencies	minor	7.0.1 → 7.2.0
zod (source)	dependencies	minor	3.22.4 → 3.25.76

---

Release Notes

actions/toolkit (@​actions/core)

v1.11.1

• Fix uses of crypto.randomUUID on Node 18 and earlier #​1842

1.11.0

• Add platform info utilities #​1551
• Remove dependency on uuid package #​1824

1.10.1

• Fix error message reference in oidc utils #​1511

1.10.0

• saveState and setOutput now use environment files if available #​1178
• getMultilineInput now correctly trims whitespace by default #​1185

1.9.1

• Randomize delimiter when calling core.exportVariable

1.9.0

• Added toPosixPath, toWin32Path and toPlatformPath utilities #​1102

1.8.2

• Update to v2.0.1 of @actions/http-client #​1087

1.8.1

• Update to v2.0.0 of @actions/http-client

1.8.0

• Deprecate markdownSummary extension export in favor of summary
  • #​1072
  • #​1073

1.7.0

• Added markdownSummary extension

1.6.0

• Added OIDC Client function getIDToken
• Added file parameter to AnnotationProperties

1.5.0

• Added support for notice annotations and more annotation fields

1.4.0

• Added the getMultilineInput function

1.3.0

• Added the trimWhitespace option to getInput
• Added the getBooleanInput function

1.2.7

• Prepend newline for set-output

1.2.6

• Update exportVariable and addPath to use environment files

1.2.5

• Correctly bundle License File with package

1.2.4

• Be more lenient in accepting non-string command inputs
• Add Echo commands

1.2.3

• IsDebug logging

1.2.2

• Fix escaping for runner commands

1.2.1

• Remove trailing comma from commands
• Add "types" to package.json

1.2.0

• saveState and getState functions for wrapper tasks (on finally entry points that run post job)

1.1.3

• setSecret added to register a secret with the runner to be masked from the logs
• exportSecret which was not implemented and never worked was removed after clarification from product.

1.1.1

• Add support for action input variables with multiple spaces #​127
• Switched ## commands to :: commands (should have no noticeable impact) [#​110)(#​110)

1.1.0

• Added helpers for group and endgroup #​98

1.0.0

• Initial release

v1.11.0

• Add platform info utilities #​1551
• Remove dependency on uuid package #​1824

v1.10.1

• Fix error message reference in oidc utils #​1511

amplitude/Amplitude-TypeScript (@​amplitude/analytics-types)

v2.11.1

Compare Source

Note: Version bump only for package @​amplitude/analytics-types

v2.11.0

Compare Source

Features

• analytics-browser: add remote config server url to proxy remote config requests (#​1348) (461b598)

v2.10.0

Compare Source

Bug Fixes

• analtyics-browser): Revert "feat(analytics-browser: add page-url-previous-page plugin" (#​1237) (dfd7340)
• analytics-core: fix typo in Reddit click-id (#​1267) (43e581d)

Features

• analytics-browser: add page-url-previous-page plugin (#​1110) (dc053ed)

v2.9.2

Compare Source

Note: Version bump only for package @​amplitude/analytics-types

v2.9.1

Compare Source

Bug Fixes

• typo in a docblock (#​954) (71e9f9a)

v2.9.0

Compare Source

Bug Fixes

• ability to send revenue currency to amplitude (d4f52e7)

Features

• moves groups to eventoptions type #​970 (#​972) (f60f71c)

Reverts

• Revert "chore(release): publish" (d392f62)

v2.8.4

Compare Source

Bug Fixes

• analytics-types: allow an array of objects as identity value type (#​914) (a6ddf9f)

v2.8.3

Compare Source

Bug Fixes

• analytics-types: build in next.js (#​900) (63be8c3)

v2.8.2

Compare Source

Bug Fixes

• analytics-types: update Element in element interactions (#​877) (d501ef6)

v2.8.1

Compare Source

Bug Fixes

• analytics-types: update element interactions options (#​862) (fbce96b)

v2.8.0

Compare Source

Features

• support remote config for each autocapture field (#​848) (939d49f)

v2.7.0

Compare Source

Features

• remote config (#​832) (c415f79), closes #​769 #​772 #​780 #​782 #​811 #​828

v2.6.0

Compare Source

Bug Fixes

• adding ability to enable debug logs using cookies (bc36f08)

Features

• analytics-browser: consume remote config (#​769) (9c4e03c)

v2.5.1

Compare Source

Note: Version bump only for package @​amplitude/analytics-types

v2.5.0

Compare Source

Features

• landing page improvement (#​667) (5f365f0)

v2.4.0

Compare Source

Features

• add offline mode (#​644) (f2cd717)

v2.3.1

Compare Source

Bug Fixes

• npm latest tags (#​624) (76bf7a4)

v2.3.0

Compare Source

Features

• add client upload time (#​601) (b80d090)

v2.2.0

Compare Source

Bug Fixes

• dont modify types in analytics-types (488832f)
• global user properties: test, and fix filename (84bdbef)
• refactor event.ts (1a28e0b)

Features

• global user properties: add global properties plugin base code without tests (b539c5e)

babel/babel (@​babel/core)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

• babel-types
  • #​17750 [7.x backport] Add attributes import declaration builder (@​JLHwung)
• babel-standalone
  • #​17663 [7.x backport] feat(standalone): export async transform (@​JLHwung)
  • #​17725 [7.x backport] feat: read standalone targets from data-targets (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​17765 fix(parser): correctly parse type assertions in extends clause (@​nicolo-ribaudo)
  • #​17723 [7.x backport] fix(parser): improve super type argument parsing (@​JLHwung)
• babel-traverse
  • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
• babel-plugin-transform-block-scoping, babel-traverse
  • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

🏃‍♀️ Performance

• babel-generator, babel-runtime-corejs3
  • #​17642 [Babel 7] Improve generator performance (@​liuxingbaoyu)

Committers: 6

• David (@​simbahax)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• @​magic-akari

v7.28.6

Compare Source

v7.28.6 (2026-01-12)

Thanks @​kadhirash and @​kolvian for your first PRs!

🐛 Bug Fix

• babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types
  • #​17589 Improve Unicode handling in code-frame tokenizer (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17556 fix: transform-regenerator correctly handles scope (@​liuxingbaoyu)
• babel-plugin-transform-react-jsx
  • #​17538 fix: Keep jsx comments (@​liuxingbaoyu)

💅 Polish

• babel-core, babel-standalone
  • #​17606 Polish(standalone): improve message on invalid preset/plugin (@​JLHwung)

🏠 Internal

• babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex
  • #​17580 Allow Babel 8 in compatible Babel 7 plugins (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-react-jsx
  • #​17555 perf: Use lighter traversal for jsx __source,__self (@​liuxingbaoyu)

Committers: 7

• Babel Bot (@​babel-bot)
• Eliot Pontarelli (@​kolvian)
• Huáng Jùnliàng (@​JLHwung)
• Kadhirash Sivakumar (@​kadhirash)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• coderaiser (@​coderaiser)

v7.28.5

Compare Source

v7.28.5 (2025-10-23)

Thank you @​CO0Ki3, @​Olexandr88, and @​youthfulhps for your first PRs!

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

Committers: 8

• Babel Bot (@​babel-bot)
• Byeongho Yoo (@​youthfulhps)
• Huáng Jùnliàng (@​JLHwung)
• Hyeon Dokko (@​CO0Ki3)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​Olexandr88
• @​liuxingbaoyu
• fisker Cheung (@​fisker)

v7.28.4

Compare Source

v7.28.4 (2025-09-05)

Thanks @​gwillen and @​mrginglymus for your first PRs!

🏠 Internal

• babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • #​17493 Update Jest to v30.1.1 (@​JLHwung)
• babel-plugin-transform-regenerator
  • #​17455 chore: Clean up transform-regenerator (@​liuxingbaoyu)
• babel-core
  • #​17474 Switch to @​jridgewell/remapping (@​mrginglymus)

Committers: 5

• Babel Bot (@​babel-bot)
• Bill Collins (@​mrginglymus)
• Glenn Willen (@​gwillen)
• Huáng Jùnliàng (@​JLHwung)
• @​liuxingbaoyu

v7.28.3

Compare Source

v7.28.3 (2025-08-14)

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

Committers: 5

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Jam Balaya (@​JamBalaya56562)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• easrng (@​easrng)

v7.28.0

Compare Source

v7.28.0 (2025-07-02)

🚀 New Feature

• babel-node
  • #​17147 Support top level await in node repl (@​liuxingbaoyu)
• babel-types
  • #​17258 feat(matchesPattern): support super/private/meta (@​JLHwung)
• babel-compat-data, babel-preset-env
  • #​17355 Add explicit resource management to preset-env (@​JLHwung)
• babel-core, babel-parser
  • #​17390 Support sourceType: "commonjs" (@​JLHwung)
• babel-generator, babel-parser
  • #​17346 Materialize explicitResourceManagement parser plugin (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • #​17391 LVal coverage updates (Part 2) (@​JLHwung)
• babel-parser, babel-traverse, babel-types
  • #​17378 Accept bigints in t.bigIntLiteral factory (@​JLHwung)
• babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • #​17277 Transform discard binding (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types
  • #​17163 Parse discard binding (@​JLHwung)

🐛 Bug Fix

• babel-helper-globals, babel-plugin-transform-classes, babel-traverse
  • #​17297 Create babel-helper-globals (@​JLHwung)
• babel-types
  • #​17009 feature: TSTypeOperator: keyof (#​16799) (@​coderaiser)

🏠 Internal

• babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • #​17403 Update babel-polyfill packages ([@​nicolo-ribaudo](https://redirect.github.co

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

Thanks for your contribution @renovate-coveo[bot] !
When your pull-request is ready to be merged, check the box below to merge it

• Merge!

[github-actions]

Dependency Review

The following issues were found:

• ❌ 5 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 4 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

packages/cli-e2e/npm-shim/package-lock.json

Name	Version	Vulnerability	Severity
glob	10.3.10	glob CLI: Command injection via -c/--cmd executes matches with shell:true	high
minimatch	9.0.3	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	high
minimatch	5.1.6	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	high
tar	6.2.1	node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization	high
		Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS	high
		node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal	high
		Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction	high

utils/release/package.json

Name	Version	Vulnerability	Severity
glob	10.3.10	glob CLI: Command injection via -c/--cmd executes matches with shell:true	high
minimatch	9.0.3	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	high
minimatch	5.1.6	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	high
tar	6.2.1	node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization	high
		Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS	high
		node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal	high
		Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction	high
octokit	2.1.0	Unauthenticated Denial of Service in the octokit/webhooks library	high

Only included vulnerabilities with severity high or higher.

License Issues

utils/verdaccio-starter/package.json

Package	Version	License	Issue Type
verdaccio	5.33.0	LicenseRef-github-NOASSERTION	Incompatible License

packages/cli-e2e/npm-shim/package-lock.json

Package	Version	License	Issue Type
string-width-cjs	4.2.3	Null	Unknown License
strip-ansi-cjs	6.0.1	Null	Unknown License
wrap-ansi-cjs	7.0.0	Null	Unknown License

packages/cli-e2e/package.json

Package	Version	License	Issue Type
devtools-protocol	0.0.1587613	Null	Unknown License

Allowed Licenses: 0BSD, AFL-2.1, AFL-3.0, Apache-1.1, Apache-2.0, Apache-2.0 WITH LLVM-exception, APL-1.0, Artistic-1.0, Artistic-1.0-Perl, Artistic-2.0, Beerware, BlueOak-1.0.0, BSD-1-Clause, BSD-2-Clause, BSD-2-Clause-Patent, BSD-2-Clause-Views, BSD-3-Clause, BSD-3-Clause-Attribution, BSD-3-Clause-Clear, BSD-3-Clause-No-Nuclear-Warranty, BSD-4-Clause, BSL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, CDDL-1.0, CDDL-1.1, CNRI-Python, CPL-1.0, curl, EPL-1.0, EPL-2.0, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, HPND, HPND-Markus-Kuhn, IBM-pibs, ImageMagick, ISC, JSON, LGPL-2.0-or-later, LGPL-2.0-only, LGPL-2.1, LGPL-2.1-only, LGPL-2.1+, LGPL-3.0, LGPL-3.0-only, LGPL-3.0-or-later, LGPL-3.0-or-later WITH openvpn-openssl-exception, LicenseRef-scancode-alliance-open-media-patent-1.0, LicenseRef-scancode-dco-1.1, LicenseRef-scancode-google-patent-license-golang, LicenseRef-scancode-other-permissive, LicenseRef-scancode-protobuf, LicenseRef-scancode-public-domain, LicenseRef-scancode-python-cwi, LicenseRef-scancode-secret-labs-2011, LicenseRef-scancode-unicode, LicenseRef-scancode-unknown-license-reference, MIT, MIT-CMU, MIT-0, MIT-advertising, MITNFA, mpi-permissive, MPL-1.1, MPL-2.0, NCSA, Nokia, ODC-By-1.0, OFL-1.1, PDDL-1.0, Plexus, PostgreSQL, PSF-2.0, Python-2.0, Python-2.0.1, Qhull, Ruby, SAX-PD, SPL-1.0, Unicode-3.0, Unlicense, UPL-1.0, W3C, Wsuipa, WTFPL, X11, X11-distribute-modifications-variant, Xerox, xpp, YPL-1.1, Zlib, ZPL-2.1

Excluded from license check: pkg:maven/com.datadoghq/java-dogstatsd-client, pkg:maven/com.google.errorprone/error_prone_annotations, pkg:maven/jakarta.xml.bind/jakarta.xml.bind-api, pkg:maven/jakarta.json/jakarta.json-api, pkg:maven/jakarta.json.bind/jakarta.json.bind-api, pkg:maven/org.apache.commons/commons-math, pkg:maven/org.apache.lucene/lucene-grouping, pkg:maven/org.apache.lucene/lucene-highlighter, pkg:maven/org.apache.lucene/lucene-misc, pkg:maven/org.apache.lucene/lucene-queries, pkg:maven/org.apache.lucene/lucene-queryparser, pkg:maven/org.apache.lucene/lucene-spatial-extras, pkg:maven/org.apache.lucene/lucene-suggest, pkg:maven/org.aspectj/aspectjweaver, pkg:maven/org.bouncycastle/bcpkix-jdk18on, pkg:maven/org.bouncycastle/bcutil-jdk18on, pkg:maven/org.eclipse.angus/angus-activation, pkg:maven/org.flywaydb/flyway-mysql, pkg:maven/org.glassfish.jaxb/jaxb-core, pkg:maven/org.glassfish.jaxb/txw2, pkg:maven/org.glassfish.jaxb/jaxb-runtime, pkg:maven/org.glassfish.jersey.connectors/jersey-apache-connector, pkg:maven/org.glassfish.jersey.core/jersey-common, pkg:maven/org.glassfish.jersey.core/jersey-client, pkg:maven/org.glassfish.jersey.inject/jersey-hk2, pkg:maven/org.jdom/jdom2, pkg:maven/org.json/json, pkg:maven/org.mpierce.metrics.reservoir:hdrhistogram-metrics-reservoir, pkg:maven/com.mysql/mysql-connector-j, pkg:maven/org.springframework/beandoc, pkg:maven/org.springframework/framework-api, pkg:maven/org.springframework/framework-docs, pkg:maven/org.springframework/spring, pkg:maven/org.springframework/spring-agent, pkg:maven/org.springframework/spring-aop, pkg:maven/org.springframework/spring-asm, pkg:maven/org.springframework/spring-aspects, pkg:maven/org.springframework/spring-beandoc, pkg:maven/org.springframework/spring-beans, pkg:maven/org.springframework/spring-binding, pkg:maven/org.springframework/spring-context, pkg:maven/org.springframework/spring-context-indexer, pkg:maven/org.springframework/spring-context-support, pkg:maven/org.springframework/spring-core, pkg:maven/org.springframework/spring-core-test, pkg:maven/org.springframework/spring-dao, pkg:maven/org.springframework/spring-expression, pkg:maven/org.springframework/spring-framework-bom, pkg:maven/org.springframework/spring-full, pkg:maven/org.springframework/spring-hibernate, pkg:maven/org.springframework/spring-hibernate2, pkg:maven/org.springframework/spring-hibernate3, pkg:maven/org.springframework/spring-ibatis, pkg:maven/org.springframework/spring-instrument, pkg:maven/org.springframework/spring-instrument-tomcat, pkg:maven/org.springframework/spring-jca, pkg:maven/org.springframework/spring-jcl, pkg:maven/org.springframework/spring-jdbc, pkg:maven/org.springframework/spring-jdo, pkg:maven/org.springframework/spring-jms, pkg:maven/org.springframework/spring-jmx, pkg:maven/org.springframework/spring-jpa, pkg:maven/org.springframework/spring-ldap, pkg:maven/org.springframework/spring-messaging, pkg:maven/org.springframework/spring-mock, pkg:maven/org.springframework/spring-ojb, pkg:maven/org.springframework/spring-orm, pkg:maven/org.springframework/spring-oxm, pkg:maven/org.springframework/spring-parent, pkg:maven/org.springframework/spring-portlet, pkg:maven/org.springframework/spring-r2dbc, pkg:maven/org.springframework/spring-remoting, pkg:maven/org.springframework/spring-struts, pkg:maven/org.springframework/spring-support, pkg:maven/org.springframework/spring-test, pkg:maven/org.springframework/spring-tomcat-weaver, pkg:maven/org.springframework/spring-toplink, pkg:maven/org.springframework/spring-tuple, pkg:maven/org.springframework/spring-tuple-parent, pkg:maven/org.springframework/spring-tx, pkg:maven/org.springframework/spring-web, pkg:maven/org.springframework/spring-webflow, pkg:maven/org.springframework/spring-webflux, pkg:maven/org.springframework/spring-webmvc, pkg:maven/org.springframework/spring-webmvc-portlet, pkg:maven/org.springframework/spring-webmvc-struts, pkg:maven/org.springframework/spring-websocket, pkg:maven/org.springframework/springloaded, pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin, pkg:maven/org.springframework.boot/spring-boot, pkg:maven/org.springframework.boot/spring-boot-actuator, pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure, pkg:maven/org.springframework.boot/spring-boot-actuator-docs, pkg:maven/org.springframework.boot/spring-boot-antlib, pkg:maven/org.springframework.boot/spring-boot-autoconfigure, pkg:maven/org.springframework.boot/spring-boot-autoconfigure-processor, pkg:maven/org.springframework.boot/spring-boot-build, pkg:maven/org.springframework.boot/spring-boot-buildpack-platform, pkg:maven/org.springframework.boot/spring-boot-cli, pkg:maven/org.springframework.boot/spring-boot-configuration-metadata, pkg:maven/org.springframework.boot/spring-boot-configuration-processor, pkg:maven/org.springframework.boot/spring-boot-dependencies, pkg:maven/org.springframework.boot/spring-boot-devtools, pkg:maven/org.springframework.boot/spring-boot-docker-compose, pkg:maven/org.springframework.boot/spring-boot-docs, pkg:maven/org.springframework.boot/spring-boot-full-build, pkg:maven/org.springframework.boot/spring-boot-gradle-plugin, pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools, pkg:maven/org.springframework.boot/spring-boot-jarmode-tools, pkg:maven/org.springframework.boot/spring-boot-loader, pkg:maven/org.springframework.boot/spring-boot-loader-classic, pkg:maven/org.springframework.boot/spring-boot-loader-tools, pkg:maven/org.springframework.boot/spring-boot-maven-plugin, pkg:maven/org.springframework.boot/spring-boot-parent, pkg:maven/org.springframework.boot/spring-boot-project, pkg:maven/org.springframework.boot/spring-boot-properties-migrator, pkg:maven/org.springframework.boot/spring-boot-security-test-web-helloworld, pkg:maven/org.springframework.boot/spring-boot-starter, pkg:maven/org.springframework.boot/spring-boot-starter-activemq, pkg:maven/org.springframework.boot/spring-boot-starter-actuator, pkg:maven/org.springframework.boot/spring-boot-starter-amqp, pkg:maven/org.springframework.boot/spring-boot-starter-aop, pkg:maven/org.springframework.boot/spring-boot-starter-artemis, pkg:maven/org.springframework.boot/spring-boot-starter-batch, pkg:maven/org.springframework.boot/spring-boot-starter-cache, pkg:maven/org.springframework.boot/spring-boot-starter-cloud-connectors, pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra, pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive, pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase, pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase-reactive, pkg:maven/org.springframework.boot/spring-boot-starter-data-elasticsearch, pkg:maven/org.springframework.boot/spring-boot-starter-data-gemfire, pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc, pkg:maven/org.springframework.boot/spring-boot-starter-data-jpa, pkg:maven/org.springframework.boot/spring-boot-starter-data-ldap, pkg:maven/org.springframework.boot/spring-boot-starter-data-mongodb, pkg:maven/org.springframework.boot/spring-boot-starter-data-mongodb-reactive, pkg:maven/org.springframework.boot/spring-boot-starter-data-neo4j, pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc, pkg:maven/org.springframework.boot/spring-boot-starter-data-redis, pkg:maven/org.springframework.boot/spring-boot-starter-data-redis-reactive, pkg:maven/org.springframework.boot/spring-boot-starter-data-rest, pkg:maven/org.springframework.boot/spring-boot-starter-data-solr, pkg:maven/org.springframework.boot/spring-boot-starter-freemarker, pkg:maven/org.springframework.boot/spring-boot-starter-graphql, pkg:maven/org.springframework.boot/spring-boot-starter-groovy-templates, pkg:maven/org.springframework.boot/spring-boot-starter-hateoas, pkg:maven/org.springframework.boot/spring-boot-starter-integration, pkg:maven/org.springframework.boot/spring-boot-starter-jdbc, pkg:maven/org.springframework.boot/spring-boot-starter-jersey, pkg:maven/org.springframework.boot/spring-boot-starter-jetty, pkg:maven/org.springframework.boot/spring-boot-starter-jooq, pkg:maven/org.springframework.boot/spring-boot-starter-json, pkg:maven/org.springframework.boot/spring-boot-starter-jta-atomikos, pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix, pkg:maven/org.springframework.boot/spring-boot-starter-log4j2, pkg:maven/org.springframework.boot/spring-boot-starter-logging, pkg:maven/org.springframework.boot/spring-boot-starter-mail, pkg:maven/org.springframework.boot/spring-boot-starter-mobile, pkg:maven/org.springframework.boot/spring-boot-starter-mustache, pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-authorization-server, pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-client, pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server, pkg:maven/org.springframework.boot/spring-boot-starter-parent, pkg:maven/org.springframework.boot/spring-boot-starter-pulsar, pkg:maven/org.springframework.boot/spring-boot-starter-pulsar-reactive, pkg:maven/org.springframework.boot/spring-boot-starter-quartz, pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty, pkg:maven/org.springframework.boot/spring-boot-starter-remote-shell, pkg:maven/org.springframework.boot/spring-boot-starter-rsocket, pkg:maven/org.springframework.boot/spring-boot-starter-security, pkg:maven/org.springframework.boot/spring-boot-starter-social-facebook, pkg:maven/org.springframework.boot/spring-boot-starter-social-linkedin, pkg:maven/org.springframework.boot/spring-boot-starter-social-twitter, pkg:maven/org.springframework.boot/spring-boot-starter-test, pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf, pkg:maven/org.springframework.boot/spring-boot-starter-tomcat, pkg:maven/org.springframework.boot/spring-boot-starter-undertow, pkg:maven/org.springframework.boot/spring-boot-starter-validation, pkg:maven/org.springframework.boot/spring-boot-starter-web, pkg:maven/org.springframework.boot/spring-boot-starter-web-services, pkg:maven/org.springframework.boot/spring-boot-starter-webflux, pkg:maven/org.springframework.boot/spring-boot-starter-websocket, pkg:maven/org.springframework.boot/spring-boot-starters, pkg:maven/org.springframework.boot/spring-boot-test, pkg:maven/org.springframework.boot/spring-boot-test-autoconfigure, pkg:maven/org.springframework.boot/spring-boot-testcontainers, pkg:maven/org.springframework.boot/spring-boot-tools, pkg:maven/org.springframework.cloud/spring-cloud-contract-converters, pkg:maven/org.springframework.cloud/spring-cloud-contract-dependencies, pkg:maven/org.springframework.cloud/spring-cloud-contract-docs, pkg:maven/org.springframework.cloud/spring-cloud-contract-gradle-plugin, pkg:maven/org.springframework.cloud/spring-cloud-contract-maven-plugin, pkg:maven/org.springframework.cloud/spring-cloud-contract-parent, pkg:maven/org.springframework.cloud/spring-cloud-contract-shade, pkg:maven/org.springframework.cloud/spring-cloud-contract-spec, pkg:maven/org.springframework.cloud/spring-cloud-contract-spec-groovy, pkg:maven/org.springframework.cloud/spring-cloud-contract-spec-java, pkg:maven/org.springframework.cloud/spring-cloud-contract-spec-kotlin, pkg:maven/org.springframework.cloud/spring-cloud-contract-starters, pkg:maven/org.springframework.cloud/spring-cloud-contract-stub-runner, pkg:maven/org.springframework.cloud/spring-cloud-contract-stub-runner-boot, pkg:maven/org.springframework.cloud/spring-cloud-contract-tools, pkg:maven/org.springframework.cloud/spring-cloud-contract-verifier, pkg:maven/org.springframework.cloud/spring-cloud-contract-wiremock, pkg:maven/org.springframework.cloud/spring-cloud-dataflow-apps-docs-plugin, pkg:maven/org.springframework.cloud/spring-cloud-dataflow-apps-generator-plugin, pkg:maven/org.springframework.cloud/spring-cloud-dataflow-apps-metadata-plugin, pkg:maven/org.springframework.cloud/spring-cloud-dataflow-apps-plugin-parent, pkg:maven/org.springframework.cloud/spring-cloud-dependencies, pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-aws, pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-azure, pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-azure-web, pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp, pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-parent, pkg:maven/org.springframework.cloud/spring-cloud-function-context, pkg:maven/org.springframework.cloud/spring-cloud-function-core, pkg:maven/org.springframework.cloud/spring-cloud-function-dependencies, pkg:maven/org.springframework.cloud/spring-cloud-function-deployer, pkg:maven/org.springframework.cloud/spring-cloud-function-docs, pkg:maven/org.springframework.cloud/spring-cloud-function-grpc, pkg:maven/org.springframework.cloud/spring-cloud-function-grpc-cloudevent-ext, pkg:maven/org.springframework.cloud/spring-cloud-function-integration, pkg:maven/org.springframework.cloud/spring-cloud-function-kotlin, pkg:maven/org.springframework.cloud/spring-cloud-function-parent, pkg:maven/org.springframework.cloud/spring-cloud-function-rsocket, pkg:maven/org.springframework.cloud/spring-cloud-function-serverless-web, pkg:maven/org.springframework.cloud/spring-cloud-function-web, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-client-autoconfig, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-client-config, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-client-discovery, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-client-loadbalancer, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-commons, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-configserver, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-configuration-watcher, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-controllers, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-dependencies, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-discovery, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-discoveryserver, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-docs, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-fabric8-autoconfig, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-fabric8-config, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-fabric8-discovery, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-fabric8-istio, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-fabric8-leader, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-fabric8-loadbalancer, pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-test-support, pkg:maven/org.springframework.cloud/spring-cloud-open-service-broker, pkg:maven/org.springframework.cloud/spring-cloud-open-service-broker-autoconfigure, pkg:maven/org.springframework.cloud/spring-cloud-open-service-broker-core, pkg:maven/org.springframework.cloud/spring-cloud-starter-build, pkg:maven/org.springframework.cloud/spring-cloud-starter-contract-stub-runner, pkg:maven/org.springframework.cloud/spring-cloud-starter-contract-stub-runner-jetty, pkg:maven/org.springframework.cloud/spring-cloud-starter-contract-verifier, pkg:maven/org.springframework.cloud/spring-cloud-starter-docs, pkg:maven/org.springframework.cloud/spring-cloud-starter-function-web, pkg:maven/org.springframework.cloud/spring-cloud-starter-function-webflux, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-client, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-client-all, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-client-config, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-client-loadbalancer, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-discoveryclient, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-fabric8, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-fabric8-all, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-fabric8-config, pkg:maven/org.springframework.cloud/spring-cloud-starter-kubernetes-fabric8-loadbalancer, pkg:maven/org.springframework.cloud/spring-cloud-starter-open-service-broker, pkg:maven/org.springframework.cloud/spring-cloud-starter-parent, pkg:maven/org.springframework.cloud/spring-cloud-starter-vault-config, pkg:maven/org.springframework.cloud/spring-cloud-starter-zookeeper, pkg:maven/org.springframework.cloud/spring-cloud-starter-zookeeper-all, pkg:maven/org.springframework.cloud/spring-cloud-starter-zookeeper-config, pkg:maven/org.springframework.cloud/spring-cloud-starter-zookeeper-discovery, pkg:maven/org.springframework.cloud/spring-cloud-vault-config, pkg:maven/org.springframework.cloud/spring-cloud-vault-config-aws, pkg:maven/org.springframework.cloud/spring-cloud-vault-config-consul, pkg:maven/org.springframework.cloud/spring-cloud-vault-config-databases, pkg:maven/org.springframework.cloud/spring-cloud-vault-config-rabbitmq, pkg:maven/org.springframework.cloud/spring-cloud-vault-dependencies, pkg:maven/org.springframework.cloud/spring-cloud-vault-docs, pkg:maven/org.springframework.cloud/spring-cloud-vault-parent, pkg:maven/org.springframework.cloud/spring-cloud-zookeeper, pkg:maven/org.springframework.cloud/spring-cloud-zookeeper-config, pkg:maven/org.springframework.cloud/spring-cloud-zookeeper-core, pkg:maven/org.springframework.cloud/spring-cloud-zookeeper-dependencies, pkg:maven/org.springframework.cloud/spring-cloud-zookeeper-discovery, pkg:maven/org.springframework.cloud/spring-cloud-zookeeper-docs, pkg:maven/org.springframework.data/spring-cql, pkg:maven/org.springframework.data/spring-data-bom, pkg:maven/org.springframework.data/spring-data-cassandra, pkg:maven/org.springframework.data/spring-data-cassandra-distribution, pkg:maven/org.springframework.data/spring-data-cassandra-parent, pkg:maven/org.springframework.data/spring-data-commons, pkg:maven/org.springframework.data/spring-data-commons-core, pkg:maven/org.springframework.data/spring-data-commons-dist, pkg:maven/org.springframework.data/spring-data-commons-parent, pkg:maven/org.springframework.data/spring-data-couchbase, pkg:maven/org.springframework.data/spring-data-elasticsearch, pkg:maven/org.springframework.data/spring-data-envers, pkg:maven/org.springframework.data/spring-data-gemfire, pkg:maven/org.springframework.data/spring-data-gemfire-test, pkg:maven/org.springframework.data/spring-data-geode, pkg:maven/org.springframework.data/spring-data-geode-distribution, pkg:maven/org.springframework.data/spring-data-geode-parent, pkg:maven/org.springframework.data/spring-data-geode-test, pkg:maven/org.springframework.data/spring-data-graph-core, pkg:maven/org.springframework.data/spring-data-graph-dist, pkg:maven/org.springframework.data/spring-data-graph-parent, pkg:maven/org.springframework.data/spring-data-hadoop, pkg:maven/org.springframework.data/spring-data-hadoop-batch, pkg:maven/org.springframework.data/spring-data-hadoop-boot, pkg:maven/org.springframework.data/spring-data-hadoop-build-tests, pkg:maven/org.springframework.data/spring-data-hadoop-cluster-tests, pkg:maven/org.springframework.data/spring-data-hadoop-config, pkg:maven/org.springframework.data/spring-data-hadoop-core, pkg:maven/org.springframework.data/spring-data-hadoop-hbase, pkg:maven/org.springframework.data/spring-data-hadoop-hive, pkg:maven/org.springframework.data/spring-data-hadoop-pig, pkg:maven/org.springframework.data/spring-data-hadoop-spark, pkg:maven/org.springframework.data/spring-data-hadoop-sqoop2, pkg:maven/org.springframework.data/spring-data-hadoop-store, pkg:maven/org.springframework.data/spring-data-hadoop-test, pkg:maven/org.springframework.data/spring-data-hadoop-util, pkg:maven/org.springframework.data/spring-data-jdbc, pkg:maven/org.springframework.data/spring-data-jdbc-core, pkg:maven/org.springframework.data/spring-data-jdbc-distribution, pkg:maven/org.springframework.data/spring-data-jpa, pkg:maven/org.springframework.data/spring-data-jpa-distribution, pkg:maven/org.springframework.data/spring-data-jpa-parent, pkg:maven/org.springframework.data/spring-data-keyvalue, pkg:maven/org.springframework.data/spring-data-ldap, pkg:maven/org.springframework.data/spring-data-mongodb, pkg:maven/org.springframework.data/spring-data-mongodb-cross-store, pkg:maven/org.springframework.data/spring-data-mongodb-dist, pkg:maven/org.springframework.data/spring-data-mongodb-distribution, pkg:maven/org.springframework.data/spring-data-mongodb-log4j, pkg:maven/org.springframework.data/spring-data-mongodb-parent, pkg:maven/org.springframework.data/spring-data-neo4j, pkg:maven/org.springframework.data/spring-data-neo4j-aspects, pkg:maven/org.springframework.data/spring-data-neo4j-cross-store, pkg:maven/org.springframework.data/spring-data-neo4j-dist, pkg:maven/org.springframework.data/spring-data-neo4j-distribution, pkg:maven/org.springframework.data/spring-data-neo4j-parent, pkg:maven/org.springframework.data/spring-data-neo4j-rest, pkg:maven/org.springframework.data/spring-data-neo4j-tx, pkg:maven/org.springframework.data/spring-data-oracle, pkg:maven/org.springframework.data/spring-data-r2dbc, pkg:maven/org.springframework.data/spring-data-redis, pkg:maven/org.springframework.data/spring-data-relational, pkg:maven/org.springframework.data/spring-data-relational-parent, pkg:maven/org.springframework.data/spring-data-releasetrain, pkg:maven/org.springframework.data/spring-data-rest-core, pkg:maven/org.springframework.data/spring-data-rest-distribution, pkg:maven/org.springframework.data/spring-data-rest-hal-browser, pkg:maven/org.springframework.data/spring-data-rest-hal-explorer, pkg:maven/org.springframework.data/spring-data-rest-parent, pkg:maven/org.springframework.data/spring-data-rest-repository, pkg:maven/org.springframework.data/spring-data-rest-webmvc, pkg:maven/org.springframework.data/spring-data-solr, pkg:maven/org.springframework.data/spring-yarn, pkg:maven/org.springframework.data/spring-yarn-batch, pkg:maven/org.springframework.data/spring-yarn-boot, pkg:maven/org.springframework.data/spring-yarn-boot-build-tests, pkg:maven/org.springframework.data/spring-yarn-boot-cli, pkg:maven/org.springframework.data/spring-yarn-boot-test, pkg:maven/org.springframework.data/spring-yarn-build-tests, pkg:maven/org.springframework.data/spring-yarn-core, pkg:maven/org.springframework.data/spring-yarn-integration, pkg:maven/org.springframework.data/spring-yarn-test, pkg:maven/xmlpull/xmlpull, pkg:npm/marked, pkg:pypi/torchmetrics, pkg:pypi/matplotlib

Scanned Files

• .github/workflows/merge-bot.yml
• .github/workflows/pr-title-semantic-lint.yml
• .github/workflows/renovate-jest-snap-updater.yml
• package.json
• packages/cli-e2e/npm-shim/package-lock.json
• packages/cli-e2e/package.json
• packages/cli/commons-dev/package.json
• packages/cli/commons/package.json
• packages/cli/core/package.json
• packages/cli/source/package.json
• packages/ui/angular/package.json
• packages/ui/atomic/health-check/package.json
• packages/ui/cra-template/package.json
• packages/ui/search-token-server/package.json
• packages/ui/vue/create-headless-vue/template/package.json
• utils/release/package.json
• utils/verdaccio-starter/package.json

[github-actions]

Pull Request Report

PR Title

✅ Title follows the conventional commit spec.

[renovate-coveo]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn Unknown project config "always-auth" (//coveo-aws-mac-730335515452.d.codeartifact.us-east-1.amazonaws.com/npm/coveo-private/:always-auth). This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn Unknown project config "always-auth" (//coveo-021891587241.d.codeartifact.us-east-1.amazonaws.com/npm/development/:always-auth). This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn Unknown project config "always-auth" (//coveo-021891587241.d.codeartifact.us-east-1.amazonaws.com/npm/release/:always-auth). This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @coveo/headless@3.45.0
npm error Found: typescript@4.9.5
npm error node_modules/typescript
npm error   dev typescript@"4.9.5" from the root project
npm error   typescript@"^4.6.4 || ^5.0.0" from @commitlint/load@17.5.0
npm error   node_modules/@commitlint/load
npm error     optional @commitlint/load@">6.1.1" from cz-conventional-changelog@3.3.0
npm error     node_modules/cz-conventional-changelog
npm error       dev cz-conventional-changelog@"3.3.0" from the root project
npm error       1 more (commitizen)
npm error   31 more (@puppeteer/browsers, @volar/typescript, ...)
npm error
npm error Could not resolve dependency:
npm error peerOptional typescript@">=5.0.0" from @coveo/headless@3.45.0
npm error node_modules/@coveo/headless
npm error   dev @coveo/headless@"latest" from @coveo/angular@1.36.16
npm error   packages/ui/angular
npm error     @coveo/angular@1.36.16
npm error     node_modules/@coveo/angular
npm error       workspace packages/ui/angular from the root project
npm error       1 more (@coveo/cli)
npm error   dev @coveo/headless@"latest" from @coveo/cra-template@1.38.25
npm error   packages/ui/cra-template
npm error     @coveo/cra-template@1.38.25
npm error     node_modules/@coveo/cra-template
npm error       workspace packages/ui/cra-template from the root project
npm error       1 more (@coveo/cli)
npm error
npm error Conflicting peer dependency: typescript@5.9.3
npm error node_modules/typescript
npm error   peerOptional typescript@">=5.0.0" from @coveo/headless@3.45.0
npm error   node_modules/@coveo/headless
npm error     dev @coveo/headless@"latest" from @coveo/angular@1.36.16
npm error     packages/ui/angular
npm error       @coveo/angular@1.36.16
npm error       node_modules/@coveo/angular
npm error         workspace packages/ui/angular from the root project
npm error         1 more (@coveo/cli)
npm error     dev @coveo/headless@"latest" from @coveo/cra-template@1.38.25
npm error     packages/ui/cra-template
npm error       @coveo/cra-template@1.38.25
npm error       node_modules/@coveo/cra-template
npm error         workspace packages/ui/cra-template from the root project
npm error         1 more (@coveo/cli)
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /tmp/cache/renovate-0/others/npm/_logs/2026-02-20T05_11_26_835Z-eresolve-report.txt
npm error A complete log of this run can be found in: /tmp/cache/renovate-0/others/npm/_logs/2026-02-20T05_11_26_835Z-debug-0.log