chore(deps-dev): bump the dev-tooling group across 1 directory with 7 updates by dependabot[bot] · Pull Request #12 · yankikucuk/efatura

dependabot · 2026-09-26T21:43:22Z

Bumps the dev-tooling group with 7 updates in the / directory:

Package	From	To
@types/node	`26.4.1`	`26.6.2`
eslint	`10.9.1`	`10.11.0`
knip	`6.34.0`	`6.38.0`
lint-staged	`17.4.1`	`17.5.1`
prettier	`3.9.6`	`3.9.9`
tsx	`4.23.13`	`4.23.15`
typescript-eslint	`8.69.0`	`8.70.1`

Updates @types/node from 26.4.1 to 26.6.2

Commits

See full diff in compare view

Updates eslint from 10.9.1 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)

397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)

d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)

b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)

26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)

6c789ff docs: Update README (GitHub Actions Bot)

5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)

92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)

9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])

24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)

45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])

ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)

c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)

f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)

fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)

c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)

5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)

427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)

9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)

87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)

8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)

9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

2417cad docs: Update README (GitHub Actions Bot)

9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)

8724829 docs: update compat table links (#21263) (fnx)

5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)

1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits

3c0b7c6 10.11.0
321f0a7 Build: changelog update for 10.11.0
520dd77 perf: Implement fast paths in critical areas (#21210)
9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
24310e3 chore: update ecosystem plugins (#21324)
d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
Additional commits viewable in compare view

Updates knip from 6.34.0 to 6.38.0

Release notes

Sourced from knip's releases.

Release 6.38.0

Include co-authors in docs contributor list (0c334100df59d89a512ad598ec50e7f62f6da0c3)

Filter bots and agents from docs contributors (617f70d8179c6b8668ca41fe5df77ced5e2b37c0)

Update Eve plugin conventions (#2049) (260dbb91a85f3a3bc2727e8f255d73df3737552c) - thanks @matchai!

Add args example to that doc page (50b271b98fc930a05a3b045a2f691486f9f06528)

Add Turborepo plugin (#2055) (e49d3db05f1d69ce7db3efcb8467a4af63c27379) - thanks @changbaebang!

Support import-x/* settings in ESLint plugin (#2050) (1a34cf82a3d6a1202717ef910bedba55838e9dd9) - thanks @bytedoe!

Resolve file option in Mocha configuration files (#2051) (9b5c5f60468c8a92a3e74adca5c0931f008677af) - thanks @giaBaoJS!

Support oxlint extends (#2054) (a149a98219bb14b15f446fc5f8c4f815e28b2183) - thanks @matthewnitschke-wk!

Fix import.meta handling in built-in compilers (#2059) (8b0c85076bf3dce15ef5f3c0c4e58bfefdf59ded) - thanks @vdavid!

Fix tag hints for enum and namespace members (#2061) (8a8805e48945863248429d18b7f6c4e4b7dc9ebd) - thanks @devYRPauli!

Flag unused member tags in tagged enums and namespaces (584e53ff3e0846fbfe04fa5b5bfefe2420576a34)

feat: resolve MDX content mapper remarkPlugins (#2060) (34dbccf25359f9e9fefe9d0be6ef2ec0252223cc) - thanks @gioboa!

Refactor and separate concerns w/ new typescript-content-mapper plugin (11e94509bd0f350d747facf4003fc5b248d1b02d)

Resolve mdx content mapper providerImportSource (7b5825117f97f2f87b7141509a254f88d0957cf7)

Fix config → entry in plop plugin (25a380c9e1165b76583d69b48b5fa7cdf5db0ae2)

Release 6.37.0

fix(graphql-codegen): mark near-operation-file outputs as entries, not the documents directory (#2048) (06a68fcf99a90e559daeb0b8fb2d24e173124774) - thanks @RobHannay!

fix: enable JSX in the config loader (#1959) (5b21dc9192f773613d1c5db8edf35f0a68820268) - thanks @addielaruee!

Match binaries only to their actual dependency providers (c5bdb69ccbcb7e1056233f346d0ada3495d1013d)

Preserve executable references across package manager commands (54af171638db22f5d903faae05c37c2ea6adc869)

Correct binary provider metadata in Relay fixtures (e67dfcb96d055c27be9c8601e077656855bb632b)

Separate shell binary expectations from reporting exemptions (resolve #2022) (c1d7d75a3529d9faff7f4c0df11dd0ca1bdfb149)

Respect npx no-install flags before the executable (4237010c9a834eb8b04f4a528c76d10a5c38ee98)

Update dependencies (038ea179f7d6bf7ca43bc5daf553a68b13a9067c)

Remove npm auth check now that's in release-it (4aaf77c58004ac64063a1982b98e53107c2ebe93)

Fix --format name resolution in the ESLint plugin (#2046) (1269e98bb700384811fadc124d69ea720832037e) - thanks @bytedoe!

Release 6.36.0

Add @tailwindcss/webpack as Tailwind plugin enabler (#2027) (b5ac0cf734dda3c6c6c51c817981dfc558b7c582) - thanks @igas!

Fix Next.js Turbopack loader dependencies (23419b4edfd48796dd484fa880e1bad49a043d2e)

Explain ambiguous star exports in traces (#2025) (3c2c1a53f9c2b7ff3057a4e46761791979e0b09c) - thanks @gioboa!

Fix eslintrc parserOptions.parser handling in ESLint plugin (#2028) (c79463cec81d09518eda325ec00e6f12327dea8d) - thanks @bytedoe!

fix(compilers): require word boundary around import keyword (#2029) (68bbe51c39b564022b63942bc83cb570778cca00) - thanks @thanadolps!

fix: recover from corrupt cache file (#2034) (30ff7568c84e0a6731ca634a52314228d23d1a2b) - thanks @gioboa!

fix: fix trailing comma on dependency removal (#2033) (adfaf4f78878b6d55b0939a92d70a1fbb0ae1240) - thanks @gioboa!

Document built-in compiler scope (a05e155276dad4ead16992580d17572cebf045e7)

Add babel, khan and oxc to projects and optimize svgs (1c26560b98bc3109e93d15761d02f089213bfb6c)

Add section to test preview packages & extension (d911c18385f0aa41f53653a2a15cc90a1e0251b8)

Fix shared info/exclude handling in linked Git worktrees (#2037) (c1f18d5a7d25fc5a614747bbcbd62d043457eb48) - thanks @kenfdev!

Shard Node specs on Windows and enable Bun test parallelism (66e966b6edec4460b40b05847fefa9f90ee69068)

Add Varlock plugin support (#2000) (e4fbf46acff08e78370e72b142e795bd81f28561) - thanks @Joehoel!

Apply NODE_OPTIONS inputs to package manager binaries (#2038) (c8df8a28e9a19484efe7097f984abc0c6556aff5) - thanks @giaBaoJS!

Handle array form of import/resolver setting in ESLint plugin (#2041) (a80d386a80fdafc89c610d4887ec82184ac178db) - thanks @bytedoe!

fix(node): add valueless Node CLI flags to boolean options (#2042) (4c6768501f7115a894d7ece9e5c32090b684cc6f) - thanks @shoutoutuoadi325!

fix(typedoc): accept string form of plugin and theme options (#2043) (ce387b05c8f136546e860ec73e29557563c63afa) - thanks @giaBaoJS!

Add textlint plugin (#2039) (532dab595fc9a910e320418dc0390222fb2d7478) - thanks @anandghegde!

fix: Correctly resolve Vitest setupFiles from nested configs (#2040) (84a494334e125d229dc865893b21d69d0d201e85) - thanks @CruseCtrl!

Add n8n to projects (3f756a7e70c4164d57a7dbbd58f3604afe4043e2)

... (truncated)

Commits

c0e42f8 Release knip@6.38.0
25a380c Fix config → entry in plop plugin
7b58251 Resolve mdx content mapper providerImportSource
11e9450 Refactor and separate concerns w/ new typescript-content-mapper plugin
34dbccf feat: resolve MDX content mapper remarkPlugins (#2060)
584e53f Flag unused member tags in tagged enums and namespaces
8a8805e Fix tag hints for enum and namespace members (#2061)
8b0c850 Fix import.meta handling in built-in compilers (#2059)
a149a98 Support oxlint extends (#2054)
9b5c5f6 Resolve file option in Mocha configuration files (#2051)
Additional commits viewable in compare view

Updates lint-staged from 17.4.1 to 17.5.1

Release notes

Sourced from lint-staged's releases.

v17.5.1

Patch Changes

#1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

v17.5.0

Minor Changes

#1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

#1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

#1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

#1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

Changelog

Sourced from lint-staged's changelog.

17.5.1

Patch Changes

#1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

17.5.0

Minor Changes

#1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

#1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

#1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

#1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

Commits

f8b1ab1 Merge pull request #1853 from lint-staged/changeset-release/main
3b54961 chore(changeset): release
09317ff Merge pull request #1852 from lint-staged/fix-ambient-declaration
bfcca94 fix: change defineConfig signature from const to a function
dcb59f6 Merge pull request #1846 from lint-staged/changeset-release/main
9c8c6dc chore(changeset): release
586466f Merge pull request #1849 from lint-staged/improve-intent-to-add
45eda5f refactor: improve --intent-to-add detection
26372e3 Merge pull request #1848 from lint-staged/fix-color-detection
d718ccc fix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streams
Additional commits viewable in compare view

Updates prettier from 3.9.6 to 3.9.9

Release notes

Sourced from prettier's releases.

3.9.9

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @fisker)

🔗 Changelog

3.9.8

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)

🔗 Changelog

3.9.7

Support Angular 22.2

Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.9

diff

Markdown: Fix text with `$` been incorrectly parsed as math syntax (#20140 by `@fisker`)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by `@seiyab`)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by `@Austin1serb`, `@giaBaoJS`)

<!-- Input -->
- [x] short first line.
</tr></table>

... (truncated)

Commits

cdd17f2 Release 3.9.9
dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
f9be58f Git blame ignore 3.9.8
88470cb Bump Prettier dependency to 3.9.8
9559cab Clean changelog_unreleased
4fc8ee8 Update dependents count
4f2ab67 Release 3.9.8
3d82af8 Update Regex related dependencies (#20082)
5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
5b142ed Release Release @prettier/plugin-hermes@0.2.3, @prettier/plugin-oxc@0.2.3, an...
Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

exclude bare builtins from namespace inheritance (38e1588)

expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)

make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

npm package (@latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

npm package (@latest dist-tag)

Commits

ca66105 test: fix drive-less file URLs in ESM resolver fixtures
2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
38e1588 fix: exclude bare builtins from namespace inheritance
562c434 fix: make namespaced register() overloads portable for declaration emit
edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
70e7828 test: upgrade tinyspy for disposable API
9ed2022 ci: avoid duplicate release notifications
872e77f refactor: use disposables for cleanup
6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
See full diff in compare view

Updates typescript-eslint from 8.69.0 to 8.70.1

Release notes

Sourced from typescript-eslint's releases.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

ast-spec: narrow import attribute keys to identifiers and strings (#12879)

eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)

eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)

eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)

eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)

eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)

eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)

eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)

eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)

eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)

eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)

eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)

eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)

eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)

rule-tester: test the final autofix output instead of the first pass (#12867)

scope-manager: merge implicit global definitions (#12809)

type-utils: match package specifiers on whole path components (#12838)

typescript-estree: resolve symlinked paths when matching files to projects (#12725)

typescript-estree: add missing < token opening type arguments (#12821)

typescript-estree: require string literal import attribute values (#12894)

website: prevent playground from breaking down after opening link with the .js file type (#12777)

❤️ Thank You

Amin @amiin-dev

Brad Zacher @bradzacher

Cameron

Diptajoy Mistry @diptomistry

Evyatar Daud @StyleShit

Grit @Grit03

Hugo @hugop95

Josh Goldberg ✨

Michael Naumov @mnaoumov

Mikhail Baev @baevm

Om Rawat

overlookmotel

Sanath @sansynx

Shinji

stoicism @stoicism02

Vinccool96

Younsang Na @nayounsang

김채영 @cchaeyoung

송재욱

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.70.1 (2026-09-21)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

🩹 Fixes

eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

Ulrich Stark @ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

23d38ce chore(release): publish 8.70.1
eb42d9b chore: cleanup and fix Nx dependencies and missing tasks (#12897)
8c80531 chore: fix typos in comments and docs (#12846)
b6b86a1 chore: migrate to nx 23.2.0 (#12843)
7ee7608 chore(release): publish 8.70.0
4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates Bumps the dev-tooling group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.2` | | [eslint](https://github.com/eslint/eslint) | `10.9.1` | `10.11.0` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.34.0` | `6.38.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.4.1` | `17.5.1` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.69.0` | `8.70.1` | Updates `@types/node` from 26.4.1 to 26.6.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.9.1 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.9.1...v10.11.0) Updates `knip` from 6.34.0 to 6.38.0 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.38.0/packages/knip) Updates `lint-staged` from 17.4.1 to 17.5.1 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.4.1...v17.5.1) Updates `prettier` from 3.9.6 to 3.9.9 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.9) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `typescript-eslint` from 8.69.0 to 8.70.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-tooling - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-tooling - dependency-name: knip dependency-version: 6.38.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-tooling - dependency-name: lint-staged dependency-version: 17.5.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-tooling - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-tooling - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-tooling - dependency-name: typescript-eslint dependency-version: 8.70.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-tooling ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-26T21:43:34Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@cacheable/memory

2.2.0

Unknown

npm/@cacheable/utils

2.5.0

Unknown

npm/@eslint/plugin-kit

0.7.3

Unknown

npm/@keyv/bigmap

1.3.1

🟢 7.2

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	🟢 10	packaging workflow detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	⚠️ -1	internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.

npm/@keyv/serialize

1.1.1

🟢 7.2

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	🟢 10	packaging workflow detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	⚠️ -1	internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.

npm/@oxc-parser/binding-android-arm-eabi

0.150.0

Unknown

npm/@oxc-parser/binding-android-arm64

0.150.0

Unknown

npm/@oxc-parser/binding-darwin-arm64

0.150.0

Unknown

npm/@oxc-parser/binding-darwin-x64

0.150.0

Unknown

npm/@oxc-parser/binding-freebsd-x64

0.150.0

Unknown

npm/@oxc-parser/binding-linux-arm-gnueabihf

0.150.0

Unknown

npm/@oxc-parser/binding-linux-arm-musleabihf

0.150.0

Unknown

npm/@oxc-parser/binding-linux-arm64-gnu

0.150.0

Unknown

npm/@oxc-parser/binding-linux-arm64-musl

0.150.0

Unknown

npm/@oxc-parser/binding-linux-ppc64-gnu

0.150.0

Unknown

npm/@oxc-parser/binding-linux-riscv64-gnu

0.150.0

Unknown

npm/@oxc-parser/binding-linux-riscv64-musl

0.150.0

Unknown

npm/@oxc-parser/binding-linux-s390x-gnu

0.150.0

Unknown

npm/@oxc-parser/binding-linux-x64-gnu

0.150.0

Unknown

npm/@oxc-parser/binding-linux-x64-musl

0.150.0

Unknown

npm/@oxc-parser/binding-openharmony-arm64

0.150.0

Unknown

npm/@oxc-parser/binding-win32-arm64-msvc

0.150.0

Unknown

npm/@oxc-parser/binding-win32-ia32-msvc

0.150.0

Unknown

npm/@oxc-parser/binding-win32-x64-msvc

0.150.0

Unknown

npm/@oxc-project/types

0.150.0

Unknown

npm/@types/node

26.6.2

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 26/28 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@typescript-eslint/eslint-plugin

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/parser

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/project-service

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/scope-manager

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/tsconfig-utils

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/type-utils

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/types

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/typescript-estree

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/utils

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@typescript-eslint/visitor-keys

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/cacheable

2.5.0

Unknown

npm/eslint

10.11.0

🟢 6.4

Details

Check	Score	Reason
Code-Review	🟢 7	Found 21/27 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 9	SAST tool detected but not run on all commits

npm/file-entry-cache

11.1.5

Unknown

npm/flat-cache

6.1.23

Unknown

npm/hashery

1.5.1

Unknown

npm/hookified

1.15.1

Unknown

npm/hookified

2.2.0

Unknown

npm/ignore

7.0.10

🟢 3.8

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 2/29 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/keyv

5.6.0

🟢 7.2

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	🟢 10	packaging workflow detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	⚠️ -1	internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.

npm/knip

6.38.0

Unknown

npm/lint-staged

17.5.1

Unknown

npm/oxc-parser

0.150.0

Unknown

npm/prettier

3.9.9

🟢 5.6

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/21 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/qified

0.10.1

Unknown

npm/tsx

4.23.15

Unknown

npm/typescript-eslint

8.70.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/undici-types

8.9.0

🟢 8.1

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 8	binaries present in source code
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 6	4 existing vulnerabilities detected
SAST	🟢 9	SAST tool detected but not run on all commits
Packaging	🟢 10	packaging workflow detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 64 contributing companies or organizations

npm/yaml

2.9.1

🟢 7.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 2	Found 5/25 approved changesets -- score normalized to 2
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	🟢 9	SAST tool detected but not run on all commits

Scanned Files

package-lock.json

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 26, 2026

dependabot Bot requested a review from yankikucuk as a code owner September 26, 2026 21:43

dependabot Bot added javascript Pull requests that update javascript code dependencies Pull requests that update a dependency file labels Sep 26, 2026

Navigation Menu

chore(deps-dev): bump the dev-tooling group across 1 directory with 7 updates - #12

chore(deps-dev): bump the dev-tooling group across 1 directory with 7 updates#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-tooling-c493388a5a

dependabot Bot commented on behalf of github Sep 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.11.0

Features

Bug Fixes

Documentation

Chores

v10.10.0

Features

Bug Fixes

Documentation

Chores

Release 6.38.0

Release 6.37.0

Release 6.36.0

v17.5.1

Patch Changes

v17.5.0

Minor Changes

Patch Changes

17.5.1

Patch Changes

17.5.0

Minor Changes

Patch Changes

3.9.9

3.9.8

3.9.7

3.9.9

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

3.9.8

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

3.9.7

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

❤️ Thank You

8.70.1 (2026-09-21)

8.70.0 (2026-09-07)

🩹 Fixes

❤️ Thank You

Uh oh!

github-actions Bot commented Sep 26, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 26, 2026 •

edited

Loading

Markdown: Fix text with `$` been incorrectly parsed as math syntax (#20140 by `@fisker`)

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by `@seiyab`)

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by `@Austin1serb`, `@giaBaoJS`)