Skip to content

Deps: Bump the patch-updates group across 1 directory with 13 updates - #5747

Merged
greenbonebot merged 3 commits into
mainfrom
dependabot/npm_and_yarn/main/patch-updates-0d70fd8883
Nov 4, 2026
Merged

Deps: Bump the patch-updates group across 1 directory with 13 updates#5747
greenbonebot merged 3 commits into
mainfrom
dependabot/npm_and_yarn/main/patch-updates-0d70fd8883

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026 •
edited by daniele-mng
Loading

Copy link
Copy Markdown
Contributor

Bumps the patch-updates group with 13 updates in the / directory:

Package From To
@dnd-kit/helpers 0.5.0 0.5.1
@dnd-kit/react 0.5.0 0.5.1
i18next-http-backend 4.0.4 4.0.6
uuid 14.0.2 14.0.3
@testing-library/user-event 14.6.7 14.6.8
@types/node 26.6.4 26.6.5
@vitest/coverage-v8 5.0.3 5.0.5
jsdom 30.1.2 30.1.3
oxlint-tsgolint 7.0.2003 7.0.2005
vite 8.3.3 8.3.5
vitest 5.0.3 5.0.5

Updates @dnd-kit/helpers from 0.5.0 to 0.5.1

Release notes

Sourced from @​dnd-kit/helpers's releases.

@​dnd-kit/helpers@​0.5.1

Patch Changes

  • Updated dependencies [69987d5]:
    • @​dnd-kit/abstract@​0.5.1
Commits
  • 01bc678 Merge pull request #2093 from clauderic/changeset-release/main
  • ca647ab Version Packages
  • 29b622f Merge pull request #2115 from MGPOCKY/fix/ci-node-version-mismatch
  • bbf1b4d Merge pull request #2151 from cpruijsen/fix/issue-2144
  • 7514377 Merge pull request #2142 from chasegiunta/fix/retain-feedback-styles
  • 51da204 Merge pull request #2152 from Bhavani2016/fix/firefox-drag-outside-click
  • 431a9e7 Merge pull request #2140 from Zencron/docs-use-correct-property
  • 56dc217 Merge pull request #2149 from ManiShah7/fix/sortable-initial-index
  • 5549a0a Merge pull request #2153 from pedroapfilho/fix/accessibility-aria-pressed-role
  • a2b7ccd Merge branch 'main' into fix/ci-node-version-mismatch
  • Additional commits viewable in compare view

Updates @dnd-kit/react from 0.5.0 to 0.5.1

Release notes

Sourced from @​dnd-kit/react's releases.

@​dnd-kit/react@​0.5.1

Patch Changes

  • #2135 5185c8f Thanks @​kimjunha1231! - Fix missing state updates when draggable, droppable, or sortable properties are first read on a later render in React, Vue, Solid, and Svelte. Retain signal subscriptions across view updates and prevent update loops for getters that return new objects.

  • #2131 037663b Thanks @​NektarTheo! - Respect transition: null in the React, Vue, Solid and Svelte sortable bindings. The bindings previously merged defaultSortableTransition before constructing or updating the core Sortable, which replaced an explicit null with the default transition, so sortable items kept animating. They now use the new resolveSortableTransition helper exported from @dnd-kit/dom/sortable, which preserves null while still merging partial transitions with the defaults.

  • Updated dependencies [22a39ef, d3f965f, 69987d5, e00be08, cf4fb8a, d5071ec, 8a1c807, bce5778, 037663b, 3ff8588]:

    • @​dnd-kit/dom@​0.5.1
    • @​dnd-kit/abstract@​0.5.1
    • @​dnd-kit/state@​0.5.1
Commits
  • 01bc678 Merge pull request #2093 from clauderic/changeset-release/main
  • ca647ab Version Packages
  • 29b622f Merge pull request #2115 from MGPOCKY/fix/ci-node-version-mismatch
  • bbf1b4d Merge pull request #2151 from cpruijsen/fix/issue-2144
  • 7514377 Merge pull request #2142 from chasegiunta/fix/retain-feedback-styles
  • 51da204 Merge pull request #2152 from Bhavani2016/fix/firefox-drag-outside-click
  • 431a9e7 Merge pull request #2140 from Zencron/docs-use-correct-property
  • 56dc217 Merge pull request #2149 from ManiShah7/fix/sortable-initial-index
  • 5549a0a Merge pull request #2153 from pedroapfilho/fix/accessibility-aria-pressed-role
  • a2b7ccd Merge branch 'main' into fix/ci-node-version-mismatch
  • Additional commits viewable in compare view

Updates i18next-http-backend from 4.0.4 to 4.0.6

Changelog

Sourced from i18next-http-backend's changelog.

4.0.6

  • fix: when XMLHttpRequest throws synchronously (open() with an invalid URL, setRequestHeader() with an invalid customHeaders name, send()), the error is now passed to the callback. It was only logged with console.log, so the load never finished and i18next init() did not resolve. Now i18next takes its usual failed-load path. The XHR path is used when no fetch is available and for file: URLs. An XHR that completes inside send() (some polyfills and fake XHRs) is not called back a second time when its callback throws. Thanks @​lprnmns (#203)

4.0.5

  • fix: a loadPath function whose promise rejects now reports the error to i18next. The read callback was never called, so init() / loadNamespaces() never settled (a react-i18next Suspense fallback stayed up for good) and in Node the unhandled rejection ended the process. i18next now takes its usual failed-load path (failedLoading event, "loading namespace ... failed" log) and init() resolves. The error is passed on without retry, like the other non-network errors. Thanks @​nk-batman21 (#201)
Commits

Updates uuid from 14.0.2 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @testing-library/user-event from 14.6.7 to 14.6.8

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

  • treat programmatic null input values as empty string (#1329) (1951eb7)
Commits

Updates @types/node from 26.6.4 to 26.6.5

Commits

Updates @vitest/coverage-v8 from 5.0.3 to 5.0.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates jsdom from 30.1.2 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

  • Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
  • Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
  • Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
  • Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
  • Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
  • Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
  • Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
  • Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
  • Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
  • Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
  • Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
  • Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
  • Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
  • Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)
Commits
  • 058c0f5 30.1.3
  • fcd1fd1 Cascade parsed longhands independently
  • a3ee786 Cascade computed style properties on demand
  • f42dc15 Resolve colors before caching or using currentcolor
  • 074b1fb Compute background-position lengths against the final font size
  • d19598c Apply style rules nested in multiple @​media rules
  • 45d626c Rule out attribute selector subjects before matching
  • 3ff0a5b Upgrade Undici and remove abort workarounds
  • 8813bb1 Ignore CSS declarations with unparseable math functions
  • 63712d8 Fix XHR credentials across redirects
  • Additional commits viewable in compare view

Updates oxlint-tsgolint from 7.0.2003 to 7.0.2005

Release notes

Sourced from oxlint-tsgolint's releases.

v7.0.2005

What's Changed

New Contributors

Full Changelog: oxc-project/tsgolint@v7.0.2004...v7.0.2005

v7.0.2004

What's Changed

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner November 1, 2026 03:05
@dependabot dependabot Bot added the javascript Pull requests that update Javascript code label Nov 1, 2026
@greenbonebot
greenbonebot enabled auto-merge (rebase) November 1, 2026 03:06
@github-actions

github-actions Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 18854ac.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@asamuzakjp/dom-selector 10.0.5 UnknownUnknown
npm/@dnd-kit/abstract 0.5.1 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 11/12 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@dnd-kit/collision 0.5.1 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 11/12 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@dnd-kit/dom 0.5.1 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 11/12 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@dnd-kit/geometry 0.5.1 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 11/12 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@dnd-kit/helpers 0.5.1 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 11/12 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@dnd-kit/react 0.5.1 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 11/12 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@dnd-kit/state 0.5.1 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 11/12 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@rolldown/binding-android-arm-eabi 1.2.15 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.2.15 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.2.15 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.2.15 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.2.15 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.2.15 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.2.15 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.2.15 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.2.15 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.2.15 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.2.15 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.2.15 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.2.15 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.2.15 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.2.15 UnknownUnknown
npm/@testing-library/user-event 14.6.8 🟢 4.7
Details
CheckScoreReason
Code-Review🟢 4Found 12/29 approved changesets -- score normalized to 4
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1013 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@types/node 26.6.5 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 27/30 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@vitest/coverage-v8 5.0.5 UnknownUnknown
npm/@vitest/istanbul-lib-coverage 1.0.2 UnknownUnknown
npm/@vitest/istanbul-lib-report 1.0.2 UnknownUnknown
npm/@vitest/mocker 5.0.5 UnknownUnknown
npm/@vitest/spy 5.0.5 UnknownUnknown
npm/ast-v8-to-istanbul 1.0.7 UnknownUnknown
npm/chai 6.3.0 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 6Found 6/9 approved changesets -- score normalized to 6
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/i18next-http-backend 4.0.6 🟢 4.6
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 1Found 3/27 approved changesets -- score normalized to 1
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/jsdom 30.1.3 🟢 6.8
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/nanoid 3.3.20 🟢 6.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 2Found 8/30 approved changesets -- score normalized to 2
Security-Policy🟢 10security policy file detected
Maintained🟢 1022 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/obug 3.0.0 UnknownUnknown
npm/postcss 8.5.32 🟢 7.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/rolldown 1.2.15 UnknownUnknown
npm/std-env 4.3.0 UnknownUnknown
npm/tinybench 6.2.2 UnknownUnknown
npm/tinyexec 1.3.1 UnknownUnknown
npm/tinyrainbow 3.2.0 UnknownUnknown
npm/uuid 14.0.3 🟢 4.5
Details
CheckScoreReason
Code-Review🟢 4Found 10/25 approved changesets -- score normalized to 4
Maintained🟢 1011 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
npm/vite 8.3.5 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 5Found 13/24 approved changesets -- score normalized to 5
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 7detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts⚠️ 1binaries present in source code
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
npm/vitest 5.0.5 UnknownUnknown

Scanned Files

  • package-lock.json

@dependabot dependabot Bot changed the title Deps: bump the patch-updates group with 13 updates Deps: Bump the patch-updates group across 1 directory with 13 updates Nov 4, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/main/patch-updates-0d70fd8883 branch 2 times, most recently from 2c92089 to 25b44d1 Compare November 4, 2026 07:28
@dependabot dependabot Bot changed the title Deps: Bump the patch-updates group across 1 directory with 13 updates Deps: bump the patch-updates group across 1 directory with 13 updates Nov 4, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/main/patch-updates-0d70fd8883 branch 2 times, most recently from 79cf67c to ba8bfc8 Compare November 4, 2026 08:07
@dependabot dependabot Bot changed the title Deps: bump the patch-updates group across 1 directory with 13 updates Deps: Bump the patch-updates group across 1 directory with 13 updates Nov 4, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/main/patch-updates-0d70fd8883 branch 3 times, most recently from 47018f5 to 3482ece Compare November 4, 2026 12:11
dependabot Bot and others added 2 commits November 4, 2026 16:12
@dependabot @daniele-mng
Deps: Bump the patch-updates group across 1 directory with 13 updates
c7b627d 
Bumps the patch-updates group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@dnd-kit/helpers](https://github.com/clauderic/dnd-kit) | `0.5.0` | `0.5.1` |
| [@dnd-kit/react](https://github.com/clauderic/dnd-kit) | `0.5.0` | `0.5.1` |
| [@mantine/dates](https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/dates) | `9.7.1` | `9.7.4` |
| [@mantine/notifications](https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/notifications) | `9.7.1` | `9.7.4` |
| [i18next-http-backend](https://github.com/i18next/i18next-http-backend) | `4.0.4` | `4.0.6` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.2` | `14.0.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.7` | `14.6.8` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.3` | `5.0.5` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.2` | `30.1.3` |
| [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2005` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.3` | `8.3.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` |

Updates `@dnd-kit/helpers` from 0.5.0 to 0.5.1
- [Release notes](https://github.com/clauderic/dnd-kit/releases)
- [Commits](https://github.com/clauderic/dnd-kit/compare/@dnd-kit/helpers@0.5.0...@dnd-kit/helpers@0.5.1)

Updates `@dnd-kit/react` from 0.5.0 to 0.5.1
- [Release notes](https://github.com/clauderic/dnd-kit/releases)
- [Commits](https://github.com/clauderic/dnd-kit/compare/@dnd-kit/react@0.5.0...@dnd-kit/react@0.5.1)

Updates `@mantine/dates` from 9.7.1 to 9.7.4
- [Release notes](https://github.com/mantinedev/mantine/releases)
- [Changelog](https://github.com/mantinedev/mantine/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mantinedev/mantine/commits/9.7.4/packages/@mantine/dates)

Updates `@mantine/notifications` from 9.7.1 to 9.7.4
- [Release notes](https://github.com/mantinedev/mantine/releases)
- [Changelog](https://github.com/mantinedev/mantine/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mantinedev/mantine/commits/9.7.4/packages/@mantine/notifications)

Updates `i18next-http-backend` from 4.0.4 to 4.0.6
- [Changelog](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-http-backend@v4.0.4...v4.0.6)

Updates `uuid` from 14.0.2 to 14.0.3
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.2...v14.0.3)

Updates `@testing-library/user-event` from 14.6.7 to 14.6.8
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.7...v14.6.8)

Updates `@types/node` from 26.6.4 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 5.0.3 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8)

Updates `jsdom` from 30.1.2 to 30.1.3
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.2...v30.1.3)

Updates `oxlint-tsgolint` from 7.0.2003 to 7.0.2005
- [Release notes](https://github.com/oxc-project/tsgolint/releases)
- [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2005)

Updates `vite` from 8.3.3 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

Updates `vitest` from 5.0.3 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@dnd-kit/helpers"
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@dnd-kit/react"
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@mantine/dates"
  dependency-version: 9.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@mantine/notifications"
  dependency-version: 9.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: i18next-http-backend
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: jsdom
  dependency-version: 30.1.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: oxlint-tsgolint
  dependency-version: 7.0.2005
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: uuid
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@daniele-mng
fix: failing test due to deps update
9b20da7
@daniele-mng
daniele-mng force-pushed the dependabot/npm_and_yarn/main/patch-updates-0d70fd8883 branch from 63a6cc9 to 9b20da7 Compare November 4, 2026 15:12
@greenbonebot
greenbonebot merged commit 8781917 into main Nov 4, 2026
28 checks passed
@greenbonebot
greenbonebot deleted the dependabot/npm_and_yarn/main/patch-updates-0d70fd8883 branch November 4, 2026 18:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@daniele-mng daniele-mng daniele-mng approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@daniele-mng @greenbonebot