Skip to content

Bump the all group across 2 directories with 5 updates - #2553

Merged
sk593 merged 2 commits into
edgefrom
dependabot/npm_and_yarn/samples/demo/edge/all-f0806e25a9
May 4, 2026
Merged

Bump the all group across 2 directories with 5 updates#2553
sk593 merged 2 commits into
edgefrom
dependabot/npm_and_yarn/samples/demo/edge/all-f0806e25a9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all group with 2 updates in the /samples/demo directory: @dapr/dapr and mongodb.
Bumps the all group with 3 updates in the /samples/demo/client directory: react-router, react-router-dom and vite.

Updates @dapr/dapr from 3.6.1 to 3.17.0

Release notes

Sourced from @​dapr/dapr's releases.

v3.17.0

What's Changed

Going forward, the JS SDK will retain the major version of 3 as that decision has already been made, but the minor version will track with the runtime release it corresponds with from a feature compatibility perspective, and the zero-based patch number will reflect new changes since the latest release of the SDK. In other words, as this marks the first release of the JS SDK since the 1.17 release of the Dapr runtime, it's released as 3.17.0.

The dapr-client package at NPM has been marked as deprecated for several releases now and I'm pulling the plug in it. Going forward, please use the @​dapr/dapr package instead (as you likely already have been doing).

Bug Fixes

Infrastructure Changes

The CNCF gave Dapr access to GitHub Enterprise and with it, a bunch of LLM tokens, so I took the opportunity this release to give several of the different models an experimental spin and evaluate how well each one worked for different ideas I wanted to add to this project. Several of these PRs took several iterations to get right, but each is backed by unit and integration tests and I've personally reviewed every line of code that was merged into the SDK. I intend to keep experimenting with these capabilities and to keep contributing my own PRs, but I think LLMs represent an opportunity to augment software engineers' creativity and skill and look forward to iterating on new functionality in the SDK at a faster clip as a result.

A huge thank you to everyone that participated in this release!

New Contributors

... (truncated)

Commits
  • 32ef932 chore(deps): Bump minimatch from 3.1.2 to 3.1.5 in /examples/http/actor (#764)
  • c649a63 feat: bump TypeScript to 5.x and target ES2022 (#766)
  • 1754c78 feat: bump @​grpc/grpc-js minimum from ^1.9.3 to ^1.12.5 (#767)
  • c467e0e chore(deps): Bump protobufjs from 7.4.0 to 7.5.5 (#765)
  • 7f2c837 chore(deps-dev): Bump minimatch from 3.0.4 to 3.1.5 in /examples/pubsub (#761)
  • 37d009d chore(deps): Bump google.golang.org/grpc from 1.56.3 to 1.79.3 in /examples/g...
  • 512ef72 chore(deps-dev): Bump flatted from 3.2.9 to 3.4.2 (#760)
  • a8b44e7 feat: Windows build support + Buf proto migration (rebased from PR #745) (#752)
  • 5e855e1 chore(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 (#759)
  • 79c3822 chore(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 in /examples/grpc/hello-w...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​dapr/dapr since your current version.


Updates mongodb from 7.1.1 to 7.2.0

Release notes

Sourced from mongodb's releases.

v7.2.0

7.2.0 (2026-04-17)

The MongoDB Node.js team is pleased to announce version 7.2.0 of the mongodb package!

Release Notes

⚙️ Added support for MongoDB's Intelligent Workload Management

Added support for MongoDB's Intelligent Workload Management (IWM) and ingress connection rate limiting features. The driver now gracefully handles write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability.

Two new client options are available:

  • maxAdaptiveRetries (default: 2) - configures the maximum number of retries during server overload. Set to 0 to disable overload retries.
  • enableOverloadRetargeting (default: false) - when enabled, the driver will deprioritize servers that return overload errors during retry server selection.

🧩 Runtime and platform compatibility improvements

Node-specific platform APIs replaced with standards-based equivalents

The following Node-specific APIs have been replaced with standards-based equivalents:

  • The driver now uses the standard Uint8Array APIs instead of the Node‑specific Buffer APIs.
  • The driver now uses the standard Web Crypto API globalThis.crypto instead of the Node‑specific crypto API.

These changes reduce the number of patches required to run the driver outside of Node.js and improve compatibility with non-Node.js runtimes.

Experimental Support for Dependency Injection of Nodejs Runtime Dependencies

This release introduces a new MongoClient option, runtimeAdapters. runtimeAdapters allows injection of core Nodejs APIs, to allow users of the driver to use alternative runtimes that don't support Nodejs compatibility or work in restricted environments.

[!WARNING] runtimeAdapters is experimental and the actual interface of each dependency might change at any time.

Notes about usage of runtimeAdapters:

  1. If no runtimeAdapter is provided for a core Nodejs module that the driver uses, the driver will import the corresponding module from Nodejs.
  2. Adapters are per-client.
  3. Each adapter specifies the required APIs as a part of its Typescript API definition. There are no runtime checks to ensure all required functions are provided; the onus is on users to ensure that all required module dependencies are provided.
  4. The runtimeAdapters Typescript types currently rely on Nodejs' type definitions (@types/node). To use runtimeAdapters in a Typescript project, @types/node must be installed as well.
  5. When providing a module in runtimeAdapters, all required functions inside that module must be provided. For example, when injecting the os module, the platform() function cannot be omitted.
runtimeAdapters supports injecting Nodejs' os module

The os module is pluggable using runtimeAdapters:

const os: OsAdapter = {
  // implement the required OSAdapter interface
}
</tr></table>

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.2.0 (2026-04-17)

Features

  • NODE-7142: Exponential backoff and jitter in retry loops (#4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#4920) (2cc7983)

Bug Fixes

  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#4905) (f36b754)

7.1.0 (2026-02-02)

Features

  • NODE-5393: aws4 no longer required for AWS authentication (#4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#4821) (a4211e7)

Bug Fixes

  • NODE-7290: use valueof for error code check (#4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#4817) (b1b6e81)

7.0.0 (2025-11-06)

... (truncated)

Commits
  • 7e53685 chore(main): release 7.2.0 (#4861)
  • dbdd932 test(NODE-7540): run BSON compability tests against server version 8.0 (#4923)
  • fb70658 test(NODE-7538): ignore unknown fields in listIndexes (#4922)
  • affc3f9 docs: generate docs from latest main [skip-ci] (#4863)
  • 2cc7983 feat(NODE-7491): finalize client backpressure implementation for phase 1 roll...
  • 16a899d fix(NODE-7430): throw timeout error when withTransaction retries exceed dea...
  • 1fc0e09 test(NODE-7513): relax regression test for emptyGetMore (#4916)
  • 01eb278 ci: exclude spec files from copilot review (#4919)
  • 1cf791f test(NODE-7508): Fix inconsistent wording for prose retryable writes test 6, ...
  • f36b754 fix(NODE-7478): OIDC host allowlist fix (#4905)
  • Additional commits viewable in compare view

Updates react-router from 7.14.1 to 7.14.2

Release notes

Sourced from react-router's releases.

v7.14.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142

Changelog

Sourced from react-router's changelog.

v7.14.2

Patch Changes

  • Remove the un-documented custom error serialization logic from the internal turbo-stream implementation. React Router only automatically handles serialization of Error and it's standard subtypes (SyntaxError, TypeError, etc.). ([aabf4a1)

  • Properly handle parent middleware redirects during fetcher.load ([aabf4a1)

  • Remove redundant Omit<RouterProviderProps, "flushSync"> from react-router/dom RouterProvider ([aabf4a1)

  • Improved types for generatePath's param arg ([aabf4a1)

    Type errors when required params are omitted:

    // Before
// Passes type checks, but throws at runtime 💥
generatePath(":required", { required: null });
// After
generatePath(":required", { required: null });
//                          ^^^^^^^^ Type 'null' is not assignable to type 'string'.ts(2322)

    Allow omission of optional params:

    // Before
generatePath(":optional?", {});
//                         ^^ Property 'optional' is missing in type '{}' but required in type '{ optional: string | null | undefined; }'.ts(2741)
// After
generatePath(":optional?", {});

    Allows extra keys:

    // Before
generatePath(":a", { a: "1", b: "2" });
//                           ^ Object literal may only specify known properties, and 'b' does not exist in type '{ a: string; }'.ts(2353)
// After
generatePath(":a", { a: "1", b: "2" });

Commits

Updates react-router-dom from 7.14.1 to 7.14.2

Changelog

Sourced from react-router-dom's changelog.

v7.14.2

Patch Changes

Commits

Updates vite from 8.0.8 to 8.0.10

Release notes

Sourced from vite's releases.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.10 (2026-04-23)

Features

Bug Fixes

  • hmrClient.logger.debug and hmrClient.logger.error looked different from other HMR logs (#22147) (a4d828f)
  • css: show filename in CSS minification warnings for .css?inline (#22292) (83f0a78)
  • optimizer: allow user transform.target to override default in optimizeDeps (#22273) (5c7cec6)
  • remove format sniffing module resolution from JS resolver (#22297) (b8a21cc)

Code Refactoring

8.0.9 (2026-04-20)

Features

Bug Fixes

  • allow binding when strictPort is set but wildcard port is in use (#22150) (dfc8aa5)
  • build: emptyOutDir should happen for watch rebuilds (#22207) (ee52267)
  • bundled-dev: reject requests to HMR patch files in non potentially trustworthy origins (#22269) (868f141)
  • css: use unique key for cssEntriesMap to prevent same-basename collision (#22039) (374bb5d)
  • deps: update all non-major dependencies (#22219) (4cd0d67)
  • deps: update all non-major dependencies (#22268) (c28e9c1)
  • detect Deno workspace root (fix #22237) (#22238) (1b793c0)
  • dev: handle errors in watchChange hook (#22188) (fc08bda)
  • optimizer: handle more chars that will be sanitized (#22208) (3f24533)
  • skip fallback sourcemap generation for ?raw imports (#22148) (3ec9cda)

Documentation

Miscellaneous Chores

  • deps: update dependency dotenv-expand to v13 (#22271) (0a3887d)
Commits
  • 32c2978 release: v8.0.10
  • a4d06d9 feat: update rolldown to 1.0.0-rc.17 (#22299)
  • a4d828f fix: hmrClient.logger.debug and hmrClient.logger.error looked different f...
  • 83f0a78 fix(css): show filename in CSS minification warnings for .css?inline (#22292)
  • b8a21cc fix: remove format sniffing module resolution from JS resolver (#22297)
  • 40a0847 refactor: typecheck client directory (#22284)
  • 5c7cec6 fix(optimizer): allow user transform.target to override default in optimizeDe...
  • 9437518 refactor: enable some typecheck rules (#22278)
  • ce729f5 release: v8.0.9
  • 605bb97 docs: update build CLI defaults (#22261)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 27, 2026
@dependabot
dependabot Bot requested review from a team as code owners April 27, 2026 00:45
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 27, 2026
@github-actions

github-actions Bot commented Apr 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 2 packages with OpenSSF Scorecard issues.
See the Details below.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@emnapi/core 1.10.0 ⚠️ 3.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1024 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/runtime 1.10.0 ⚠️ 3.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1024 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@oxc-project/types 0.127.0 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-wasm32-wasi 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.0.0-rc.17 UnknownUnknown
npm/@rolldown/pluginutils 1.0.0-rc.17 UnknownUnknown
npm/nanoid 3.3.12 🟢 6.6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 10all dependencies are pinned
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 1Found 4/30 approved changesets -- score normalized to 1
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
npm/postcss 8.5.13 🟢 6
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 3branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 7SAST tool is not run on all commits -- score normalized to 7
npm/react-router 7.14.2 🟢 5.1
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 1Found 4/30 approved changesets -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/react-router-dom 7.14.2 🟢 5.1
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 1Found 4/30 approved changesets -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/rolldown 1.0.0-rc.17 UnknownUnknown
npm/tinyglobby 0.2.16 UnknownUnknown
npm/vite 8.0.10 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 20/26 approved changesets -- score normalized to 7
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 5detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 5binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
npm/@bufbuild/protobuf 2.12.0 UnknownUnknown
npm/@connectrpc/connect 2.1.1 UnknownUnknown
npm/@connectrpc/connect-node 2.1.1 UnknownUnknown
npm/@connectrpc/connect-web 2.1.1 UnknownUnknown
npm/@dapr/dapr 3.17.0 🟢 5.6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 7Found 3/4 approved changesets -- score normalized to 7
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Pinned-Dependencies⚠️ 3dependency not pinned by hash detected -- score normalized to 3
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@dapr/durabletask-js 1.0.0 UnknownUnknown
npm/mongodb 7.2.0 🟢 6.2
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 9SAST tool detected but not run on all commits
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed

Scanned Files

  • samples/demo/client/package-lock.json
  • samples/demo/package-lock.json

@dependabot
Bump the all group across 2 directories with 5 updates
94f1a7f 
Bumps the all group with 2 updates in the /samples/demo directory: [@dapr/dapr](https://github.com/dapr/js-sdk/tree/HEAD) and [mongodb](https://github.com/mongodb/node-mongodb-native).
Bumps the all group with 3 updates in the /samples/demo/client directory: [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router), [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@dapr/dapr` from 3.6.1 to 3.17.0
- [Release notes](https://github.com/dapr/js-sdk/releases)
- [Changelog](https://github.com/dapr/js-sdk/blob/main/CHANGELOG.md)
- [Commits](https://github.com/dapr/js-sdk/commits/v3.17.0)

Updates `mongodb` from 7.1.1 to 7.2.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.1.1...v7.2.0)

Updates `react-router` from 7.14.1 to 7.14.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.14.2/packages/react-router)

Updates `react-router-dom` from 7.14.1 to 7.14.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.14.2/packages/react-router-dom)

Updates `vite` from 8.0.8 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite)

---
updated-dependencies:
- dependency-name: "@dapr/dapr"
  dependency-version: 3.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: mongodb
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: react-router
  dependency-version: 7.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: react-router-dom
  dependency-version: 7.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: vite
  dependency-version: 8.0.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/samples/demo/edge/all-f0806e25a9 branch from 8056432 to 94f1a7f Compare May 4, 2026 00:48
@sk593
sk593 merged commit d05ee88 into edge May 4, 2026
12 checks passed
@sk593
sk593 deleted the dependabot/npm_and_yarn/samples/demo/edge/all-f0806e25a9 branch May 4, 2026 22:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@sk593 sk593 sk593 approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sk593