Skip to content

Bump the npm-dependencies group with 9 updates - #646

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-c4c74558fb
Closed

Bump the npm-dependencies group with 9 updates#646
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-c4c74558fb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 9 updates:

Package From To
@astrojs/compiler-rs 0.1.6 0.1.7
astro 6.1.6 6.1.7
postcss 8.5.9 8.5.10
prettier 3.8.2 3.8.3
puppeteer 24.40.0 24.41.0
resend 6.11.0 6.12.0
sanitize-html 2.17.2 2.17.3
stylelint 17.7.0 17.8.0
vercel 51.2.1 51.4.0

Updates @astrojs/compiler-rs from 0.1.6 to 0.1.7

Release notes

Sourced from @​astrojs/compiler-rs's releases.

@​astrojs/compiler-rs@​0.1.7

Patch Changes

  • 4c9a9ed: Fixes edge cases where certain niche types of expressions wouldn't properly compile
  • 1b17201: Fixes slots not working inside parenthesized conditional slots
  • cace524: Fixes the compiler sometimes adding extra whitespace between root elements when one of the root elements would be hoisted (e.g. style tags, scripts etc.)
  • 4ebb68d: Fixes slots not being collected inside optional chain expressions
  • dc9cbe4: Fixes scripts inside template elements not being rendered as-is
  • Updated dependencies [4c9a9ed]
  • Updated dependencies [1b17201]
  • Updated dependencies [cace524]
  • Updated dependencies [4ebb68d]
  • Updated dependencies [dc9cbe4]
    • @​astrojs/compiler-binding@​0.1.7
Commits
  • a316310 Version Packages (#23)
  • cace524 fix: don't print whitespace between elements that will be removed anyway (#24)
  • 4c9a9ed feat: handle more types of expressions correctly
  • 4ebb68d collect slots inside optional chain expressions (#16)
  • 1b17201 handle parenthesized conditional slots (#15)
  • dc9cbe4 fix(scripts): Render scripts inside template elements as-is
  • f54b744 fix(ci): add -x to x86_64-unknown-linux-gnu build for glibc compat (#22)
  • See full diff in compare view

Updates astro from 6.1.6 to 6.1.7

Release notes

Sourced from astro's releases.

astro@6.1.7

Patch Changes

  • #16027 c62516b Thanks @​fkatsuhiro! - Fixes a bug where remote image dimensions were not validated during static builds on Netlify.

  • #16311 94048f2 Thanks @​Arecsu! - Fixes --port flag being ignored after a Vite-triggered server restart (e.g. when a .env file changes)

  • #16316 0fcd04c Thanks @​ematipico! - Fixes the /_image endpoint accepting an arbitrary f=svg query parameter and serving non-SVG content as image/svg+xml. The endpoint now validates that the source is actually SVG before honoring f=svg, matching the same guard already enforced on the <Image> component path.

Changelog

Sourced from astro's changelog.

6.1.7

Patch Changes

  • #16027 c62516b Thanks @​fkatsuhiro! - Fixes a bug where remote image dimensions were not validated during static builds on Netlify.

  • #16311 94048f2 Thanks @​Arecsu! - Fixes --port flag being ignored after a Vite-triggered server restart (e.g. when a .env file changes)

  • #16316 0fcd04c Thanks @​ematipico! - Fixes the /_image endpoint accepting an arbitrary f=svg query parameter and serving non-SVG content as image/svg+xml. The endpoint now validates that the source is actually SVG before honoring f=svg, matching the same guard already enforced on the <Image> component path.

Commits

Updates postcss from 8.5.9 to 8.5.10

Release notes

Sourced from postcss's releases.

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).
Changelog

Sourced from postcss's changelog.

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).
Commits

Updates prettier from 3.8.2 to 3.8.3

Release notes

Sourced from prettier's releases.

3.8.3

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.8.3

diff

SCSS: Prevent trailing comma in if() function (#18471 by @​kovsu)

// Input
$value: if(sass(false): 1; else: -1);
// Prettier 3.8.2
$value: if(
sass(false): 1; else: -1,
);
// Prettier 3.8.3
$value: if(sass(false): 1; else: -1);

Commits

Updates puppeteer from 24.40.0 to 24.41.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v24.41.0

24.41.0 (2026-04-15)

🎉 Features

🛠️ Fixes

📄 Documentation

puppeteer: v24.41.0

24.41.0 (2026-04-15)

🎉 Features

Dependencies

  • The following workspace dependencies were updated

... (truncated)

Changelog

Sourced from puppeteer's changelog.

24.41.0 (2026-04-15)

🎉 Features

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 24.40.0 to 24.41.0

🛠️ Fixes

📄 Documentation

Commits

Updates resend from 6.11.0 to 6.12.0

Release notes

Sourced from resend's releases.

v6.12.0

What's Changed

Full Changelog: resend/resend-node@v6.11.0...v6.12.0

Commits

Updates sanitize-html from 2.17.2 to 2.17.3

Changelog

Sourced from sanitize-html's changelog.

2.17.3 (2026-04-15)

Security

  • Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.
Commits

Updates stylelint from 17.7.0 to 17.8.0

Release notes

Sourced from stylelint's releases.

17.8.0

It adds 3 new rules and 1 configuration property.

Changelog

Sourced from stylelint's changelog.

17.8.0 - 2026-04-15

It adds 3 new rules and 1 configuration property.

Commits

Updates vercel from 51.2.1 to 51.4.0

Release notes

Sourced from vercel's releases.

vercel@51.4.0

Minor Changes

  • Support dynamically specifying crons from a python service (#15930)

Patch Changes

  • Add vercel flags rollout for progressive rollouts. (#15963)

    Examples:

    vercel flags rollout redesigned-checkout \
  --environment production \
  --by user.userId \
  --stage 5,6h \
  --stage 10,6h \
  --stage 25,12h \
  --stage 50,1d
    vercel flags rollout redesigned-checkout \
  --environment production \
  --by user.userId \
  --stage 5,30m \
  --stage 25,2h \
  --stage 50,8h \
  --start now
    vercel flags rollout welcome-message \
  --environment production \
  --by user.userId \
  --from-variant control \
  --to-variant treatment \
  --default-variant control \
  --stage 10,2h \
  --stage 50,12h \
  --start 2026-04-16T09:00:00Z
    vercel flags rollout redesigned-checkout \
  --environment production \
  --stage 10,6h \
  --stage 50,1d \
  --message "Adjust production rollout schedule"

... (truncated)

Changelog

Sourced from vercel's changelog.

51.4.0

Minor Changes

  • Support dynamically specifying crons from a python service (#15930)

Patch Changes

  • Add vercel flags rollout for progressive rollouts. (#15963)

    Examples:

    vercel flags rollout redesigned-checkout \
  --environment production \
  --by user.userId \
  --stage 5,6h \
  --stage 10,6h \
  --stage 25,12h \
  --stage 50,1d
    vercel flags rollout redesigned-checkout \
  --environment production \
  --by user.userId \
  --stage 5,30m \
  --stage 25,2h \
  --stage 50,8h \
  --start now
    vercel flags rollout welcome-message \
  --environment production \
  --by user.userId \
  --from-variant control \
  --to-variant treatment \
  --default-variant control \
  --stage 10,2h \
  --stage 50,12h \
  --start 2026-04-16T09:00:00Z
    vercel flags rollout redesigned-checkout \
  --environment production \
  --stage 10,6h \
  --stage 50,1d \
  --message "Adjust production rollout schedule"

... (truncated)

Commits
  • 1cb4e23 Version Packages (#15968)
  • 8f0699e [flags] Add vercel flags rollout for progressive rollouts (#15963)
  • 16aca7d Address bundling failures for vanilla node packages (#15891)
  • 4489729 [services] Support specifying multiple crons in a python service dynamically ...
  • 43915bb Version Packages (#15939)
  • 1056be9 Add root to experimentalServices. (#15929)
  • fc5a29d [vercel] fix: return 3xx responses when redirect is manual in client.fetch() ...
  • c27eeda [python] Add --functions-beta flag to vercel deploy. (#15892)
  • e939f51 [CLI] feat: alerts vs dashboard parity audit scope (CLI-238) (#15850)
  • bb66fe4 [flags] Add JSON feature flag support (#15741)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm-dependencies group with 9 updates
c5d7276 
Bumps the npm-dependencies group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/compiler-rs](https://github.com/withastro/compiler-rs) | `0.1.6` | `0.1.7` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.1.6` | `6.1.7` |
| [postcss](https://github.com/postcss/postcss) | `8.5.9` | `8.5.10` |
| [prettier](https://github.com/prettier/prettier) | `3.8.2` | `3.8.3` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `24.40.0` | `24.41.0` |
| [resend](https://github.com/resend/resend-node) | `6.11.0` | `6.12.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.2` | `2.17.3` |
| [stylelint](https://github.com/stylelint/stylelint) | `17.7.0` | `17.8.0` |
| [vercel](https://github.com/vercel/vercel/tree/HEAD/packages/cli) | `51.2.1` | `51.4.0` |


Updates `@astrojs/compiler-rs` from 0.1.6 to 0.1.7
- [Release notes](https://github.com/withastro/compiler-rs/releases)
- [Commits](https://github.com/withastro/compiler-rs/compare/@astrojs/compiler-rs@0.1.6...@astrojs/compiler-rs@0.1.7)

Updates `astro` from 6.1.6 to 6.1.7
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@6.1.7/packages/astro)

Updates `postcss` from 8.5.9 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.9...8.5.10)

Updates `prettier` from 3.8.2 to 3.8.3
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.2...3.8.3)

Updates `puppeteer` from 24.40.0 to 24.41.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v24.40.0...puppeteer-v24.41.0)

Updates `resend` from 6.11.0 to 6.12.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Commits](resend/resend-node@v6.11.0...v6.12.0)

Updates `sanitize-html` from 2.17.2 to 2.17.3
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.3/packages/sanitize-html)

Updates `stylelint` from 17.7.0 to 17.8.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint@17.7.0...17.8.0)

Updates `vercel` from 51.2.1 to 51.4.0
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/vercel@51.4.0/packages/cli)

---
updated-dependencies:
- dependency-name: "@astrojs/compiler-rs"
  dependency-version: 0.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: astro
  dependency-version: 6.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: prettier
  dependency-version: 3.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: puppeteer
  dependency-version: 24.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: resend
  dependency-version: 6.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: sanitize-html
  dependency-version: 2.17.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: stylelint
  dependency-version: 17.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: vercel
  dependency-version: 51.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Apr 16, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automerge 🤞, type: dependencies 🔗. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Apr 16, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@astrojs/compiler-binding 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-darwin-arm64 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-darwin-x64 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-linux-arm64-gnu 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-linux-arm64-musl 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-linux-x64-gnu 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-linux-x64-musl 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-wasm32-wasi 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-win32-arm64-msvc 0.1.7 UnknownUnknown
npm/@astrojs/compiler-binding-win32-x64-msvc 0.1.7 UnknownUnknown
npm/@astrojs/compiler-rs 0.1.7 UnknownUnknown
npm/@napi-rs/wasm-runtime 1.1.4 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 6Found 15/25 approved changesets -- score normalized to 6
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/backends 0.0.62 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/build-utils 13.17.0 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/cervel 0.0.49 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/elysia 0.1.65 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/express 0.1.75 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/fastify 0.1.68 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/gatsby-plugin-vercel-builder 2.1.15 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/h3 0.1.74 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/hono 0.2.68 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/koa 0.1.48 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/nestjs 0.2.69 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/next 4.16.8 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/node 5.7.7 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/python 6.33.0 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vercel/static-build 2.9.15 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/astro 6.1.7 UnknownUnknown
npm/devtools-protocol 0.0.1595872 🟢 4.9
Details
CheckScoreReason
Code-Review⚠️ 1Found 3/28 approved changesets -- score normalized to 1
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
npm/postcss 8.5.10 🟢 5.5
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1021 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/prettier 3.8.3 🟢 7.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 8Found 4/5 approved changesets -- score normalized to 8
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 9SAST tool detected but not run on all commits
npm/puppeteer 24.41.0 🟢 7.9
Details
CheckScoreReason
Security-Policy🟢 9security policy file detected
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ -1no releases found
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Vulnerabilities🟢 37 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 60 contributing companies or organizations
npm/puppeteer-core 24.41.0 🟢 7.9
Details
CheckScoreReason
Security-Policy🟢 9security policy file detected
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ -1no releases found
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Vulnerabilities🟢 37 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 60 contributing companies or organizations
npm/resend 6.12.0 UnknownUnknown
npm/sanitize-html 2.17.3 🟢 6.3
Details
CheckScoreReason
Code-Review🟢 9Found 28/30 approved changesets -- score normalized to 9
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License⚠️ 0license file not detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 9security policy file detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
npm/stylelint 17.8.0 🟢 7.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 8detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices⚠️ 2badge detected: InProgress
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 4security policy file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
npm/vercel 51.4.0 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 6binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • package-lock.json

@github-actions

github-actions Bot commented Apr 16, 2026

Copy link
Copy Markdown

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 71.14% 10264 / 14427
🔵 Statements 69.03% 10828 / 15685
🔵 Functions 70.99% 2129 / 2999
🔵 Branches 54.6% 5786 / 10597
File CoverageNo changed files found.
Generated in workflow #417 for commit c5d7276 by the Vitest Coverage Report Action

@dependabot @github

dependabot Bot commented on behalf of github Apr 18, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 18, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-c4c74558fb branch April 18, 2026 10:49

This branch was previously deployed

2 inactive deployments
testing — c5d72761 Deployed Apr 16, 2026 by dependabot[bot] via Unit Tests #417
preview — c5d72761 Deployed Apr 16, 2026 by dependabot[bot] via Deploy Preview #388
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants