chore(deps): Bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #86 · NeiRo21/solidmarks

dependabot · 2026-11-10T17:22:26Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
brace-expansion	`1.1.18`	`1.1.21`
fast-uri	`3.1.7`	`3.1.9`
node-forge	`1.4.0`	`1.4.3`
shell-quote	`1.10.0`	`1.11.0`
source-map-js	`1.2.1`	`1.2.2`
undici	`7.30.0`	`7.30.2`

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
See full diff in compare view

Updates fast-uri from 3.1.7 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.

Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.

Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.

Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:
npm install fast-uri@3.1.9
Thanks to @zekth for reporting the scheme, host, and relative-reference issues, and to @UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

ci: enable trusted publishing releases (v3.x) by @mcollina in fastify/fast-uri#229

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

Commits

0def703 Bumped v3.1.9
a1d0da2 test: generate only relative path references
9eb8759 fix: preserve relative paths in suffix and relative resolution
54c30f7 docs: note suffix-reference authority ambiguity
39e6493 fix: escape a first-segment colon in suffix references
745183c test: cover first-segment colon in suffix references
ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
eb483b5 test: cover colon-first relative references in normalization
b110a35 fix(SEC-02): preserve meaning of relative references during normalization
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.

Updates node-forge from 1.4.0 to 1.4.3

Changelog

Sourced from node-forge's changelog.

1.4.3 - 2026-11-03

Security

HIGH: X.509 certificate chain verification ignores name constraints.

pki.verifyCertificateChain() does not check the nameConstraints extension (RFC 5280 4.2.1.10). A non-critical nameConstraints extension in a CA certificate is ignored, so a name-constrained intermediate CA can issue certificates for names outside its permitted subtrees, or inside its excluded subtrees, and the chain verifies. Exploitation requires the private key of a name-constrained CA that chains to a trusted root. A critical nameConstraints extension is rejected as an unsupported critical extension.

Reported by @bhaswanthc.

CVE ID: CVE-TBD

GHSA ID: GHSA-3cc4-3294-vgjf

MODERATE: TLS client crash on a handshake record without a session.

A TLS client throws an uncaught TypeError from process() when it receives a ServerHello while it has no session: after a close_notify alert or a call to close(), or before handshake() is called. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions. Servers are not affected.

Reported by @manus-use.

CVE ID: CVE-TBD

GHSA ID: GHSA-j8rw-jp99-435v

MODERATE: ReDoS in forge.http response header parsing.

forge.http trims response header and Set-Cookie values with a regular expression that takes quadratic time on a long run of whitespace followed by another character. A server, or an on-path attacker, can block a forge.http client for minutes with one large header.

Reported by @manus-pi.

CVE ID: CVE-TBD

GHSA ID: GHSA-6cv4-p8m7-4r25

MODERATE: TLS client crash on an unsupported ServerHello compression method.

A TLS client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes process() throw an uncaught Error at ServerHelloDone, before the server is authenticated. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions, including through forge.tls.wrapSocket. Servers are not affected.

Reported by @alienkeric.

CVE ID: CVE-TBD

GHSA ID: GHSA-w4xr-hqv8-ch44

LOW: Ed25519 signature verification accepts small-order public keys.

ed25519.verify() does not reject public keys of small order, such as the identity point. Under such a key, a signature with S = 0 and a small-order R verifies for many or, with the identity key, all messages, without any private key. Applications are affected only if

... (truncated)

Commits

936b24d Release 1.4.3.
4d8f79a Update changelog.
1d9816d Check the ServerHello compression method.
326a4d0 Trim forge.http header values in linear time.
2cfaeb5 Ignore handshake messages on a TLS client without a session.
6b23eae Complete nameConstraints enforcement.
862aa5f Enforce nameConstraints in verifyCertificateChain().
956f2b5 Document ed25519.verify() small-order key behavior.
1b77e6f Reject small-order Ed25519 public keys in verify.
2bd5146 Add GitHub usernames to credits.
Additional commits viewable in compare view

Updates shell-quote from 1.10.0 to 1.11.0

Changelog

Sourced from shell-quote's changelog.

v1.11.0 - 2026-09-29

Fixed

[Refactor] quote: drop a replace that can never match in the single-quote branch [#15](https://github.com/ljharb/shell-quote/issues/15)

[New] parse: support bash ANSI-C quoting ($'...') [#32](https://github.com/ljharb/shell-quote/issues/32)

Commits

[Fix] quote: reject line terminators in tokens after a comment 6002b2e

[Fix] parse: preserve text after special shell parameters 81b08a5

[Fix] parse: an escaped backslash does not escape the character after it d708019

[Fix] quote: preserve ! in arguments that also contain ' ad39927

[Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd

[Fix] quote: preserve empty glob patterns 35c9b97

[Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e

[meta] npmignore some files ebfc308

[actions] add permissions 3429b0d

[actions] set least-privilege cache-mode 36f2394

[Dev Deps] update eslint 6de9a41

Commits

88241f8 v1.11.0
ebfc308 [meta] npmignore some files
c4385ec [Refactor] quote: drop a replace that can never match in the single-quote b...
e455649 [New] parse: support bash ANSI-C quoting ($'...')
d708019 [Fix] parse: an escaped backslash does not escape the character after it
b1e406e [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd
ad39927 [Fix] quote: preserve ! in arguments that also contain '
6002b2e [Fix] quote: reject line terminators in tokens after a comment
36f2394 [actions] set least-privilege cache-mode
28f88cd [Fix] parse: treat $_name as a variable name, not $_ followed by text
Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Updates undici from 7.30.0 to 7.30.2

Release notes

Sourced from undici's releases.

v7.30.2

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 7.30.1 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

In Undici 7.x, a shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

In Undici 7.x, a cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

In Undici 7.x, the redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

In Undici 7.x, a downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

Undici 7.15.0 through 7.30.1 could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

[v7.x] fix(decompress): join a repeated content-encoding header (#5664) by @mrityunjay-pandey in nodejs/undici#6026

ci: fix macOS WPT (Python 3.15) and job timeout on v7.x by @mcollina in nodejs/undici#6087

fix(h1): backport ignore type of service errors to v7.x (#5547) by @mcollina in nodejs/undici#6076

[Backport v7.x] extractBody fixes 2 by @github-actions[bot] in nodejs/undici#6093

Full Changelog: nodejs/undici@v7.30.1...v7.30.2

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

... (truncated)

Commits

6be5720 Bumped v7.30.2 (#6163)
4bca0ab test: support Node.js 20 in cache replay tests
520d95b docs: add v7.30.2 security release notes
bcba54b fix(redirect): normalize tuple headers on v7
faba415 fix(cache): adapt security fixes to v7 lifecycle
3df9ff5 test(cache): align redirect caching with hop policy
4d54152 fix(cache): detect an actual redirect, not a plain revalidation
c363766 test(cache): cover credentialed revalidation refresh
b790905 fix(cache): treat proxy-authorization as a credential when caching redirects
95a17aa test(cache): cover proxy-authorization credential on same-origin redirect
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.18` | `1.1.21` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.7` | `3.1.9` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.4.0` | `1.4.3` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.10.0` | `1.11.0` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [undici](https://github.com/nodejs/undici) | `7.30.0` | `7.30.2` | Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21) Updates `fast-uri` from 3.1.7 to 3.1.9 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.7...v3.1.9) Updates `node-forge` from 1.4.0 to 1.4.3 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.4.0...v1.4.3) Updates `shell-quote` from 1.10.0 to 1.11.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.10.0...v1.11.0) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `undici` from 7.30.0 to 7.30.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.30.0...v7.30.2) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.11.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.30.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-11-10T17:22:41Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@babel/runtime

8.0.7

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 7	Found 23/29 approved changesets -- score normalized to 7
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@mdn/browser-compat-data

8.1.4

🟢 6.3

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 3	SAST tool is not run on all commits -- score normalized to 3

npm/addons-linter

10.14.0

🟢 6.4

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	🟢 10	SAST tool is run on all commits

npm/addons-moz-compare

1.4.0

🟢 6.4

Details

Check	Score	Reason
Code-Review	🟢 7	Found 9/12 approved changesets -- score normalized to 7
Maintained	🟢 10	25 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	🟢 8	SAST tool is not run on all commits -- score normalized to 8

npm/addons-scanner-utils

16.0.0

🟢 6.7

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 8	binaries present in source code
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits

npm/brace-expansion

1.1.21

🟢 7

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 3/16 approved changesets -- score normalized to 1
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	11 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/bundle-name

4.1.1

🟢 3.6

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 9	security policy file detected
Code-Review	⚠️ 0	Found 2/27 approved changesets -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Maintained	⚠️ 2	3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/default-browser

5.5.1

🟢 3.7

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 4/30 approved changesets -- score normalized to 1
Maintained	⚠️ 2	3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 9	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/fast-uri

3.1.9

🟢 8.1

Details

Check	Score	Reason
Code-Review	🟢 3	Found 9/28 approved changesets -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests	🟢 10	11 out of 11 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 33 contributing companies or organizations

npm/fx-runner

1.7.0

Unknown

npm/image-size

2.0.4

Unknown

npm/jszip

3.10.2

🟢 4.3

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 7	7 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 7
Code-Review	🟢 4	Found 9/21 approved changesets -- score normalized to 4
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/node-forge

1.4.3

🟢 6.1

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 0/15 approved changesets -- score normalized to 0
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/open

11.0.4

🟢 4.2

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 5/30 approved changesets -- score normalized to 1
Maintained	🟢 7	9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Security-Policy	🟢 9	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/pino

10.4.0

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 22/23 approved changesets -- score normalized to 9
Maintained	🟢 10	14 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches

npm/powershell-utils

0.2.1

Unknown

npm/process-warning

5.1.1

Unknown

npm/shell-quote

1.11.0

🟢 5.1

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 3/29 approved changesets -- score normalized to 1
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	22 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/source-map-js

1.2.2

🟢 3.1

Details

Check	Score	Reason
Token-Permissions	⚠️ -1	No tokens found
Dangerous-Workflow	⚠️ -1	no workflows found
Maintained	🟢 5	4 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5
Code-Review	🟢 3	Found 9/30 approved changesets -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ -1	no dependencies found
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/thread-stream

4.2.1

Unknown

npm/undici

7.30.2

🟢 7.6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 2	Found 6/23 approved changesets -- score normalized to 2
Security-Policy	🟢 10	security policy file detected
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 8	binaries present in source code
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
Packaging	🟢 10	packaging workflow detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	🟢 10	SAST tool is run on all commits
Fuzzing	🟢 10	project is fuzzed
CI-Tests	🟢 10	13 out of 13 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 71 contributing companies or organizations

npm/web-ext

10.8.0

Unknown

npm/wsl-utils

1.0.1

Unknown

npm/yargs

17.7.3

🟢 7.3

Details

Check	Score	Reason
Maintained	🟢 10	15 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 4	Found 13/27 approved changesets -- score normalized to 4
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

package-lock.json

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 10, 2026

NeiRo21 approved these changes Nov 11, 2026

View reviewed changes

NeiRo21 merged commit bb91faf into main Nov 11, 2026
6 checks passed

NeiRo21 deleted the dependabot/npm_and_yarn/npm_and_yarn-b8079564f4 branch November 11, 2026 12:11

Navigation Menu

Repository navigation

chore(deps): Bump the npm_and_yarn group across 1 directory with 6 updates - #86

chore(deps): Bump the npm_and_yarn group across 1 directory with 6 updates#86
NeiRo21 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b8079564f4

dependabot Bot commented on behalf of github Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 10, 2026

v3.1.9

Security

What's Changed

v3.1.8

⚠️ Security Warning

1.4.3 - 2026-11-03

Security

v1.11.0 - 2026-09-29

Fixed

Commits

v1.2.2

1.2.2

v7.30.2

⚠️ Security Fixes

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

What's Changed

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

Uh oh!

github-actions Bot commented Nov 10, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant