Skip to content

Bump the npm group across 2 directories with 15 updates#56

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-7baa01b908
Dec 15, 2025
Merged

Bump the npm group across 2 directories with 15 updates#56
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-7baa01b908

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Dec 15, 2025

Copy link
Copy Markdown
Contributor

Bumps the npm group with 6 updates in the / directory:

Package From To
pnpm 10.25.0 10.26.0
hono 4.11.0 4.11.1
zod 4.1.13 4.2.0
typescript-eslint 8.49.0 8.50.0
aws-cdk 2.1034.0 2.1100.0
vite-tsconfig-paths 5.1.4 6.0.1

Bumps the npm group with 5 updates in the /example directory:

Package From To
hono 4.11.0 4.11.1
zod 4.1.13 4.2.0
typescript-eslint 8.49.0 8.50.0
aws-cdk 2.1034.0 2.1100.0
vite-tsconfig-paths 5.1.4 6.0.1

Updates pnpm from 10.25.0 to 10.26.0

Release notes

Sourced from pnpm's releases.

pnpm 10.26

Minor Changes

  • Semi-breaking. Block git-hosted dependencies from running prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.

  • Semi-breaking. Compute integrity hash for HTTP tarball dependencies when fetching, storing it in the lockfile to prevent servers from serving altered content on subsequent installs #10287.

  • Added a new setting blockExoticSubdeps that prevents the resolution of exotic protocols in transitive dependencies.

    When set to true, direct dependencies (those listed in your root package.json) may still use exotic sources, but all transitive dependencies must be resolved from a trusted source. Trusted sources include the configured registry, local file paths, workspace links, trusted GitHub repositories (node, bun, deno), and custom resolvers.

    This helps to secure the dependency supply chain. Packages from trusted sources are considered safer, as they are typically subject to more reliable verification and scanning for malware and vulnerabilities.

    Exotic sources are dependency locations that bypass the usual trusted resolution process. These protocols are specifically targeted and blocked: Git repositories (git+ssh://...) and direct URL links to tarballs (https://.../package.tgz).

    Related PR: #10265.

  • Added support for allowBuilds, which is a new field that can be used instead of onlyBuiltDependencies and ignoredBuiltDependencies. The new allowBuilds field in your pnpm-workspace.yaml uses a map of package matchers to explicitly allow (true) or disallow (false) script execution. This allows for a single, easy-to-manage source of truth for your build permissions.

    Example Usage. To explicitly allow all versions of esbuild to run scripts and prevent core-js from running them:

    allowBuilds:
  esbuild: true
  core-js: false

    The example above achieves the same result as the previous configuration:

    onlyBuiltDependencies:
  - esbuild
ignoredBuiltDependencies:
  - core-js

    Related PR: #10311

  • Added support for --dry-run to the pack command #10301.

Patch Changes

  • Show deprecation in table/list formats when latest version is deprecated #8658.
  • Remove the injectWorkspacePackages setting from the lockfile on the deploy command #10294.
  • Normalize the tarball URLs before saving them to the lockfile. URLs should not contain default ports, like :80 for http and :443 for https #10273.
  • When a dependency is installed via a direct URL that redirects to another URL and is immutable, the original URL is normalized and saved to package.json #10197.

Platinum Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.26.0

Minor Changes

  • Semi-breaking. Block git-hosted dependencies from running prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.

  • Semi-breaking. Compute integrity hash for HTTP tarball dependencies when fetching, storing it in the lockfile to prevent servers from serving altered content on subsequent installs #10287.

  • Added a new setting blockExoticSubdeps that prevents the resolution of exotic protocols in transitive dependencies.

    When set to true, direct dependencies (those listed in your root package.json) may still use exotic sources, but all transitive dependencies must be resolved from a trusted source. Trusted sources include the configured registry, local file paths, workspace links, trusted GitHub repositories (node, bun, deno), and custom resolvers.

    This helps to secure the dependency supply chain. Packages from trusted sources are considered safer, as they are typically subject to more reliable verification and scanning for malware and vulnerabilities.

    Exotic sources are dependency locations that bypass the usual trusted resolution process. These protocols are specifically targeted and blocked: Git repositories (git+ssh://...) and direct URL links to tarballs (https://.../package.tgz).

    Related PR: #10265.

  • Added support for allowBuilds, which is a new field that can be used instead of onlyBuiltDependencies and ignoredBuiltDependencies. The new allowBuilds field in your pnpm-workspace.yaml uses a map of package matchers to explicitly allow (true) or disallow (false) script execution. This allows for a single, easy-to-manage source of truth for your build permissions.

    Example Usage. To explicitly allow all versions of esbuild to run scripts and prevent core-js from running them:

    allowBuilds:
  esbuild: true
  core-js: false

    The example above achieves the same result as the previous configuration:

    onlyBuiltDependencies:
  - esbuild
ignoredBuiltDependencies:
  - core-js

    Related PR: #10311

  • Added support for --dry-run to the pack command #10301.

Patch Changes

  • Show deprecation in table/list formats when latest version is deprecated #8658.
  • Remove the injectWorkspacePackages setting from the lockfile on the deploy command #10294.
  • Normalize the tarball URLs before saving them to the lockfile. URLs should not contain default ports, like :80 for http and :443 for https #10273.
  • When a dependency is installed via a direct URL that redirects to another URL and is immutable, the original URL is normalized and saved to package.json #10197.
Commits
  • 244e33b chore(release): 10.26.0
  • 4077539 fix(git-fetcher): block git dependencies from running prepare scripts unless ...
  • See full diff in compare view

Updates hono from 4.11.0 to 4.11.1

Release notes

Sourced from hono's releases.

v4.11.1

What's Changed

Full Changelog: honojs/hono@v4.11.0...v4.11.1

Commits

Updates zod from 4.1.13 to 4.2.0

Release notes

Sourced from zod's releases.

v4.2.0

Features

Implement Standard JSON Schema

standard-schema/standard-schema#134

Implement z.fromJSONSchema()

const jsonSchema = {
  type: "object",
  properties: {
    name: { type: "string" },
    age: { type: "number" }
  },
  required: ["name"]
};
const schema = z.fromJSONSchema(jsonSchema);

Implement z.xor()

const schema = z.xor(
  z.object({ type: "user", name: z.string() }),
  z.object({ type: "admin", role: z.string() })
);
// Exactly one of the schemas must match

Implement z.looseRecord()

const schema = z.looseRecord(z.string(), z.number());
// Allows additional properties beyond those defined

Commits:

  • af49c084f66339110d00e37ff71dc7b3b9f2b7ef Update docs for JSON Schema conversion of z.undefined() (#5504)
  • 767f320318986e422f524b939f1a7174544fda2e Add .toJSONSchema() method (#5477)
  • e17dcb63573397063e87d7c7fe10a5a78968181a Add z.fromJSONSchema(), z.looseRecord(), z.xor() (#5534)
Commits

Updates typescript-eslint from 8.49.0 to 8.50.0

Release notes

Sourced from typescript-eslint's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.50.0 (2025-12-15)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates aws-cdk from 2.1034.0 to 2.1100.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1100.0

2.1100.0 (2025-12-15)

Features

Commits

Updates vite-tsconfig-paths from 5.1.4 to 6.0.1

Release notes

Sourced from vite-tsconfig-paths's releases.

v6.0.0

Highlights

  • On-demand tsconfig discovery via projectDiscovery: "lazy", while eager discovery remains the default.
  • tsconfig/jsconfig files are watched and reloaded automatically in both modes, including during vite build --watch.
  • New logFile option for per-import resolution traces (pass true for vite-tsconfig-paths.log or provide a path).
  • Support for root /* aliases and other absolute-style imports.
  • Support for .astro files when allowJs/loose is enabled.

Fixes

  • More reliable tsconfig watching and resolver refreshes: handles lazy discovery edge cases, recreates resolvers after file changes, tolerates missing directories, and copes better with virtual importers.
  • Windows path handling now normalizes drive-letter casing to avoid missed matches (#183).

Upgrade notes

  • Install the stable release: pnpm add -D vite-tsconfig-paths.
  • Opt into lazy discovery or logging when needed:
import tsconfigPaths from 'vite-tsconfig-paths'
export default {
plugins: [
tsconfigPaths({
projectDiscovery: 'lazy',
logFile: true,
}),
],
}

  • Rooted path patterns such as "/*": ["src/*"] now resolve the same way tsserver does.

v6.0.0-beta.4

  • fix(windows): ensure drive letter is uppercase (#183)
  • feat: add .astro to JS-like extension regex (fbbc8edb86606c612565a6672c8e0ae93f0001a0)

v6.0.0-beta.3

  • Added support for /* path aliases. (#101)

v6.0.0-beta.2

  • Added a new logFile option.
    Pass logFile: true and the plugin will create a vite-tsconfig-paths.log file in your working directory.

    Using DEBUG=vite-tsconfig-paths in the past has worked pretty well, but it isn't always the most readable. In v6 and above, this plugin will still have debug logs using this approach, but module resolution will only be logged through the new logFile option. The log file will be comprehensive (as in, every import that vite-tsconfig-paths receives will be logged). If an import goes unhandled by this plugin, the reason will be logged. If an import is resolved, the resolved path and the tsconfig path are both logged. In fact, every possible code path (in the context of module resolution) is logged to the log file.

  • Universal support for tsconfig reloading.
    Whether you're using projectDiscovery: "lazy" or eager loading, this plugin should now be able to watch and reload tsconfig files when you make changes to them. This feature hasn't been rigorously tested yet. Please report issues you come across.

... (truncated)

Commits
  • 9625d21 chore: release v6.0.1
  • ea57709 fix: ensure getResolvers is never undefined
  • afb6ab9 chore(docs): tweak readme
  • 3951713 chore(docs): fix grammar
  • 17110f1 chore: release v6.0.0
  • 9a39620 chore(docs): update readme for v6
  • 87890d0 chore(docs): add new section to readme
  • 08677af feat(refactor): narrow the plugin type to avoid conflicts
  • 5ce91a3 chore: release v6.0.0-beta.4
  • 80b4c63 fix(windows): ensure drive letter is uppercase (#183)
  • Additional commits viewable in compare view

Updates @typescript-eslint/eslint-plugin from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/parser from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.50.0 (2025-12-15)

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/project-service from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/project-service's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/project-service's changelog.

8.50.0 (2025-12-15)

This was a version bump only for project-service to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/scope-manager from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/scope-manager's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/scope-manager's changelog.

8.50.0 (2025-12-15)

This was a version bump only for scope-manager to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/tsconfig-utils from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/tsconfig-utils's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/tsconfig-utils's changelog.

8.50.0 (2025-12-15)

This was a version bump only for tsconfig-utils to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/type-utils from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/type-utils's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/type-utils's changelog.

8.50.0 (2025-12-15)

This was a version bump only for type-utils to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/typescript-estree from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/typescript-estree's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/typescript-estree's changelog.

8.50.0 (2025-12-15)

This was a version bump only for typescript-estree to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/utils from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/utils's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/utils's changelog.

8.50.0 (2025-12-15)

This was a version bump only for utils to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/visitor-keys from 8.49.0 to 8.50.0

Release notes

Sourced from @​typescript-eslint/visitor-keys's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/visitor-keys's changelog.

8.50.0 (2025-12-15)

This was a version bump only for visitor-keys to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates hono from 4.11.0 to 4.11.1

Release notes

Sourced from hono's releases.

v4.11.1

What's Changed

Full Changelog: honojs/hono@v4.11.0...v4.11.1

Commits

Updates zod from 4.1.13 to 4.2.0

Release notes

Sourced from zod's releases.

v4.2.0

Features

Implement Standard JSON Schema

standard-schema/standard-schema#134

Implement z.fromJSONSchema()

const jsonSchema = {
  type: "object",
  properties: {
    name: { type: "string" },
    age: { type: "number" }
  },
  required: ["name"]
};
const schema = z.fromJSONSchema(jsonSchema);

Implement z.xor()

const schema = z.xor(
  z.object({ type: "user", name: z.string() }),
  z.object({ type: "admin", role: z.string() })
);
// Exactly one of the schemas must match

Implement z.looseRecord()

const schema = z.looseRecord(z.string(), z.number());
// Allows additional properties beyond those defined

Commits:

  • af49c084f66339110d00e37ff71dc7b3b9f2b7ef Update docs for JSON Schema conversion of z.undefined() (#5504)
  • 767f320318986e422f524b939f1a7174544fda2e Add .toJSONSchema() method (#5477)
  • e17dcb63573397063e87d7c7fe10a5a78968181a Add z.fromJSONSchema(), z.looseRecord(), z.xor() (#5534)
Commits

Updates typescript-eslint from 8.49.0 to 8.50.0

Release notes

Sourced from typescript-eslint's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.50.0 (2025-12-15)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates aws-cdk from 2.1034.0 to 2.1100.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1100.0

2.1100.0 (2025-12-15)

Features

Commits

Updates vite-tsconfig-paths from 5.1.4 to 6.0.1

Release notes

Sourced from vite-tsconfig-paths's releases.

v6.0.0

Highlights

  • On-demand tsconfig discovery via projectDiscovery: "lazy", while eager discovery remains the default.
  • tsconfig/jsconfig files are watched and reloaded automatically in both modes, including during vite build --watch.
  • New logFile option for per-import resolution traces (pass true for vite-tsconfig-paths.log or provide a path).
  • Support for root /* aliases and other absolute-style imports.
  • Support for .astro files when allowJs/loose is enabled.

Fixes

  • More reliable tsconfig watching and resolver refreshes: handles lazy discovery edge cases, recreates resolvers after file changes, tolerates missing directories, and copes better with virtual importers.
  • Windows path handling now normalizes drive-letter casing to avoid missed matches (#183).

Upgrade notes

  • Install the stable release: pnpm add -D vite-tsconfig-paths.
  • Opt into lazy discovery or logging when needed:
import tsconfigPaths from 'vite-tsconfig-paths'
export default {
plugins: [
tsconfigPaths({
projectDiscovery: 'lazy',
logFile: true,
}),
],
}

  • Rooted path patterns such as "/*": ["src/*"] now resolve the same way tsserver does.

v6.0.0-beta.4

  • fix(windows): ensure drive letter is uppercase (#183)
  • feat: add .astro to JS-like extension regex (fbbc8edb86606c612565a6672c8e0ae93f0001a0)

v6.0.0-beta.3

  • Added support for /* path aliases. (#101)

v6.0.0-beta.2

  • Added a new logFile option.
    Pass logFile: true and the plugin will create a vite-tsconfig-paths.log file in your working directory.

    Using DEBUG=vite-tsconfig-paths in the past has worked pretty well, but it isn't always the most readable. In v6 and above, this plugin will still have debug logs using this approach, but module resolution will only be logged through the new logFile option. The log file will be comprehensive (as in, every import that vite-tsconfig-paths receives will be logged). If an import goes unhandled by this plugin, the reason will be logged. If an import is resolved, the resolved path and the tsconfig path are both logged. In fact, every possible code path (in the context of module resolution) is logged to the log file.

  • Universal support for tsconfig reloading.
    Whether you're using projectDiscovery: "lazy" or eager loading, this plugin should now be able to watch and reload tsconfig files when you make changes to them. This feature hasn't been rigorously tested yet. Please report issues you come across.

... (truncated)

Commits
  • 9625d21 chore: release v6.0.1
  • ea57709 fix: ensure getResolvers is never undefined
  • afb6ab9 chore(docs): tweak readme
  • 3951713 chore(docs): fix grammar
  • 17110f1 chore: release v6.0.0
  • 9a39620 chore(docs): update readme for v6
  • 87890d0 chore(docs): add new section to readme
  • 08677af feat(refactor): narrow the plugin type to avoid conflicts
  • 5ce91a3 chore: release v6.0.0-beta.4
  • 80b4c63 fix(windows): ensure drive letter is uppercase (#183)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm group across 2 directories with 15 updates
8420ac7 
Bumps the npm group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) | `10.25.0` | `10.26.0` |
| [hono](https://github.com/honojs/hono) | `4.11.0` | `4.11.1` |
| [zod](https://github.com/colinhacks/zod) | `4.1.13` | `4.2.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.49.0` | `8.50.0` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1034.0` | `2.1100.0` |
| [vite-tsconfig-paths](https://github.com/aleclarson/vite-tsconfig-paths) | `5.1.4` | `6.0.1` |

Bumps the npm group with 5 updates in the /example directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.11.0` | `4.11.1` |
| [zod](https://github.com/colinhacks/zod) | `4.1.13` | `4.2.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.49.0` | `8.50.0` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1034.0` | `2.1100.0` |
| [vite-tsconfig-paths](https://github.com/aleclarson/vite-tsconfig-paths) | `5.1.4` | `6.0.1` |



Updates `pnpm` from 10.25.0 to 10.26.0
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.26.0/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.26.0/pnpm)

Updates `hono` from 4.11.0 to 4.11.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.0...v4.11.1)

Updates `zod` from 4.1.13 to 4.2.0
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.1.13...v4.2.0)

Updates `typescript-eslint` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/typescript-eslint)

Updates `aws-cdk` from 2.1034.0 to 2.1100.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1100.0/packages/aws-cdk)

Updates `vite-tsconfig-paths` from 5.1.4 to 6.0.1
- [Release notes](https://github.com/aleclarson/vite-tsconfig-paths/releases)
- [Commits](aleclarson/vite-tsconfig-paths@v5.1.4...v6.0.1)

Updates `@typescript-eslint/eslint-plugin` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/parser)

Updates `@typescript-eslint/project-service` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/project-service/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/project-service)

Updates `@typescript-eslint/scope-manager` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/scope-manager/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/scope-manager)

Updates `@typescript-eslint/tsconfig-utils` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/tsconfig-utils/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/tsconfig-utils)

Updates `@typescript-eslint/type-utils` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/type-utils/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/type-utils)

Updates `@typescript-eslint/typescript-estree` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-estree/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/typescript-estree)

Updates `@typescript-eslint/utils` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/utils/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/utils)

Updates `@typescript-eslint/visitor-keys` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/visitor-keys/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/visitor-keys)

Updates `hono` from 4.11.0 to 4.11.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.0...v4.11.1)

Updates `zod` from 4.1.13 to 4.2.0
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.1.13...v4.2.0)

Updates `typescript-eslint` from 8.49.0 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/typescript-eslint)

Updates `aws-cdk` from 2.1034.0 to 2.1100.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1100.0/packages/aws-cdk)

Updates `vite-tsconfig-paths` from 5.1.4 to 6.0.1
- [Release notes](https://github.com/aleclarson/vite-tsconfig-paths/releases)
- [Commits](aleclarson/vite-tsconfig-paths@v5.1.4...v6.0.1)

---
updated-dependencies:
- dependency-name: pnpm
  dependency-version: 10.26.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: hono
  dependency-version: 4.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: zod
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: typescript-eslint
  dependency-version: 8.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: aws-cdk
  dependency-version: 2.1100.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: vite-tsconfig-paths
  dependency-version: 6.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/project-service"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/scope-manager"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/tsconfig-utils"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/type-utils"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/typescript-estree"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/utils"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/visitor-keys"
  dependency-version: 8.50.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: hono
  dependency-version: 4.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: zod
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: typescript-eslint
  dependency-version: 8.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: aws-cdk
  dependency-version: 2.1100.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: vite-tsconfig-paths
  dependency-version: 6.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 15, 2025
@github-actions github-actions Bot enabled auto-merge (squash) December 15, 2025 19:02
@github-actions

github-actions Bot commented Dec 15, 2025

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/aws-cdk ^2.1100.0 UnknownUnknown
npm/hono ^4.11.1 UnknownUnknown
npm/typescript-eslint ^8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/vite-tsconfig-paths ^6.0.1 🟢 3.1
Details
CheckScoreReason
Dangerous-Workflow⚠️ -1no workflows found
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ -1No tokens found
Pinned-Dependencies⚠️ -1no dependencies found
Maintained⚠️ 10 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 1
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Vulnerabilities⚠️ 031 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/zod ^4.2.0 🟢 4.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 013 existing vulnerabilities detected
npm/@typescript-eslint/eslint-plugin 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/parser 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/project-service 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/scope-manager 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/tsconfig-utils 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/type-utils 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/types 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/typescript-estree 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/utils 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/visitor-keys 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/aws-cdk 2.1100.0 UnknownUnknown
npm/hono 4.11.1 UnknownUnknown
npm/pnpm 10.26.0 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 5Found 15/28 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 9SAST tool detected but not run on all commits
Vulnerabilities⚠️ 0124 existing vulnerabilities detected
npm/typescript-eslint 8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/vite-tsconfig-paths 6.0.1 🟢 3.1
Details
CheckScoreReason
Dangerous-Workflow⚠️ -1no workflows found
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ -1No tokens found
Pinned-Dependencies⚠️ -1no dependencies found
Maintained⚠️ 10 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 1
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Vulnerabilities⚠️ 031 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/zod 4.2.0 🟢 4.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 013 existing vulnerabilities detected
npm/hono ^4.11.1 UnknownUnknown
npm/typescript-eslint ^8.50.0 🟢 5.3
Details
CheckScoreReason
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 16/20 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 037 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/zod ^4.2.0 🟢 4.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 013 existing vulnerabilities detected

Scanned Files

  • example/package.json
  • package/package.json
  • pnpm-lock.yaml

@github-actions github-actions Bot merged commit aa66b62 into main Dec 15, 2025
4 checks passed
@github-actions github-actions Bot deleted the dependabot/npm_and_yarn/npm-7baa01b908 branch December 15, 2025 19:03
@github-actions github-actions Bot mentioned this pull request Jan 8, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

@poad poad

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@poad