Skip to content

Bump the npm group with 7 updates#2674

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-1071c532d2
Apr 6, 2026
Merged

Bump the npm group with 7 updates#2674
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-1071c532d2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 7 updates:

Package From To
@types/node 25.5.0 25.5.1
axe-core 4.11.1 4.11.2
baseline-browser-mapping 2.10.12 2.10.14
browserslist 4.28.1 4.28.2
eslint-import-resolver-node 0.3.9 0.3.10
node-releases 2.0.36 2.0.37
resolve 1.22.11 2.0.0-next.6

Updates @types/node from 25.5.0 to 25.5.1

Commits

Updates axe-core from 4.11.1 to 4.11.2

Release notes

Sourced from axe-core's releases.

Release 4.11.2

This release addresses a number of false positives, including ones related to target size. It adds new affordances for ARIA, and adds a clarification around the scrollable regions rule.

Bug Fixes

  • aria-valid-attr-value: handle multiple aria-errormessage IDs (#4973) (9322148)
  • aria: prevent getOwnedVirtual from returning duplicate nodes (#4987) (99d1e77), closes #4840
  • DqElement: avoid calling constructors with cloneNode (#5013) (88bc57f)
  • existing-rule: aria-busy now shows an error message for a use with unallowed children (#5017) (dded75a)
  • scrollable-region-focusable: clarify the issue is in safari (#4995) (2567afd), closes WebKit#190870 WebKit#277290
  • scrollable-region-focusable: do not fail scroll areas when all content is visible without scrolling (#4993) (240f8b5)
  • target-size: determine offset using clientRects if target is display:inline (#5012) (69d81c1)
  • target-size: ignore widgets that are inline with other inline elements (#5000) (cf8a3c0)
Changelog

Sourced from axe-core's changelog.

4.11.2 (2026-03-30)

Bug Fixes

  • aria-valid-attr-value: handle multiple aria-errormessage IDs (#4973) (9322148)
  • aria: prevent getOwnedVirtual from returning duplicate nodes (#4987) (99d1e77), closes #4840
  • DqElement: avoid calling constructors with cloneNode (#5013) (88bc57f)
  • existing-rule: aria-busy now shows an error message for a use with unallowed children (#5017) (dded75a)
  • scrollable-region-focusable: clarify the issue is in safari (#4995) (2567afd), closes WebKit#190870 WebKit#277290
  • scrollable-region-focusable: do not fail scroll areas when all content is visible without scrolling (#4993) (240f8b5)
  • target-size: determine offset using clientRects if target is display:inline (#5012) (69d81c1)
  • target-size: ignore widgets that are inline with other inline elements (#5000) (cf8a3c0)
Commits
  • 41093da chore(release): v4.11.2 (#5049)
  • 66c26aa chore(release): 4.11.2
  • cf8a3c0 fix(target-size): ignore widgets that are inline with other inline elements (...
  • 3d80a37 chore: add CLAUDE.md and pull request checklist (#5035)
  • a09204f chore: bump the npm-low-risk group with 6 updates (#5020)
  • 431f621 chore: bump jsdom from 27.4.0 to 28.1.0 (#5021)
  • 68aab66 test: fix chromedriver 146 failing to create session (#5026)
  • dded75a fix(existing-rule): aria-busy now shows an error message for a use with unall...
  • 69d81c1 fix(target-size): determine offset using clientRects if target is display:inl...
  • 99d1e77 fix(aria): prevent getOwnedVirtual from returning duplicate nodes (#4987)
  • Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.10.12 to 2.10.14

Release notes

Sourced from baseline-browser-mapping's releases.

v2.9.3 - remove process.loadEnvFile()

What's Changed

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

Commits
  • 7058e24 Patch to 2.10.14 because browser or feature data changed
  • 406bd81 Browser or feature data changed
  • 34613b9 Bump serialize-javascript from 7.0.4 to 7.0.5 (#130)
  • fdb0665 Bump picomatch (#129)
  • 7bbeaa0 Bump flatted from 3.3.3 to 3.4.2 (#128)
  • 10a3d63 Updating static site
  • 10fcf19 Patch to 2.10.13 because browser or feature data changed
  • 5db8ac5 Browser or feature data changed
  • 74c2c12 Updating static site
  • See full diff in compare view

Updates browserslist from 4.28.1 to 4.28.2

Release notes

Sourced from browserslist's releases.

4.28.2

Changelog

Sourced from browserslist's changelog.

4.28.2

Commits

Updates eslint-import-resolver-node from 0.3.9 to 0.3.10

Release notes

Sourced from eslint-import-resolver-node's releases.

no-reassign

Added rule no-reassign, made some mistakes publishing to npm. 😳

Changelog

Sourced from eslint-import-resolver-node's changelog.

v0.3.10 - 2026-04-01

  • [deps] update is-core-module, resolve
  • [meta] add repository.directory field
  • [refactor] avoid hoisting
Commits

Updates node-releases from 2.0.36 to 2.0.37

Commits

Updates resolve from 1.22.11 to 2.0.0-next.6

Commits
  • f637b5c v2.0.0-next.6
  • ab587d7 [New] add exports support via engines and exportsCategory options
  • 1894ba4 [Refactor] use non-hoisted declarations instead of expressions
  • e606385 [Robustness] use es-errors
  • 13df854 [Dev Deps] update @ljharb/eslint-config, npmignore
  • d086095 [readme] replace runkit CI badge with shields.io check-runs badge
  • 121c276 [Performance] avoid an unnecessary slice
  • 0a42ec2 [meta] add DCO
  • 0cfd54e [readme] add CII Best Practices badge
  • 79f0d81 [eslint] add eslint optional peer dep
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.5.0` | `25.5.1` |
| [axe-core](https://github.com/dequelabs/axe-core) | `4.11.1` | `4.11.2` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.12` | `2.10.14` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.28.2` |
| [eslint-import-resolver-node](https://github.com/import-js/eslint-plugin-import/tree/HEAD/resolvers/node) | `0.3.9` | `0.3.10` |
| [node-releases](https://github.com/chicoxyzzy/node-releases) | `2.0.36` | `2.0.37` |
| [resolve](https://github.com/browserify/resolve) | `1.22.11` | `2.0.0-next.6` |


Updates `@types/node` from 25.5.0 to 25.5.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `axe-core` from 4.11.1 to 4.11.2
- [Release notes](https://github.com/dequelabs/axe-core/releases)
- [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core@v4.11.1...v4.11.2)

Updates `baseline-browser-mapping` from 2.10.12 to 2.10.14
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.12...v2.10.14)

Updates `browserslist` from 4.28.1 to 4.28.2
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.28.2)

Updates `eslint-import-resolver-node` from 0.3.9 to 0.3.10
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/resolvers/node/CHANGELOG.md)
- [Commits](https://github.com/import-js/eslint-plugin-import/commits/v0.3.10/resolvers/node)

Updates `node-releases` from 2.0.36 to 2.0.37
- [Commits](https://github.com/chicoxyzzy/node-releases/commits/v2.0.37)

Updates `resolve` from 1.22.11 to 2.0.0-next.6
- [Commits](browserify/resolve@v1.22.11...v2.0.0-next.6)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: axe-core
  dependency-version: 4.11.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: baseline-browser-mapping
  dependency-version: 2.10.14
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: browserslist
  dependency-version: 4.28.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: eslint-import-resolver-node
  dependency-version: 0.3.10
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: node-releases
  dependency-version: 2.0.37
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: resolve
  dependency-version: 2.0.0-next.6
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot assigned poad Apr 6, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 6, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) April 6, 2026 10:15
@github-actions

github-actions Bot commented Apr 6, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 1db2388.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/@types/node 25.5.1 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 8Found 26/29 approved changesets -- score normalized to 8
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/axe-core 4.11.2 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/baseline-browser-mapping 2.10.14 UnknownUnknown
npm/browserslist 4.28.2 🟢 4.2
Details
CheckScoreReason
Maintained🟢 66 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 6
Code-Review⚠️ 1Found 4/25 approved changesets -- score normalized to 1
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/eslint-import-resolver-node 0.3.10 🟢 5.6
Details
CheckScoreReason
Maintained🟢 94 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 9
Code-Review🟢 6Found 18/30 approved changesets -- score normalized to 6
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/node-exports-info 1.6.0 🟢 4.5
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1015 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
SAST⚠️ 0no SAST tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
npm/node-releases 2.0.37 🟢 3.9
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1013 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
SAST⚠️ 0no SAST tool detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
npm/object.entries 1.1.9 🟢 3.8
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0no SAST tool detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
npm/resolve 2.0.0-next.6 🟢 6.4
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 68 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6
Code-Review⚠️ 0Found 2/29 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 7SAST tool detected but not run on all commits

Scanned Files

  • pnpm-lock.yaml

@github-actions
github-actions Bot merged commit 9ea18fc into main Apr 6, 2026
6 checks passed
@github-actions
github-actions Bot deleted the dependabot/npm_and_yarn/npm-1071c532d2 branch April 6, 2026 10:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant