chore(deps-dev): bump @vitest/expect from 2.1.8 to 3.0.4 #207
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [@vitest/expect](https://github.com/vitest-dev/vitest/tree/HEAD/packages/expect) from 2.1.8 to 3.0.4. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.0.4/packages/expect) --- updated-dependencies: - dependency-name: "@vitest/expect" dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
Minder Vulnerability Report ✅Minder analyzed this PR and found it does not add any new vulnerable dependencies.
|
There was a problem hiding this comment.
Dependency Information
Minder analyzed the dependencies introduced in this pull request and detected that some dependencies do not meet your security profile.
📦 Dependency: @vitest/expect
Trusty Score: 0
📦 Dependency: @vitest/pretty-format
Trusty Score: 0
Scoring details
| Component | Score |
|---|---|
| Package activity | 8.7 |
| Repository activity | 7.7 |
| User activity | 9.7 |
| Provenance | verified_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 24 |
| Number of git tags or releases | 169 |
| Versions matched to tags or releases | 18 |
This package has been digitally signed using sigtore.
| Source repository | https://github.com/vitest-dev/vitest |
| Cerificate Issuer | CN=sigstore-intermediate,O=sigstore.dev |
| GitHub action workflow | .github/workflows/publish.yml |
| Rekor (public ledger) entry | https://search.sigstore.dev/?logIndex=164849956 |
📦 Dependency: @vitest/spy
Trusty Score: 0
Scoring details
| Component | Score |
|---|---|
| Package activity | 8.7 |
| Repository activity | 7.7 |
| User activity | 9.7 |
| Provenance | verified_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 106 |
| Number of git tags or releases | 169 |
| Versions matched to tags or releases | 89 |
This package has been digitally signed using sigtore.
| Source repository | https://github.com/vitest-dev/vitest |
| Cerificate Issuer | CN=sigstore-intermediate,O=sigstore.dev |
| GitHub action workflow | .github/workflows/publish.yml |
| Rekor (public ledger) entry | https://search.sigstore.dev/?logIndex=164849964 |
Alternatives
| Package | Score | Description |
|---|---|---|
| sinon | 0 |
📦 Dependency: @vitest/utils
Trusty Score: 0
📦 Dependency: tinyrainbow
Trusty Score: 0
Scoring details
| Component | Score |
|---|---|
| Package activity | 3.8 |
| Repository activity | 1.9 |
| User activity | 5.7 |
| Provenance | historical_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 6 |
| Number of git tags or releases | 5 |
| Versions matched to tags or releases | 5 |
Pull Request Test Coverage Report for Build 12991365246Details
💛 - Coveralls |
There was a problem hiding this comment.
Dependency Information
Minder analyzed the dependencies introduced in this pull request and detected that some dependencies do not meet your security profile.
📦 Dependency: @vitest/expect
Trusty Score: 0
Proof of Origin (Provenance)
This package has been digitally signed using sigtore.
| Source repository | https://github.com/vitest-dev/vitest |
| Cerificate Issuer | CN=sigstore-intermediate,O=sigstore.dev |
| GitHub action workflow | .github/workflows/publish.yml |
| Rekor (public ledger) entry | https://search.sigstore.dev/?logIndex=152860477 |
Alternatives
| Package | Score | Description |
|---|---|---|
| chai-jest-snapshot | 0 |
📦 Dependency: @vitest/pretty-format
Trusty Score: 0
Scoring details
| Component | Score |
|---|---|
| Package activity | 8.6 |
| Repository activity | 7.7 |
| User activity | 9.5 |
| Provenance | verified_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 24 |
| Number of git tags or releases | 169 |
| Versions matched to tags or releases | 18 |
This package has been digitally signed using sigtore.
| Source repository | https://github.com/vitest-dev/vitest |
| Cerificate Issuer | CN=sigstore-intermediate,O=sigstore.dev |
| GitHub action workflow | .github/workflows/publish.yml |
| Rekor (public ledger) entry | https://search.sigstore.dev/?logIndex=164849956 |
📦 Dependency: @vitest/spy
Trusty Score: 0
Scoring details
| Component | Score |
|---|---|
| Package activity | 8.6 |
| Repository activity | 7.7 |
| User activity | 9.5 |
| Provenance | verified_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 106 |
| Number of git tags or releases | 169 |
| Versions matched to tags or releases | 89 |
This package has been digitally signed using sigtore.
| Source repository | https://github.com/vitest-dev/vitest |
| Cerificate Issuer | CN=sigstore-intermediate,O=sigstore.dev |
| GitHub action workflow | .github/workflows/publish.yml |
| Rekor (public ledger) entry | https://search.sigstore.dev/?logIndex=164849964 |
📦 Dependency: @vitest/utils
Trusty Score: 0
Scoring details
| Component | Score |
|---|---|
| Package activity | 8.6 |
| Repository activity | 7.7 |
| User activity | 9.5 |
| Provenance | verified_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 106 |
| Number of git tags or releases | 169 |
| Versions matched to tags or releases | 89 |
This package has been digitally signed using sigtore.
| Source repository | https://github.com/vitest-dev/vitest |
| Cerificate Issuer | CN=sigstore-intermediate,O=sigstore.dev |
| GitHub action workflow | .github/workflows/publish.yml |
| Rekor (public ledger) entry | https://search.sigstore.dev/?logIndex=164849986 |
📦 Dependency: tinyrainbow
Trusty Score: 0
Scoring details
| Component | Score |
|---|---|
| Package activity | 3.8 |
| Repository activity | 1.9 |
| User activity | 5.7 |
| Provenance | historical_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 6 |
| Number of git tags or releases | 5 |
| Versions matched to tags or releases | 5 |
Alternatives
| Package | Score | Description |
|---|---|---|
| colors | 0 | |
| ansi-colors | 0 |
Bumps @vitest/expect from 2.1.8 to 3.0.4.
Release notes
Sourced from
@vitest/expect's releases.... (truncated)
Commits
9e40437chore: release v3.0.4a8d123cchore(deps): update eslint packages (#7086)33ab8a2chore: release v3.0.3f17918achore: release v3.0.2fa41505fix(expect): fixexpect().resolves/rejectschain typings (#7273)56c5018chore: release v3.0.101600e0chore: release v3.0.08cab960fix: colors onforkspool (#7090)57b671dchore: release v3.0.0-beta.48dd2071chore: fix various typos (#7054)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)