GeezerVison is showing github.com — Bump the dev-dependencies group with 8 updates by dependabot[bot] · Pull Request #313 · EngineScript/EngineScript
Conversation
Bumps the dev-dependencies group with 8 updates:
Updates jsdom from 30.1.3 to 31.0.0
Release notes
Sourced from jsdom's releases.
v31.0.0
Breaking changes
- Changed the optional canvas and image decoding backend from
canvas to @napi-rs/canvas. Install @napi-rs/canvas v1.0.13 or later in the v1.x series alongside jsdom; installing canvas alone no longer enables this support. The new backend provides prebuilt Skia binaries on supported platforms, and rendering and encoded image bytes can differ. Projects using native canvas objects or custom font registration should follow the canvas migration guidance. Added WebP serialization through canvas.toDataURL() and canvas.toBlob(). Fixed image loading to wait for decoding before firing load, discard obsolete source requests, avoid refetching when dimensions change, and prevent failed images from drawing stale contents. Fixed canvas context and serialization behavior, including unsupported context types, read-only ctx.canvas, image-drawing exceptions, MIME type and quality normalization, and asynchronous null results from canvas.toBlob() for empty canvases or encoding failures. (@Brooooooklyn)
- Changed CSS parsing, selector matching, and computed styles to use a new integrated implementation, with substantially expanded support and faster selector queries and repeated style reads. This includes cascade layers, nesting,
@scope, custom-property substitution and registration through @property and CSS.registerProperty(), typed attr(), conditional if(), shadow-tree styling with :host, ::slotted(), and ::part(), pseudo-element computed styles, and constructable stylesheets with document.adoptedStyleSheets and shadowRoot.adoptedStyleSheets. Fixed numerous cascade, shorthand, serialization, and default-style issues; computed declarations now stay live across DOM and stylesheet changes. CSS serialization and computed values can differ from previous releases.
- Changed HTML and XML parsing to pause at blocking scripts until their required resources are ready. The
JSDOM constructor, JSDOM.fromURL(), and JSDOM.fromFile() can now return partially parsed documents. Wait for DOMContentLoaded for the finished tree, or the window's load event for load-delaying resources, checking document.readyState first in case the event has already fired. XML syntax errors encountered after asynchronous parsing resumes are reported through the virtual console as "xml-parsing" errors.
Other changes
- Added
window.reportError(), which dispatches an error event and reports uncanceled errors to the virtual console. (@sarankumar1325)
- Added
element.ariaBrailleLabel and element.ariaBrailleRoleDescription. (@Kjubikstronk)
- Fixed page-completion
load events to fire only on the window. Use window.addEventListener("load", ...) or window.onload instead of listening on the document.
- Fixed
document.open(), including implicit calls from document.write(), to clear event listeners and handlers from the document, its descendants, and its window when replacing the input stream.
- Fixed
document.write() to process successive writes through the parser's input stream, preserve insertion points across nested scripts, and make completed text immediately visible. Script-created input streams now remain open until document.close().
- Fixed dynamically inserted scripts to respect
script.async = false execution order, use their source text and document from preparation time, and avoid executing after adoption into another document. Scripts parsed through inert fragment APIs no longer execute when subsequently inserted.
- Fixed unrelated images, stylesheets, and frames being delayed behind scripts, and resource completion events firing before nested stylesheet imports finish. Cyclic imports no longer prevent completion, and
<style> elements in shadow trees now fire load events.
- Fixed
window.stop() to cancel pending subresource and XMLHttpRequest requests in descendant frames and suppress completion events for canceled loads, while allowing subsequent requests to proceed.
- Fixed repeated
document.close() calls replaying readiness and load events, and incorrect iframe load events when reopening documents from event handlers.
- Fixed memory leaks where pending request interceptor promises retained closed windows, introduced in v28.0.0.
- Fixed focus remaining on elements that become non-focusable after DOM or style changes. Focus now moves asynchronously to the document's viewport, and
element.blur() can release it immediately.
- Fixed
document.hasFocus() returning false before an element is focused or during focus transitions within the document, including inside frames.
- Fixed
\<template> parsing and template.innerHTML serialization in XML documents, including templates with namespace prefixes. (@b84330808)
- Fixed
rect.toJSON() and performance.toJSON() to create their result objects in the method's realm instead of the host Node.js realm.
Commits
825fa8e 31.0.09f2e49a Add ariaBrailleLabel and ariaBrailleRoleDescription4c0a35e Flush text written with document.write()fce11d3 Switch canvas support to @napi-rs/canvas27614bf Fix document.hasFocus() during focus changes627ade2 Implement asynchronous focus fixup8bd17a2 Implement reportError()5ae66cf Update webidl2js and remove IDL workaroundsce5a100 Align development scripts and CI9cc717f Adopt ESLint config v6 and oxfmt- Additional commits viewable in compare view
Updates stylelint from 17.16.0 to 18.0.0
Release notes
Sourced from stylelint's releases.
18.0.0
It contains 13 breaking changes, which we've detailed in the migrating to 18.0.0 guide. It also adds 4 new rules and fixes 16 bugs.
- Removed: support for end-of-life and older versions of Node.js (#9486) (
@jeddy3).
- Removed: support for CommonJS-style filename-less and extension-less locator paths (#9545) (
@jeddy3).
- Removed: resolution of packages from the global
node_modules directory (#9534) (@jeddy3).
- Removed:
context.fix property (#9505) (@jeddy3).
- Removed:
declaration-block-single-line-max-declarations rule (#9565) (@jeddy3).
- Removed:
*syntax options from declaration-property-value-no-unknown (#9487) (@jeddy3).
- Removed:
ignoreSelectors option from selector-max-specificity (#9579) (@jeddy3).
- Changed: TypeScript config files to be loaded by Node.js's built-in type stripping (#9489) (
@jeddy3).
- Changed: the CLI to parse arguments with
node:util.parseArgs (#9508) (@jeddy3).
- Changed:
globbyOptions to support only a subset of options (#9500) (@jeddy3).
- Changed:
function-no-unknown to use the CSSTree Syntax Reference for known functions and to ignore vendor-prefixed functions (#9574) (@jeddy3).
- Changed: color detection to use new
color option with node:util.styleText (#9529) (@jeddy3).
- Changed: hyperlink detection (#9536) (
@jeddy3).
- Added:
at-charset-rule-no-invalid rule (#9509) (@firefoxic).
- Added:
declaration-property-custom-property-allowed-list rule (#9542) (@jeddy3).
- Added:
value-no-invalid rule (#9507) (@jeddy3).
- Added:
value-type-custom-property-required-list experimental rule (#9572) (@jeddy3).
- Added: stable support for
processors configuration property (#9543) (@jeddy3).
- Added: stable support for
referenceFiles configuration property (#9598) (@jeddy3).
- Added:
result.stylelint.postcss property for plugins (#9594) (@jeddy3).
- Added:
stylelint.version property (#9595) (@ybiquitous).
- Added:
languageOptions.syntax support to function-no-unknown (#9574) (@jeddy3).
- Fixed:
referenceFiles performance (#9573) (@jeddy3).
- Fixed: import and cache performance by replacing
file-entry-cache (#9593) (@jeddy3).
- Fixed: import performance by lazily loading
css-tree (#9580) (@jeddy3).
- Fixed: exit code when all errors in a file are suppressed and other problems are reported (#9528) (
@schreibse).
- Fixed:
--fix for files where the only change is the removal of a byte order mark (#9512) (@firefoxic).
- Fixed:
Config['extends'] type for configuration objects (#9526) (@firefoxic).
- Fixed:
at-rule-descriptor-value-no-unknown false negatives for var() (#9614) (@jeddy3).
- Fixed:
custom-property-{pattern,no-missing-var-function} and *-no-unknown false positives and negatives for @property with a list of names (#9571) (@jeddy3).
- Fixed:
custom-property-no-missing-var-function false negatives for custom properties defined in referenceFiles (#9570) (@jeddy3).
- Fixed:
custom-property-no-missing-var-function false positives for recently introduced properties (#9567) (@jeddy3).
- Fixed:
declaration-block-no-redundant-longhand-properties and declaration-block-no-shorthand-property-overrides false negatives for contain-intrinsic-size (#9550) (@firefoxic).
- Fixed:
declaration-block-no-shorthand-property-overrides false negatives for flow-relative properties overridden by physical shorthands (#9549) (@firefoxic).
- Fixed:
declaration-property-value-no-unknown false negatives for values containing known custom properties (#9537) (@jeddy3).
- Fixed:
declaration-property-value-no-unknown false negatives for values containing registered custom properties (#9566) (@jeddy3).
- Fixed:
declaration-property-value-no-unknown false positives and negatives for files included in a referenceFiles bundle (#9358) (@romainmenke).
- Fixed:
property-layout-mappings false negatives for physical shorthand properties (#9615) (@jeddy3).
18.0.0-next.0
This is a prerelease of our next major. Migration guide.
- Removed: support for end-of-life and older versions of Node.js (#9486) (
@jeddy3).
- Removed: support for CommonJS-style filename-less and extension-less locator paths (#9545) (
@jeddy3).
- Removed: resolution of packages from the global
node_modules directory (#9534) (@jeddy3).
- Removed:
declaration-block-single-line-max-declarations rule (#9565) (@jeddy3).
- Removed:
context.fix property (#9505) (@jeddy3).
... (truncated)
Changelog
Sourced from stylelint's changelog.
18.0.0 - 2026-11-03
It contains 13 breaking changes, which we've detailed in the migrating to 18.0.0 guide. It also adds 4 new rules and fixes 16 bugs.
- Removed: support for end-of-life and older versions of Node.js (#9486) (
@jeddy3).
- Removed: support for CommonJS-style filename-less and extension-less locator paths (#9545) (
@jeddy3).
- Removed: resolution of packages from the global
node_modules directory (#9534) (@jeddy3).
- Removed:
context.fix property (#9505) (@jeddy3).
- Removed:
declaration-block-single-line-max-declarations rule (#9565) (@jeddy3).
- Removed:
*syntax options from declaration-property-value-no-unknown (#9487) (@jeddy3).
- Removed:
ignoreSelectors option from selector-max-specificity (#9579) (@jeddy3).
- Changed: TypeScript config files to be loaded by Node.js's built-in type stripping (#9489) (
@jeddy3).
- Changed: the CLI to parse arguments with
node:util.parseArgs (#9508) (@jeddy3).
- Changed:
globbyOptions to support only a subset of options (#9500) (@jeddy3).
- Changed:
function-no-unknown to use the CSSTree Syntax Reference for known functions and to ignore vendor-prefixed functions (#9574) (@jeddy3).
- Changed: color detection to use new
color option with node:util.styleText (#9529) (@jeddy3).
- Changed: hyperlink detection (#9536) (
@jeddy3).
- Added:
at-charset-rule-no-invalid rule (#9509) (@firefoxic).
- Added:
declaration-property-custom-property-allowed-list rule (#9542) (@jeddy3).
- Added:
value-no-invalid rule (#9507) (@jeddy3).
- Added:
value-type-custom-property-required-list experimental rule (#9572) (@jeddy3).
- Added: stable support for
processors configuration property (#9543) (@jeddy3).
- Added: stable support for
referenceFiles configuration property (#9598) (@jeddy3).
- Added:
result.stylelint.postcss property for plugins (#9594) (@jeddy3).
- Added:
stylelint.version property (#9595) (@ybiquitous).
- Added:
languageOptions.syntax support to function-no-unknown (#9574) (@jeddy3).
- Fixed:
referenceFiles performance (#9573) (@jeddy3).
- Fixed: import and cache performance by replacing
file-entry-cache (#9593) (@jeddy3).
- Fixed: import performance by lazily loading
css-tree (#9580) (@jeddy3).
- Fixed: exit code when all errors in a file are suppressed and other problems are reported (#9528) (
@schreibse).
- Fixed:
--fix for files where the only change is the removal of a byte order mark (#9512) (@firefoxic).
- Fixed:
Config['extends'] type for configuration objects (#9526) (@firefoxic).
- Fixed:
at-rule-descriptor-value-no-unknown false negatives for var() (#9614) (@jeddy3).
- Fixed:
custom-property-{pattern,no-missing-var-function} and *-no-unknown false positives and negatives for @property with a list of names (#9571) (@jeddy3).
- Fixed:
custom-property-no-missing-var-function false negatives for custom properties defined in referenceFiles (#9570) (@jeddy3).
- Fixed:
custom-property-no-missing-var-function false positives for recently introduced properties (#9567) (@jeddy3).
- Fixed:
declaration-block-no-redundant-longhand-properties and declaration-block-no-shorthand-property-overrides false negatives for contain-intrinsic-size (#9550) (@firefoxic).
- Fixed:
declaration-block-no-shorthand-property-overrides false negatives for flow-relative properties overridden by physical shorthands (#9549) (@firefoxic).
- Fixed:
declaration-property-value-no-unknown false negatives for values containing known custom properties (#9537) (@jeddy3).
- Fixed:
declaration-property-value-no-unknown false negatives for values containing registered custom properties (#9566) (@jeddy3).
- Fixed:
declaration-property-value-no-unknown false positives and negatives for files included in a referenceFiles bundle (#9358) (@romainmenke).
- Fixed:
property-layout-mappings false negatives for physical shorthand properties (#9615) (@jeddy3).
Commits
7c49e18 Release 18.0.0 (#9628)88973f0 Prepare 18.0.0 (#9627)c775354 Fix declaration-property-value-no-unknown false positives and negatives for...9040322 Change ignore* for value-type-custom-property-required-list (#9626)106c1f0 Document custom property example more precisely in the customising guide (#9624)221d9b8 Document overrides more prominently in customizing guide (#9623)6c923ef Document configuration-based approach to rules (#9622)5290eea Document use cases in rule extended description of each rule (#9621)a1d7ca9 Bump ignore from 7.0.12 to 7.0.14 (#9620)0009a60 Bump npm-run-all2 from 9.0.3 to 9.0.4 (#9619)- Additional commits viewable in compare view
Updates stylelint-config-standard from 40.0.0 to 41.0.0
Release notes
Sourced from stylelint-config-standard's releases.
41.0.0
- Removed:
declaration-block-single-line-max-declarations rule.
- Removed:
stylelint less than 18.0.0 from peer dependencies.
- Removed: support for end-of-life and older versions of Node.js.
- Changed: updated to
[email protected].
41.0.0-next.0
- Removed:
declaration-block-single-line-max-declarations rule.
- Removed:
stylelint less than 18.0.0 from peer dependencies.
- Removed: support for end-of-life and older versions of Node.js.
- Changed: updated to
[email protected].
Changelog
Sourced from stylelint-config-standard's changelog.
41.0.0
- Removed:
declaration-block-single-line-max-declarations rule.
- Removed:
stylelint less than 18.0.0 from peer dependencies.
- Removed: support for end-of-life and older versions of Node.js.
- Changed: updated to
[email protected].
Commits
Install script changes
This version modifies prepare script that runs during installation. Review the package contents before updating.
Updates baseline-browser-mapping from 2.11.34 to 2.11.35
Commits
Updates caniuse-lite from 1.0.30001820 to 1.0.30001823
Commits
Updates electron-to-chromium from 1.5.472 to 1.5.478
Commits
Updates semver from 7.8.5 to 7.8.6
Release notes
Sourced from semver's releases.
v7.8.6
7.8.6 (2026-11-02)
Bug Fixes
Chores
Changelog
Sourced from semver's changelog.
7.8.6 (2026-11-02)
Bug Fixes
Chores
Commits
Updates undici from 8.12.3 to 8.12.4
Release notes
Sourced from undici's releases.
v8.12.4
⚠️ Security Fixes
This release fixes six vulnerabilities.
Undici 8.12.2 and 8.12.3 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.
A shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.
A cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.
The redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.
A downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.
fetch() could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.
What's Changed
... (truncated)
Commits
779ee3e Bumped v8.12.4 (#6162)10fa822 docs: remove security release notes6228fc5 docs: add security release notes1dd2657 test(cache): align redirect caching with hop policy8ea1d61 fix(cache): detect an actual redirect, not a plain revalidation4257261 test(cache): cover credentialed revalidation refreshaa7ccff fix(cache): treat proxy-authorization as a credential when caching redirects8cf5ce1 test(cache): cover proxy-authorization credential on same-origin redirect26c42c2 fix(cache): do not cache credential-bearing same-origin redirects under the a...e958661 test: cover decompress too-many-content-encodings throw on async cache replay- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Labels
The following labels could not be found: javascript. Please create it before Dependabot can add it to a pull request.
Please fix the above issues or remove invalid values from dependabot.yml.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
Thanks for contributing to EngineScript! 🎉
If your PR fixes an issue or relates to a specific environment, please consider including the sanitized output
of es.debug to show the environment where you tested your changes.
Remember to remove any sensitive information before sharing.
We'll review your PR soon!
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Dependency Review
The following issues were found:- ✅ 0 vulnerable package(s)
- ✅ 0 package(s) with incompatible licenses
- ✅ 0 package(s) with invalid SPDX license definitions
- ✅ 0 package(s) with unknown licenses.
- ⚠️ 1 packages with OpenSSF Scorecard issues.
See the Details below.OpenSSF Scorecard
Scorecard details
| Package | Version | Score | Details |
|---|
| npm/baseline-browser-mapping | 2.11.35 |
Unknown | Unknown |
| npm/bcp-47 | 2.1.2 |
🟢 3 | Details| Check | Score | Reason |
|---|
| Maintained | ⚠️ 2 | 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 | | Packaging | ⚠️ -1 | packaging workflow not detected | | Code-Review | ⚠️ 0 | Found 2/30 approved changesets -- score normalized to 0 | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Security-Policy | ⚠️ 0 | security policy file not detected | | License | 🟢 10 | license file detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | Branch-Protection | ⚠️ 0 | branch protection not enabled on development/release branches | | Signed-Releases | ⚠️ -1 | no releases found | | SAST | ⚠️ 0 | SAST tool is not run on all commits -- score normalized to 0 |
|
| npm/bcp-47-match | 2.0.3 |
⚠️ 2.5 | Details| Check | Score | Reason |
|---|
| Code-Review | ⚠️ 0 | Found 1/30 approved changesets -- score normalized to 0 | | Maintained | ⚠️ 0 | 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Packaging | ⚠️ -1 | packaging workflow not detected | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Security-Policy | ⚠️ 0 | security policy file not detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ 0 | Project has not signed or included provenance with any releases. | | Branch-Protection | ⚠️ 0 | branch protection not enabled on development/release branches | | SAST | ⚠️ 0 | SAST tool is not run on all commits -- score normalized to 0 |
|
| npm/caniuse-lite | 1.0.30001823 |
🟢 4.4 | Details| Check | Score | Reason |
|---|
| Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Packaging | ⚠️ -1 | packaging workflow not detected | | Code-Review | ⚠️ 0 | Found 1/28 approved changesets -- score normalized to 0 | | Maintained | 🟢 9 | 11 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 9 | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Security-Policy | ⚠️ 0 | security policy file not detected | | License | 🟢 10 | license file detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | Signed-Releases | ⚠️ -1 | no releases found | | Branch-Protection | ⚠️ 0 | branch protection not enabled on development/release branches | | SAST | ⚠️ 0 | SAST tool is not run on all commits -- score normalized to 0 |
|
| npm/cosmiconfig | 10.0.1 |
🟢 5 | Details| Check | Score | Reason |
|---|
| Code-Review | ⚠️ 2 | Found 7/30 approved changesets -- score normalized to 2 | | Token-Permissions | 🟢 10 | GitHub workflow tokens follow principle of least privilege | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Packaging | ⚠️ -1 | packaging workflow not detected | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Maintained | 🟢 5 | 5 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5 | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Security-Policy | ⚠️ 0 | security policy file not detected | | License | 🟢 10 | license file detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | Signed-Releases | ⚠️ -1 | no releases found | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | SAST | ⚠️ 0 | SAST tool is not run on all commits -- score normalized to 0 |
|
| npm/electron-to-chromium | 1.5.478 |
Unknown | Unknown |
| npm/fdir | 6.5.0 |
🟢 3.3 | Details| Check | Score | Reason |
|---|
| Code-Review | 🟢 5 | Found 14/28 approved changesets -- score normalized to 5 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Packaging | ⚠️ -1 | packaging workflow not detected | | Maintained | ⚠️ 0 | 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Security-Policy | ⚠️ 0 | security policy file not detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Branch-Protection | ⚠️ 0 | branch protection not enabled on development/release branches | | Signed-Releases | ⚠️ -1 | no releases found | | SAST | ⚠️ 0 | SAST tool is not run on all commits -- score normalized to 0 |
|
| npm/jsdom | 31.0.0 |
🟢 6.8 | Details| Check | Score | Reason |
|---|
| Code-Review | ⚠️ 2 | Found 7/30 approved changesets -- score normalized to 2 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Maintained | 🟢 10 | 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 | | Token-Permissions | 🟢 10 | GitHub workflow tokens follow principle of least privilege | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Pinned-Dependencies | 🟢 3 | dependency not pinned by hash detected -- score normalized to 3 | | License | 🟢 9 | license file detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | Signed-Releases | ⚠️ -1 | no releases found | | Security-Policy | 🟢 10 | security policy file detected | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | Packaging | 🟢 10 | packaging workflow detected | | SAST | ⚠️ 0 | SAST tool is not run on all commits -- score normalized to 0 |
|
| npm/parse5-parser-stream | 8.1.0 |
🟢 7.1 | Details| Check | Score | Reason |
|---|
| Maintained | 🟢 10 | 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Security-Policy | 🟢 10 | security policy file detected | | Code-Review | 🟢 5 | Found 6/12 approved changesets -- score normalized to 5 | | Packaging | ⚠️ -1 | packaging workflow not detected | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | SAST | 🟢 10 | SAST tool is run on all commits |
|
| npm/semver | 7.8.6 |
🟢 5.5 | Details| Check | Score | Reason |
|---|
| Maintained | ⚠️ 0 | 1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Packaging | ⚠️ -1 | packaging workflow not detected | | Security-Policy | 🟢 10 | security policy file detected | | Code-Review | 🟢 8 | Found 14/16 approved changesets -- score normalized to 8 | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | License | 🟢 10 | license file detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | Signed-Releases | ⚠️ -1 | no releases found | | SAST | 🟢 9 | SAST tool detected but not run on all commits |
|
| npm/stylelint | 18.0.0 |
🟢 7.6 | Details| Check | Score | Reason |
|---|
| Maintained | 🟢 10 | 30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10 | | Packaging | ⚠️ -1 | packaging workflow not detected | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Code-Review | 🟢 10 | all changesets reviewed | | Token-Permissions | 🟢 8 | detected GitHub workflow tokens with excessive permissions | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Pinned-Dependencies | 🟢 7 | dependency not pinned by hash detected -- score normalized to 7 | | CII-Best-Practices | ⚠️ 2 | badge detected: InProgress | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Security-Policy | 🟢 4 | security policy file detected | | Branch-Protection | 🟢 4 | branch protection is not maximal on development and all release branches | | SAST | 🟢 10 | SAST tool is run on all commits |
|
| npm/stylelint-config-recommended | 19.0.0 |
🟢 7.7 | Details| Check | Score | Reason |
|---|
| Code-Review | 🟢 10 | all changesets reviewed | | Maintained | 🟢 10 | 21 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Packaging | ⚠️ -1 | packaging workflow not detected | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | Token-Permissions | 🟢 8 | detected GitHub workflow tokens with excessive permissions | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Security-Policy | 🟢 4 | security policy file detected | | Branch-Protection | 🟢 4 | branch protection is not maximal on development and all release branches | | SAST | 🟢 10 | SAST tool is run on all commits |
|
| npm/stylelint-config-standard | 41.0.0 |
🟢 7.7 | Details| Check | Score | Reason |
|---|
| Packaging | ⚠️ -1 | packaging workflow not detected | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Code-Review | 🟢 10 | all changesets reviewed | | Maintained | 🟢 10 | 24 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | Token-Permissions | 🟢 8 | detected GitHub workflow tokens with excessive permissions | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | License | 🟢 10 | license file detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | Signed-Releases | ⚠️ -1 | no releases found | | Branch-Protection | 🟢 4 | branch protection is not maximal on development and all release branches | | Security-Policy | 🟢 4 | security policy file detected | | SAST | 🟢 10 | SAST tool is run on all commits |
|
| npm/tinyglobby | 0.2.17 |
Unknown | Unknown |
| npm/undici | 8.12.4 |
🟢 7.6 | Details| Check | Score | Reason |
|---|
| Code-Review | ⚠️ 2 | Found 6/26 approved changesets -- score normalized to 2 | | Maintained | 🟢 10 | 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 | | Dependency-Update-Tool | 🟢 10 | update tool detected | | Security-Policy | 🟢 10 | security policy file detected | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Binary-Artifacts | 🟢 8 | binaries present in source code | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Pinned-Dependencies | 🟢 6 | dependency not pinned by hash detected -- score normalized to 6 | | SAST | 🟢 10 | SAST tool is run on all commits | | Fuzzing | 🟢 10 | project is fuzzed | | Vulnerabilities | 🟢 7 | 3 existing vulnerabilities detected | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | Packaging | 🟢 10 | packaging workflow detected | | CI-Tests | 🟢 10 | 10 out of 10 merged PRs checked by a CI test -- score normalized to 10 | | Contributors | 🟢 10 | project has 71 contributing companies or organizations |
|
| npm/write-file-atomic | 8.0.0 |
🟢 5.7 | Details| Check | Score | Reason |
|---|
| Code-Review | 🟢 10 | all changesets reviewed | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Security-Policy | 🟢 10 | security policy file detected | | Maintained | ⚠️ 0 | 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 | | Packaging | ⚠️ -1 | packaging workflow not detected | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | SAST | 🟢 9 | SAST tool detected but not run on all commits |
|
Scanned Files
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Up to standards ✅
🟢 Issues 0 issues
Results:
0 new issues
View in Codacy
🟢 Metrics 0 complexity · 0 duplication
| Metric |
Results |
| Complexity |
0 |
| Duplication |
0 |
View in Codacy
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|