Skip to content

Update JS dev dependencies (major)#14

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-js-dev-dependencies
Open

Update JS dev dependencies (major)#14
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-js-dev-dependencies

Conversation

@renovate
Copy link
Copy Markdown

@renovate renovate Bot commented Oct 28, 2025

This PR contains the following updates:

Package Change Age Confidence
@types/node (source) ^22.5.5 -> ^24.0.0 age confidence
@types/node (source) ^22.5.5 -> ^24.0.0 age confidence
@vitejs/plugin-react-swc (source) ^3.5.0 -> ^4.0.0 age confidence
@vitejs/plugin-react-swc (source) ^3.5.0 -> ^4.0.0 age confidence
eslint-plugin-react-hooks (source) ^5.1.0-rc.0 -> ^7.0.0 age confidence
eslint-plugin-react-hooks (source) ^5.1.0-rc.0 -> ^7.0.0 age confidence
globals ^15.15.0 -> ^16.0.0 age confidence
tailwindcss (source) ^3.4.11 -> ^4.0.0 age confidence
tailwindcss (source) ^3.4.11 -> ^4.0.0 age confidence
vite (source) ^5.4.1 -> ^7.0.0 age confidence
vite (source) ^5.4.1 -> ^7.0.0 age confidence

Release Notes

vitejs/vite-plugin-react (@​vitejs/plugin-react-swc)

v4.2.0

Compare Source

Add @vitejs/plugin-react-swc/preamble virtual module for SSR HMR (#​890)

SSR applications can now initialize HMR runtime by importing @vitejs/plugin-react-swc/preamble at the top of their client entry instead of manually calling transformIndexHtml. This simplifies SSR setup for applications that don't use the transformIndexHtml API.

Use SWC when useAtYourOwnRisk_mutateSwcOptions is provided (#​951)

Previously, this plugin did not use SWC if plugins were not provided even if useAtYourOwnRisk_mutateSwcOptions was provided. This is now fixed.

v4.1.0

Compare Source

Set SWC cacheRoot options

This is set to {viteCacheDir}/swc and override the default of .swc.

Perf: simplify refresh wrapper generation (#​835)

v4.0.1

Compare Source

Set optimizeDeps.rollupOptions.transform.jsx instead of optimizeDeps.rollupOptions.jsx for rolldown-vite (#​735)

optimizeDeps.rollupOptions.jsx is going to be deprecated in favor of optimizeDeps.rollupOptions.transform.jsx.

v4.0.0

Compare Source

v3.11.0

Compare Source

Add HMR support for compound components (#​518)

HMR now works for compound components like this:

const Root = () => <div>Accordion Root</div>
const Item = () => <div>Accordion Item</div>

export const Accordion = { Root, Item }
Return Plugin[] instead of PluginOption[] (#​537)

The return type has changed from react(): PluginOption[] to more specialized type react(): Plugin[]. This allows for type-safe manipulation of plugins, for example:

// previously this causes type errors
react()
  .map(p => ({ ...p, applyToEnvironment: e => e.name === 'client' }))

v3.10.2

Compare Source

Suggest @vitejs/plugin-react-oxc if rolldown-vite is detected #​491

Emit a log which recommends @vitejs/plugin-react-oxc when rolldown-vite is detected to improve performance and use Oxc under the hood. The warning can be disabled by setting disableOxcRecommendation: true in the plugin options.

Use optimizeDeps.rollupOptions instead of optimizeDeps.esbuildOptions for rolldown-vite #​489

This suppresses the warning about optimizeDeps.esbuildOptions being deprecated in rolldown-vite.

Add Vite 7-beta to peerDependencies range #​497

React plugins are compatible with Vite 7, this removes the warning when testing the beta.

v3.10.1

Compare Source

Add explicit semicolon in preambleCode #​485

This fixes an edge case when using HTML minifiers that strips line breaks aggressively.

v3.10.0

Compare Source

Add filter for rolldown-vite #​470

Added filter so that it is more performant when running this plugin with rolldown-powered version of Vite.

Skip HMR preamble in Vitest browser mode #​478

This was causing annoying Sourcemap for "/@&#8203;react-refresh" points to missing source files and is unnecessary in test mode.

Skip HMR for JSX files with hooks #​480

This removes the HMR warning for hooks with JSX.

v3.9.0

Compare Source

Make compatible with rolldown-vite

This plugin is now compatible with rolldown-powered version of Vite.

v3.8.1

Compare Source

Remove WebContainers warning #​268

SWC is now supported in WebContainers 🎉

v3.8.0

Compare Source

Add useAtYourOwnRisk_mutateSwcOptions option

The future of Vite is with OXC, and from the beginning this was a design choice to not exposed too many specialties from SWC so that Vite React users can move to another transformer later.
Also debugging why some specific version of decorators with some other unstable/legacy feature doesn't work is not fun, so we won't provide support for it, hence the name useAtYourOwnRisk.

react({
  useAtYourOwnRisk_mutateSwcOptions(options) {
    options.jsc.parser.decorators = true;
    options.jsc.transform.decoratorVersion = "2022-03";
  },
});

v3.7.2

Compare Source

Add Vite 6 to peerDependencies range #​207

Thanks @​RobinTail

Revert throw when refresh runtime is loaded twice #​237

Revert the throw when refresh runtime is loaded twice to enable usage in micro frontend apps. This was added to help fix setup usage, and this is not worth an annoying warning for others or a config parameter.

This revert was done in the Babel plugin last year and I didn't port it back.

facebook/react (eslint-plugin-react-hooks)

v7.0.1

Compare Source

v7.0.0

Compare Source

This release slims down presets to just 2 configurations (recommended and recommended-latest), and all compiler rules are enabled by default.

  • Breaking: Removed recommended-latest-legacy and flat/recommended configs. The plugin now provides recommended (legacy and flat configs with all recommended rules), and recommended-latest (legacy and flat configs with all recommended rules plus new bleeding edge experimental compiler rules). (@​poteto in #​34757)

v6.1.1

Compare Source

Note: 6.1.0 accidentally allowed use of recommended without flat config, causing errors when used with ESLint v9's defineConfig() helper. This has been fixed in 6.1.1.

v6.1.0

Compare Source

Note: Version 6.0.0 was mistakenly released and immediately deprecated and untagged on npm. This is the first official 6.x major release and includes breaking changes.

  • Breaking: Require Node.js 18 or newer. (@​michaelfaith in #​32458)
  • Breaking: Flat config is now the default recommended preset. Legacy config moved to recommended-legacy. (@​michaelfaith in #​32457)
  • New Violations: Disallow calling use within try/catch blocks. (@​poteto in #​34040)
  • New Violations: Disallow calling useEffectEvent functions in arbitrary closures. (@​jbrown215 in #​33544)
  • Handle React.useEffect in addition to useEffect in rules-of-hooks. (@​Ayc0 in #​34076)
  • Added react-hooks settings config option that to accept additionalEffectHooks that are used across exhaustive-deps and rules-of-hooks rules. (@​jbrown215) in #​34497

v6.0.0

Compare Source

Accidentally released. See 6.1.0 for the actual changes.

v5.2.0

Compare Source

v5.1.0

Compare Source

sindresorhus/globals (globals)

v16.5.0

Compare Source


v16.4.0

Compare Source


v16.3.0

Compare Source


v16.2.0

Compare Source


v16.1.0

Compare Source


v16.0.0

Compare Source

Breaking
  • The serviceworker globals are now generated from browsers (#​281) 039ed51
    • It's a breaking change as a few globals have been removed.

tailwindlabs/tailwindcss (tailwindcss)

v4.1.16

Compare Source

Fixed
  • Discard candidates with an empty data type (#​19172)
  • Fix canonicalization of arbitrary variants with attribute selectors (#​19176)
  • Fix invalid colors due to nested & (#​19184)
  • Improve canonicalization for & > :pseudo and & :pseudo arbitrary variants (#​19178)

v4.1.15

Compare Source

Fixed
  • Fix Safari devtools rendering issue due to color-mix fallback (#​19069)
  • Suppress Lightning CSS warnings about :deep, :slotted, and :global (#​19094)
  • Fix resolving theme keys when starting with the name of another theme key in JS configs and plugins (#​19097)
  • Allow named groups in combination with not-*, has-*, and in-* (#​19100)
  • Prevent important utilities from affecting other utilities (#​19110)
  • Don’t index into strings with the theme(…) function (#​19111)
  • Fix parsing issue when \t is used in at-rules (#​19130)
  • Upgrade: Canonicalize utilities containing 0 values (#​19095)
  • Upgrade: Migrate deprecated break-words to wrap-break-word (#​19157)
Changed

v4.1.14

Compare Source

Fixed
  • Handle ' syntax in ClojureScript when extracting classes (#​18888)
  • Handle @variant inside @custom-variant (#​18885)
  • Merge suggestions when using @utility (#​18900)
  • Ensure that file system watchers created when using the CLI are always cleaned up (#​18905)
  • Do not generate grid-column utilities when configuring grid-column-start or grid-column-end (#​18907)
  • Do not generate grid-row utilities when configuring grid-row-start or grid-row-end (#​18907)
  • Prevent duplicate CSS when overwriting a static utility with a theme key (#​18056)
  • Show Lightning CSS warnings (if any) when optimizing/minifying (#​18918)
  • Use default export condition for @tailwindcss/vite (#​18948)
  • Re-throw errors from PostCSS nodes (#​18373)
  • Detect classes in markdown inline directives (#​18967)
  • Ensure files with only @theme produce no output when built (#​18979)
  • Support Maud templates when extracting classes (#​18988)
  • Upgrade: Do not migrate variant = 'outline' during upgrades (#​18922)
  • Upgrade: Show version mismatch (if any) when running upgrade tool (#​19028)
  • Upgrade: Ensure first class inside className is migrated (#​19031)
  • Upgrade: Migrate classes inside *ClassName and *Class attributes (#​19031)

v4.1.13

Compare Source

Changed
  • Drop warning from browser build (#​18731)
  • Drop exact duplicate declarations when emitting CSS (#​18809)
Fixed
  • Don't transition visibility when using transition (#​18795)
  • Discard matched variants with unknown named values (#​18799)
  • Discard matched variants with non-string values (#​18799)
  • Show suggestions for known matchVariant values (#​18798)
  • Replace deprecated clip with clip-path in sr-only (#​18769)
  • Hide internal fields from completions in matchUtilities (#​18820)
  • Ignore .vercel folders by default (can be overridden by @source … rules) (#​18855)
  • Consider variants starting with @- to be invalid (e.g. @-2xl:flex) (#​18869)
  • Do not allow custom variants to start or end with a - or _ (#​18867, #​18872)
  • Upgrade: Migrate aria theme keys to @custom-variant (#​18815)
  • Upgrade: Migrate data theme keys to @custom-variant (#​18816)
  • Upgrade: Migrate supports theme keys to @custom-variant (#​18817)

v4.1.12

Compare Source

Fixed
  • Don't consider the global important state in @apply (#​18404)
  • Add missing suggestions for flex-<number> utilities (#​18642)
  • Fix trailing ) from interfering with extraction in Clojure keywords (#​18345)
  • Detect classes inside Elixir charlist, word list, and string sigils (#​18432)
  • Track source locations through @plugin and @config (#​18345)
  • Allow boolean values of process.env.DEBUG in @tailwindcss/node (#​18485)
  • Ignore consecutive semicolons in the CSS parser (#​18532)
  • Center the dropdown icon added to an input with a paired datalist by default (#​18511)
  • Extract candidates in Slang templates (#​18565)
  • Improve error messages when encountering invalid functional utility names (#​18568)
  • Discard CSS AST objects with false or undefined properties (#​18571)
  • Allow users to disable URL rebasing in @tailwindcss/postcss via transformAssetUrls: false (#​18321)
  • Fix false-positive migrations in addEventListener and JavaScript variable names (#​18718)
  • Fix Standalone CLI showing default Bun help when run via symlink on Windows (#​18723)
  • Read from --border-color-* theme keys in divide-* utilities for backwards compatibility (#​18704)
  • Don't scan .hdr and .exr files for classes by default (#​18734)

v4.1.11

Compare Source

Fixed
  • Add heuristic to skip candidate migrations inside emit(…) (#​18330)
  • Extract candidates with variants in Clojure/ClojureScript keywords (#​18338)
  • Document --watch=always in the CLI's usage (#​18337)
  • Add support for Vite 7 to @tailwindcss/vite (#​18384)

v4.1.10

Compare Source

Fixed
  • Fix incorrectly generated CSS when using percentages in arbitrary values with calc (e.g. w-[calc(100%-var(--offset))]) (#​18289)

v4.1.9

Compare Source

Fixed
  • Correctly parse custom properties with strings containing semicolons (#​18251)
  • Upgrade: Migrate arbitrary modifiers without percentage signs to bare values (e.g. /[0.16]/16) (#​18184)
  • Upgrade: Migrate CSS variable shorthands where fallback value contains function call (#​18184)
  • Upgrade: Migrate negative arbitrary values to negative bare values (e.g. mb-[-32rem]-mb-128) (#​18212)
  • Upgrade: Do not migrate blur in wire:model.blur (#​18216)
  • Don't add spaces around CSS dashed idents when formatting math expressions (#​18220)

v4.1.8

Compare Source

Added
  • Improve error messages when @apply fails (#​18059)
Fixed
  • Upgrade: Do not migrate declarations that look like candidates in <style> blocks (#​18057, 18068)
  • Upgrade: Don't error when looking for tailwindcss in pnpm monorepos (#​18065)
  • Upgrade: Don't error when updating dependencies in pnpm monorepos (#​18065)
  • Upgrade: Migrate deprecated order-none to order-0 (#​18126)
  • Support Leptos class: attributes when extracting classes (#​18093)
  • Fix "Cannot read properties of undefined" crash on malformed arbitrary value (#​18133)
  • Upgrade: Migrate -mt-[0px] to mt-[0px] instead of the other way around (#​18154)
  • Fix Haml pre-processing crash when there is no \n at the end of the file (#​18155)
  • Ignore .pnpm-store folders by default (can be overridden by @source … rules) (#​18163)
  • Fix PostCSS crash when calling toJSON() (#​18083)

v4.1.7

Compare Source

Added
  • Upgrade: Migrate bare values to named values (#​18000)
  • Upgrade: Added cache to improve template migration performance (#​18025)
Fixed
  • Allow _ before numbers during candidate extraction (#​17961)
  • Prevent duplicate suggestions when using @theme and @utility together (#​17675)
  • Ensure that media queries within ::before and ::after pseudo selectors create valid CSS rules in production builds (#​17979)
  • Ensure that the standalone CLI does not leave temporary files behind (#​17981)
  • Ensure -rotate-* utilities properly negate arbitrary values (#​18014)
  • Ignore custom variants using :merge(…) selectors in legacy JS plugins (#​18020)
  • Ensure classes containing . are properly extracted from Clojure files (#​18038)
  • Upgrade: Fix error when using @import … source(…) (#​17963)
  • Upgrade: Change casing of utilities with named values to kebab-case to match updated theme variables (#​18017)
  • Upgrade: Don't migrate strings that match utility names in Vue attribute bindings other than class (#​18025)

v4.1.6

Compare Source

Added
  • Upgrade: Automatically convert arbitrary values to named values when possible (e.g. h-[1lh] to h-lh) (#​17831, #​17854)
  • Upgrade: Update dependencies in parallel for improved performance (#​17898)
  • Add detailed logging about @source directives, discovered files and scanned files when using DEBUG=* (#​17906, #​17952)
  • Add support for generating source maps in development (#​17775)
Fixed
  • Ensure negative arbitrary scale values generate negative values (#​17831)
  • Fix HAML extraction with embedded Ruby (#​17846)
  • Don't scan files for utilities when using @reference (#​17836)
  • Fix incorrectly replacing _ with in arbitrary modifier shorthand bg-red-500/(--my_opacity) (#​17889)
  • Don't scan .log files for classes by default (#​17906)
  • Ensure that custom utilities applying other custom utilities don't swallow nested @apply rules (#​17925)
  • Download platform specific package if optionalDependencies are skipped (#​17929)

v4.1.5

Compare Source

Added
  • Support using @tailwindcss/upgrade to upgrade between versions of v4.* (#​17717)
  • Add h-lh / min-h-lh / max-h-lh utilities (#​17790)
  • Transition display, visibility, content-visibility, overlay, and pointer-events when using transition to simplify @starting-style usage (#​17812)
Fixed
  • Don't scan .geojson or .db files for classes by default (#​17700, #​17711)
  • Hide default shadow suggestions when missing default shadow theme keys (#​17743)
  • Replace _ with . in theme suggestions for @utility if surrounded by digits (#​17733)
  • Skip color-mix(…) when opacity is 100% (#​17815)
  • PostCSS: Ensure that errors in imported stylesheets are recoverable (#​17754)
  • Upgrade: Bump all Tailwind CSS related dependencies during upgrade (#​17763)
  • Upgrade: Don't add - to variants starting with @ (#​17814)
  • Upgrade: Don't format stylesheets that didn't change when upgrading (#​17824)
Changed
  • Ignore .hg, .svn, .venv, venv, .yarn, .next, .turbo, .parcel-cache, __pycache__, and .svelte-kit folders by default (can be overridden by @source … rules) (#​17892)
  • @source rules that point inside .hg, .svn, .venv, venv, .yarn, .next, .turbo, .parcel-cache, __pycache__, and .svelte-kit folders no longer consider your .gitignore rules (#​17892)

v4.1.4

Compare Source

Added
  • Add experimental @tailwindcss/oxide-wasm32-wasi target for running Tailwind in browser environments like StackBlitz (#​17558)
Fixed
  • Ensure color-mix(…) polyfills do not cause used CSS variables to be removed (#​17555)
  • Ensure color-mix(…) polyfills create fallbacks for theme variables that reference other theme variables (#​17562)
  • Fix brace expansion in declining ranges like {10..0..5} and {0..10..-5} (#​17591)
  • Work around a Chrome rendering bug when using the skew-* utilities (#​17627)
  • Ensure container query variant names can contain hyphens (#​17628)
  • Ensure shadow-inherit, inset-shadow-inherit, drop-shadow-inherit, and text-shadow-inherit inherit the shadow color (#​17647)
  • Ensure compatibility with array tuples used in fontSize JS theme keys (#​17630)
  • Ensure folders with binary file extensions in their names are scanned for utilities (#​17595)
  • Upgrade: Convert fontSize array tuple syntax to CSS theme variables (#​17630)

v4.1.3

Compare Source

Fixed
  • Show warning when using unsupported bare value data type in --value(…) (#​17464)
  • PostCSS: Ensure changes to the input CSS file don't generate stale output when using Turbopack (#​17554)
  • Ensure classes are detected in Ruby's %w syntax in Slim templates (#​17557)

v4.1.2

Compare Source

Fixed
  • Don't rely on the presence of @layer base to polyfill @property (#​17506)
  • Support setting multiple inset shadows as arbitrary values (#​17523)
  • Fix drop-shadow-* utilities that are defined with multiple shadows (#​17515)
  • PostCSS: Fix race condition when two changes are queued concurrently (#​17514)
  • PostCSS: Ensure files containing @tailwind utilities are processed (#​17514)
  • Ensure the color-mix(…) polyfill creates fallbacks even when using colors that cannot be statically analyzed (#​17513)
  • Fix slow incremental builds with @tailwindcss/vite and @tailwindcss/postscss (especially on Windows) (#​17511)
  • Vite: Fix missing CSS file in Qwik setups (#​17533)

v4.1.1

Compare Source

Fixed
  • Handle ' syntax in ClojureScript when extracting classes (#​18888)
  • Handle @variant inside @custom-variant (#​18885)
  • Merge suggestions when using @utility (#​18900)
  • Ensure that file system watchers created when using the CLI are always cleaned up (#​18905)
  • Do not generate grid-column utilities when configuring grid-column-start or grid-column-end (#​18907)
  • Do not generate grid-row utilities when configuring grid-row-start or grid-row-end (#​18907)
  • Prevent duplicate CSS when overwriting a static utility with a theme key (#​18056)
  • Show Lightning CSS warnings (if any) when optimizing/minifying (#​18918)
  • Use default export condition for @tailwindcss/vite (#​18948)
  • Re-throw errors from PostCSS nodes (#​18373)
  • Detect classes in markdown inline directives (#​18967)
  • Ensure files with only @theme produce no output when built (#​18979)
  • Support Maud templates when extracting classes (#​18988)
  • Upgrade: Do not migrate variant = 'outline' during upgrades (#​18922)
  • Upgrade: Show version mismatch (if any) when running upgrade tool (#​19028)
  • Upgrade: Ensure first class inside className is migrated (#​19031)
  • Upgrade: Migrate classes inside *ClassName and *Class attributes (#​19031)

v4.1.0

Compare Source

Added
  • Add details-content variant (#​15319)
  • Add inverted-colors variant (#​11693)
  • Add noscript variant (#​11929, #​17431)
  • Add items-baseline-last and self-baseline-last utilities (#​13888, #​17476)
  • Add pointer-none, pointer-coarse, and pointer-fine variants (#​16946)
  • Add any-pointer-none, any-pointer-coarse, and any-pointer-fine variants (#​16941)
  • Add safe alignment utilities (#​14607)
  • Add user-valid and user-invalid variants (#​12370)
  • Add wrap-anywhere, wrap-break-word, and wrap-normal utilities (#​12128)
  • Add @source inline(…) and @source not inline(…) (#​17147)
  • Add @source not "…" (#​17255)
  • Add text-shadow-* utilities (#​17389)
  • Add mask-* utilities (#​17134)
  • Add bg-{position,size}-* utilities for arbitrary values (#​17432)
  • Add shadow-*/<alpha>, inset-shadow-*/<alpha>, drop-shadow-*/<alpha>, and text-shadow-*/<alpha> utilities to control shadow opacity (#​17398, #​17434)
  • Add drop-shadow-<color> utilities (#​17434)
  • Improve compatibility with older versions of Safari and Firefox (#​17435)
Fixed

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Copy Markdown
Author

renovate Bot commented Oct 28, 2025

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: lovable-tagger@1.1.7
npm error Found: vite@7.1.12
npm error node_modules/vite
npm error   dev vite@"^7.0.0" from the root project
npm error   peer vite@"^4 || ^5 || ^6 || ^7" from @vitejs/plugin-react-swc@4.2.0
npm error   node_modules/@vitejs/plugin-react-swc
npm error     dev @vitejs/plugin-react-swc@"^4.0.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer vite@"^5.0.0" from lovable-tagger@1.1.7
npm error node_modules/lovable-tagger
npm error   dev lovable-tagger@"^1.1.7" from the root project
npm error
npm error Conflicting peer dependency: vite@5.4.21
npm error node_modules/vite
npm error   peer vite@"^5.0.0" from lovable-tagger@1.1.7
npm error   node_modules/lovable-tagger
npm error     dev lovable-tagger@"^1.1.7" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2025-11-02T11_50_27_227Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2025-11-02T11_50_27_227Z-debug-0.log

File name: package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: out/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm audit fix --package-lock-only' has not been added to the allowed list in allowedCommands
File name: gurdip-portfolio-2.1.14.61555/package/dist/package.json
Post-upgrade command 'npm run lint:fix || true' has not been added to the allowed list in allowedCommands

@safedep
Copy link
Copy Markdown

safedep Bot commented Oct 28, 2025

SafeDep Report Summary

Yellow Malicious Packages Badge Red Vulnerable Packages Badge Red Risky License Badge

⚠ 1 packages are identified as suspicious, human review is recommended.

Package Details
Package Malware Vulnerability Risky License Report
axios @ 1.8.2
npm package-lock.json
✔️ ✔️ 🔗
cross-spawn @ 7.0.3
npm package-lock.json
✔️ ✔️ 🔗
form-data @ 4.0.2
npm package-lock.json
✔️ ✔️ 🔗
libxmljs2 @ 0.35.0
npm package-lock.json
✔️ ✔️ 🔗
tar-fs @ 2.1.2
npm package-lock.json
✔️ ✔️ 🔗
@sonar/scan @ 4.3.0
npm package-lock.json
✔️ ✔️ 🔗
napi-build-utils @ 1.0.2
npm package-lock.json
⚠️ ✔️ ✔️ 🔗
sonarqube-scanner @ 4.3.0
npm package-lock.json
✔️ ✔️ 🔗
@alloc/quick-lru @ 5.2.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@babel/helper-string-parser @ 7.25.9
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@babel/helper-validator-identifier @ 7.25.9
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@babel/parser @ 7.25.9
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@babel/runtime @ 7.25.9
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@babel/types @ 7.25.9
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/cspell-bundled-dicts @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/cspell-json-reporter @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/cspell-pipe @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/cspell-resolver @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/cspell-service-bus @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/cspell-types @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-ada @ 4.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-al @ 1.0.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-bash @ 4.2.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-companies @ 3.2.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-cpp @ 6.0.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-cryptocurrencies @ 5.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-csharp @ 4.0.6
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-css @ 4.0.17
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-dart @ 1.0.6
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-data-science @ 2.0.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-django @ 4.1.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-docker @ 1.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-elixir @ 4.0.7
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-en-common-misspellings @ 1.0.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-en-gb @ 1.1.33
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-en_us @ 4.4.6
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-filetypes @ 3.0.12
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-flutter @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-fonts @ 2.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-fsharp @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-fullstack @ 3.2.6
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-gaming-terms @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-git @ 3.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-golang @ 6.0.20
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-google @ 1.0.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-haskell @ 4.0.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-html @ 4.0.11
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-html-symbol-entities @ 4.0.3
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-java @ 5.0.11
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-julia @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-k8s @ 1.0.10
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-kotlin @ 1.0.6
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-lorem-ipsum @ 4.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-lua @ 4.0.7
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-makefile @ 1.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-markdown @ 2.0.10
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-npm @ 5.2.3
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-php @ 3.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-powershell @ 5.0.14
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-public-licenses @ 1.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-r @ 2.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-ruby @ 5.0.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-rust @ 4.0.11
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-scala @ 5.0.7
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-shell @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-software-terms @ 5.0.7
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-sql @ 2.2.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-svelte @ 1.0.6
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-swift @ 1.0.6
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-terraform @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-typescript @ 3.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dict-vue @ 3.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/dynamic-import @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/filetypes @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/strong-weak-map @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cspell/url @ 8.19.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cyclonedx/cyclonedx-library @ 7.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@cyclonedx/cyclonedx-npm @ 2.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/aix-ppc64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/aix-ppc64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/android-arm @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/android-arm @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/android-arm64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/android-arm64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/android-x64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/android-x64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/darwin-arm64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/darwin-arm64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/darwin-x64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/darwin-x64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/freebsd-arm64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/freebsd-arm64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/freebsd-x64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/freebsd-x64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-arm @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-arm @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-arm64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-arm64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-ia32 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-ia32 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-loong64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-loong64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-mips64el @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-mips64el @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-ppc64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-ppc64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-riscv64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-riscv64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-s390x @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-s390x @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-x64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/linux-x64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/netbsd-arm64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/netbsd-x64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/netbsd-x64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/openbsd-arm64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/openbsd-x64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/openbsd-x64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/sunos-x64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/sunos-x64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/win32-arm64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/win32-arm64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/win32-ia32 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/win32-ia32 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/win32-x64 @ 0.21.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@esbuild/win32-x64 @ 0.25.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@eslint-community/eslint-utils @ 4.4.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@eslint/config-array @ 0.20.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@eslint/config-helpers @ 0.2.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@eslint/core @ 0.13.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@eslint/eslintrc @ 3.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@eslint/js @ 9.26.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@eslint/object-schema @ 0.3.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@eslint/plugin-kit @ 0.2.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@floating-ui/core @ 1.6.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@floating-ui/react-dom @ 2.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@floating-ui/utils @ 0.2.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@hookform/resolvers @ 3.9.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@humanfs/core @ 0.19.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@humanfs/node @ 0.16.6
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@humanwhocodes/retry @ 0.4.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@humanwhocodes/retry @ 0.3.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@isaacs/cliui @ 8.0.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@jridgewell/gen-mapping @ 0.3.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@jridgewell/resolve-uri @ 3.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@jridgewell/set-array @ 1.2.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@jridgewell/sourcemap-codec @ 1.5.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@jridgewell/trace-mapping @ 0.3.25
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@modelcontextprotocol/sdk @ 1.11.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@nodelib/fs.scandir @ 2.1.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@nodelib/fs.stat @ 2.0.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@nodelib/fs.walk @ 1.2.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@npmcli/agent @ 2.2.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@npmcli/fs @ 3.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@oozcitak/dom @ 2.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@oozcitak/infra @ 1.0.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@oozcitak/url @ 1.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@oozcitak/util @ 8.3.8
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@pkgjs/parseargs @ 0.11.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/number @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/primitive @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-accordion @ 1.2.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-alert-dialog @ 1.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-arrow @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-avatar @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-collapsible @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-compose-refs @ 1.0.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-compose-refs @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-context @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-context @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-context-menu @ 2.2.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-dialog @ 1.0.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-dialog @ 1.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-direction @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-dismissable-layer @ 1.0.5
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-dropdown-menu @ 2.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-focus-guards @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-focus-guards @ 1.0.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-focus-scope @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-focus-scope @ 1.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-hover-card @ 1.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-id @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-label @ 2.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-menubar @ 1.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-popover @ 1.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-popper @ 1.2.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-portal @ 1.0.4
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-presence @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-presence @ 1.0.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-primitive @ 1.0.3
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-progress @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-radio-group @ 1.2.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-select @ 2.1.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-separator @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-slider @ 1.2.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-slot @ 1.0.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-switch @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-tabs @ 1.1.1
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-toast @ 1.2.2
npm package-lock.json
✔️ ✔️ ✔️ 🔗
@radix-ui/react-toggle-group @ 1.1.0
npm package-lock.json
✔️ ✔️ ✔️ 🔗
✂️ Report is truncated due to max size limit of 200 packages

This report is generated by SafeDep Github App

@secure-code-warrior-for-github
Copy link
Copy Markdown

Micro-Learning Topic: Race condition (Detected by phrase)

Matched on "race condition"

What is this? (2min video)

A race condition is a flaw that produces an unexpected result when the timing of actions impact other actions.

Try a challenge in Secure Code Warrior

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Oct 28, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch renovate/major-js-dev-dependencies

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate Bot force-pushed the renovate/major-js-dev-dependencies branch 5 times, most recently from 4082d13 to 56e9724 Compare October 31, 2025 17:32
@renovate renovate Bot changed the title chore(deps): update js dev dependencies (major) Update JS dev dependencies (major) Oct 31, 2025
@renovate renovate Bot force-pushed the renovate/major-js-dev-dependencies branch from 56e9724 to 021800a Compare November 2, 2025 11:50
@safedep
Copy link
Copy Markdown

safedep Bot commented Nov 2, 2025

SafeDep Report Summary

Green Malicious Packages Badge Green Vulnerable Packages Badge Green Risky License Badge

Package Details
Package Malware Vulnerability Risky License Report
icon @esbuild/openbsd-arm64 @ 0.25.0
package-lock.json
ok icon
ok icon
ok icon
🔗

This report is generated by SafeDep Github App

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants