fix(deps): update npm - license-inventory - experimental/license-inventory/package.json #994

renovate · 2025-04-29T11:21:03Z

This PR contains the following updates:

Package	Change	Type	Update
@eslint/compat (source)	`^1.2.7` -> `^1.4.0`	devDependencies	minor
@eslint/js (source)	`^9.21.0` -> `^9.38.0`	devDependencies	minor
@jest/globals (source)	`^30.0.3` -> `^30.2.0`	devDependencies	minor
@opentelemetry/auto-instrumentations-node (source)	`^0.56.1` -> `^0.65.0`	optionalDependencies	minor
@types/cors (source)	`^2.8.17` -> `^2.8.19`	devDependencies	patch
@types/express (source)	`^5.0.0` -> `^5.0.3`	devDependencies	patch
@types/node (source)	`^22.13.5` -> `^22.18.11`	devDependencies	minor
@types/semver (source)	`^7.5.8` -> `^7.7.1`	devDependencies	minor
@types/supertest (source)	`^6.0.2` -> `^6.0.3`	devDependencies	patch
@typescript-eslint/eslint-plugin (source)	`^8.24.1` -> `^8.46.1`	devDependencies	minor
@typescript-eslint/parser (source)	`^8.24.1` -> `^8.46.1`	devDependencies	minor
alpine	`3.21` -> `3.22`		minor
cross-env	`^10.0.0` -> `^10.1.0`	devDependencies	minor
dotenv	`^17.2.2` -> `^17.2.3`	dependencies	patch
eslint (source)	`^9.21.0` -> `^9.38.0`	devDependencies	minor
eslint-config-prettier	`^10.0.1` -> `^10.1.8`	devDependencies	minor
eslint-plugin-prettier	`^5.2.3` -> `^5.5.4`	devDependencies	minor
globals	`^16.0.0` -> `^16.4.0`	devDependencies	minor
grafana/grafana	`12.0.2` -> `12.2.0`		minor
grafana/loki	`3.4.2` -> `3.5.7`		minor
grafana/promtail	`3.4.2` -> `3.5.7`		minor
grafana/tempo	`2.7.1` -> `2.9.0`		minor
helmet (source)	`^8.0.0` -> `^8.1.0`	dependencies	minor
lint-staged	`^16.1.2` -> `^16.2.4`	devDependencies	minor
mongo	`8.0.4` -> `8.0.15`		patch
mongodb-memory-server-core (source)	`^10.1.4` -> `^10.2.3`	devDependencies	minor
mongoose (source)	`^8.10.1` -> `^8.19.1`	dependencies	minor
node	`0a29d8a` -> `a34e14e`		digest
nodemon (source)	`^3.1.9` -> `^3.1.10`	devDependencies	patch
otel/opentelemetry-collector-contrib	`0.120.0` -> `0.137.0`		minor
pino (source)	`^9.6.0` -> `^9.14.0`	dependencies	minor
pino-http	`^10.4.0` -> `^10.5.0`	dependencies	minor
pino-pretty	`^13.0.0` -> `^13.1.2`	devDependencies	minor
prettier (source)	`^3.5.2` -> `^3.6.2`	devDependencies	minor
prom/prometheus	`v3.2.0` -> `v3.7.1`		minor
supertest	`^7.0.0` -> `^7.1.4`	devDependencies	minor
ts-jest (source)	`^29.2.6` -> `^29.4.5`	devDependencies	minor
tsc-alias (source)	`^1.8.10` -> `^1.8.16`	devDependencies	patch
typescript (source)	`^5.7.3` -> `^5.9.3`	devDependencies	minor
typescript-eslint (source)	`^8.24.1` -> `^8.46.1`	devDependencies	minor
zod (source)	`^3.24.2` -> `^3.25.76`	dependencies	minor

Release Notes

eslint/rewrite (@eslint/compat)

`v1.4.0`

Features

Add config types in @eslint/core (#237) (7b6dd37)

Dependencies

The following workspace dependencies were updated
- dependencies
  - @eslint/core bumped from ^0.15.2 to ^0.16.0

`v1.3.2`

Compare Source

Dependencies

The following workspace dependencies were updated
- devDependencies
  - @eslint/core bumped from ^0.15.1 to ^0.15.2

`v1.3.1`

Compare Source

Bug Fixes

relax @eslint/compat eslint peerDependencies constraint (#215) (b96ec0c)

Dependencies

The following workspace dependencies were updated
- devDependencies
  - @eslint/core bumped from ^0.15.0 to ^0.15.1

`v1.3.0`

Compare Source

Features

add support for custom name parameter to includeIgnoreFile (#211) (3e18175)

Dependencies

The following workspace dependencies were updated
- devDependencies
  - @eslint/core bumped from ^0.14.0 to ^0.15.0

Dependencies

The following workspace dependencies were updated
- devDependencies
  - @eslint/core bumped from ^0.12.0 to ^0.13.0

eslint/eslint (@eslint/js)

`v9.38.0`

Compare Source

`v9.37.0`

Compare Source

`v9.36.0`

Compare Source

Features

47afcf6 feat: correct preserve-caught-error edge cases (#20109) (Francesco Trotta)

Bug Fixes

75b74d8 fix: add missing rule option types (#20127) (ntnyq)
1c0d850 fix: update eslint-all.js to use Object.freeze for rules object (#20116) (루밀LuMir)
7d61b7f fix: add missing scope types to Scope.type (#20110) (Pixel998)
7a670c3 fix: correct rule option typings in rules.d.ts (#20084) (Pixel998)

Documentation

b73ab12 docs: update examples to use defineConfig (#20131) (sethamus)
31d9392 docs: fix typos (#20118) (Pixel998)
c7f861b docs: Update README (GitHub Actions Bot)
6b0c08b docs: Update README (GitHub Actions Bot)
91f97c5 docs: Update README (GitHub Actions Bot)

Chores

12411e8 chore: upgrade @eslint/js@9.36.0 (#20139) (Milos Djermanovic)
488cba6 chore: package.json update for @eslint/js release (Jenkins)
bac82a2 ci: simplify renovate configuration (#19907) (唯然)
c00bb37 ci: bump actions/labeler from 5 to 6 (#20090) (dependabot[bot])
fee751d refactor: use defaultOptions in rules (#20121) (Pixel998)
1ace67d chore: update example to use defineConfig (#20111) (루밀LuMir)
4821963 test: add missing loc information to error objects in rule tests (#20112) (루밀LuMir)
b42c42e chore: disallow use of deprecated type property in core rule tests (#20094) (Milos Djermanovic)
7bb498d test: remove deprecated type property from core rule tests (#20093) (Pixel998)
e10cf2a ci: bump actions/setup-node from 4 to 5 (#20089) (dependabot[bot])
5cb0ce4 refactor: use meta.defaultOptions in preserve-caught-error (#20080) (Pixel998)
f9f7cb5 chore: package.json update for eslint-config-eslint release (Jenkins)
81764b2 chore: update eslint peer dependency in eslint-config-eslint (#20079) (Milos Djermanovic)

`v9.35.0`

Compare Source

`v9.34.0`

Compare Source

`v9.33.0`

Compare Source

`v9.32.0`

Compare Source

`v9.31.0`

Compare Source

`v9.30.1`

Compare Source

`v9.30.0`

Compare Source

`v9.29.0`

Compare Source

`v9.28.0`

Compare Source

Features

b0674be feat: Customization of serialization for languageOptions (#19760) (Nicholas C. Zakas)
a95721f feat: Add --pass-on-unpruned-suppressions CLI option (#19773) (Milos Djermanovic)
bfd0e7a feat: support TypeScript syntax in no-use-before-define (#19566) (Tanuj Kanti)
68c61c0 feat: support TS syntax in no-shadow (#19565) (Nitin Kumar)
0f773ef feat: support TS syntax in no-magic-numbers (#19561) (Nitin Kumar)
c4a6b60 feat: add allowTypeAnnotation to func-style (#19754) (sethamus)
b03ad17 feat: add TypeScript support to prefer-arrow-callback (#19678) (Tanuj Kanti)
bc3c331 feat: ignore overloaded function declarations in func-style rule (#19755) (sethamus)

Bug Fixes

eea3e7e fix: Remove configured global variables from GlobalScope#implicit (#19779) (Milos Djermanovic)
a467de3 fix: update context.report types (#19751) (Nitin Kumar)
fd467bb fix: remove interopDefault to use jiti's default (#19697) (sethamus)
72d16e3 fix: avoid false positive in no-unassigned-vars for declare module (#19746) (Azat S.)
81c3c93 fix: curly types (#19750) (Eli)

Documentation

3ec2082 docs: Nested arrays in files config entry (#19799) (Nicholas C. Zakas)
89a65b0 docs: clarify how config arrays can apply to subsets of files (#19788) (Shais Ch)
2ba8a0d docs: Add description of meta.namespace to plugin docs (#19798) (Nicholas C. Zakas)
59dd7e6 docs: update func-style with examples (#19793) (Tanuj Kanti)
e9129e0 docs: add global scope's implicit field to Scope Manager docs (#19770) (Milos Djermanovic)
52f5b7a docs: fix minor typos and add links (#19743) (루밀LuMir)
00716a3 docs: upfront recommend against using the no-return-await rule (#19727) (Mike DiDomizio)

Chores

175b7b8 chore: upgrade to @eslint/[email protected] (#19802) (Francesco Trotta)
844f5a6 chore: package.json update for @eslint/js release (Jenkins)
62b1c1b chore: update globals to v16 (#19791) (Nitin Kumar)
e8a1cb8 chore: ignore jiti-v2.0 & jiti-v2.1 for renovate (#19786) (Nitin Kumar)
43d3975 chore: Add Copilot Instructions file (#19753) (Nicholas C. Zakas)
2dfb5eb test: update SourceCodeTraverser tests (#19763) (Milos Djermanovic)
5bc21f9 chore: add *.code-workspace to .gitignore (#19771) (루밀LuMir)
f4fa40e refactor: NodeEventGenerator -> SourceCodeTraverser (#19679) (Nicholas C. Zakas)
0f49329 refactor: use a service to emit warnings (#19725) (Francesco Trotta)
20a9e59 chore: update dependency shelljs to ^0.10.0 (#19740) (renovate[bot])

`v9.27.0`

Compare Source

Features

d71e37f feat: Allow flags to be set in ESLINT_FLAGS env variable (#19717) (Nicholas C. Zakas)
ba456e0 feat: Externalize MCP server (#19699) (Nicholas C. Zakas)
07c1a7e feat: add allowRegexCharacters to no-useless-escape (#19705) (sethamus)
7bc6c71 feat: add no-unassigned-vars rule (#19618) (Jacob Bandes-Storch)
ee40364 feat: convert no-array-constructor suggestions to autofixes (#19621) (sethamus)
32957cd feat: support TS syntax in max-params (#19557) (Nitin Kumar)

Bug Fixes

5687ce7 fix: correct mismatched removed rules (#19734) (루밀LuMir)
dc5ed33 fix: correct types and tighten type definitions in SourceCode class (#19731) (루밀LuMir)
de1b5de fix: correct service property name in Linter.ESLintParseResult type (#19713) (Francesco Trotta)
60c3e2c fix: sort keys in eslint-suppressions.json to avoid git churn (#19711) (Ron Waldon-Howe)
9da90ca fix: add allowReserved to Linter.ParserOptions type (#19710) (Francesco Trotta)
fbb8be9 fix: add info to ESLint.DeprecatedRuleUse type (#19701) (Francesco Trotta)

Documentation

25de550 docs: Update description of frozen rules to mention TypeScript (#19736) (Nicholas C. Zakas)
bd5def6 docs: Clean up configuration files docs (#19735) (Nicholas C. Zakas)
4d0c60d docs: Add Neovim to editor integrations (#19729) (Maria José Solano)
71317eb docs: Update README (GitHub Actions Bot)
4c289e6 docs: Update README (GitHub Actions Bot)
f0f0d46 docs: clarify that unused suppressions cause non-zero exit code (#19698) (Milos Djermanovic)
8ed3273 docs: fix internal usages of ConfigData type (#19688) (Francesco Trotta)
eb316a8 docs: add fmt and check sections to Package.json Conventions (#19686) (루밀LuMir)
a3a2559 docs: fix wording in Combine Configs (#19685) (Milos Djermanovic)
c8d17e1 docs: Update README (GitHub Actions Bot)

Chores

f8f1560 chore: upgrade @eslint/js@9.27.0 (#19739) (Milos Djermanovic)
ecaef73 chore: package.json update for @eslint/js release (Jenkins)
596fdc6 chore: update dependency @arethetypeswrong/cli to ^0.18.0 (#19732) (renovate[bot])
f791da0 chore: remove unbalanced curly brace from .editorconfig (#19730) (Maria José Solano)
e86edee refactor: Consolidate Config helpers (#19675) (Nicholas C. Zakas)
cf36352 chore: remove shared types (#19718) (Francesco Trotta)
f60f276 refactor: Easier RuleContext creation (#19709) (Nicholas C. Zakas)
58a171e chore: update dependency @eslint/plugin-kit to ^0.3.1 (#19712) (renovate[bot])
3a075a2 chore: update dependency @eslint/core to ^0.14.0 (#19715) (renovate[bot])
44bac9d ci: run tests in Node.js 24 (#19702) (Francesco Trotta)
35304dd chore: add missing funding field to packages (#19684) (루밀LuMir)
f305beb test: mock process.emitWarning to prevent output disruption (#19687) (Francesco Trotta)

`v9.26.0`

Compare Source

Features

e9754e7 feat: add reportGlobalThis to no-shadow-restricted-names (#19670) (sethamus)
0fa2b7a feat: add suggestions for eqeqeq rule (#19640) (Nitin Kumar)
dcbdcc9 feat: Add MCP server (#19592) (Nicholas C. Zakas)
2dfd83e feat: add ignoreDirectives option in no-unused-expressions (#19645) (sethamus)

Bug Fixes

96e84de fix: check cache file existence before deletion (#19648) (sethamus)
d683aeb fix: don't crash on tests with circular references in RuleTester (#19664) (Milos Djermanovic)
9736d5d fix: add namespace to Plugin.meta type (#19661) (Milos Djermanovic)
17bae69 fix: update RuleTester.run() type (#19634) (Nitin Kumar)

Documentation

dd98d63 docs: Update README (GitHub Actions Bot)
c25e858 docs: Update README (GitHub Actions Bot)
b2397e9 docs: Update README (GitHub Actions Bot)
addd0a6 docs: fix formatting of unordered lists in Markdown (#19660) (Milos Djermanovic)
a21b38d docs: Update README (GitHub Actions Bot)
c0721a7 docs: fix double space in command (#19657) (CamWass)

Chores

5b247c8 chore: upgrade to @eslint/[email protected] (#19681) (Francesco Trotta)
d6fa4ac chore: package.json update for @eslint/js release (Jenkins)
0958690 chore: disambiguate internal types LanguageOptions and Rule (#19669) (Francesco Trotta)
f1c858e chore: fix internal type references to Plugin and Rule (#19665) (Francesco Trotta)
40dd299 refactor: One-shot ESQuery selector analysis (#19652) (Nicholas C. Zakas)
1cfd702 chore: update dependency @eslint/json to ^0.12.0 (#19656) (renovate[bot])

`v9.25.1`

Compare Source

Bug Fixes

cdc8e8c fix: revert directive detection in no-unused-expressions (#19639) (sethamus)

Chores

1f2b057 chore: upgrade @eslint/js@9.25.1 (#19642) (Milos Djermanovic)
771317f chore: package.json update for @eslint/js release (Jenkins)

`v9.25.0`

Compare Source

Features

dcd95aa feat: support TypeScript syntax in no-empty-function rule (#19551) (sethamus)
77d6d5b feat: support TS syntax in no-unused-expressions (#19564) (Sweta Tanwar)
90228e5 feat: support JSRuleDefinition type (#19604) (루밀LuMir)
59ba6b7 feat: add allowObjects option to no-restricted-properties (#19607) (sethamus)
db650a0 feat: support TypeScript syntax in no-invalid-this rule (#19532) (Tanuj Kanti)
9535cff feat: support TS syntax in no-loop-func (#19559) (Nitin Kumar)

Bug Fixes

910bd13 fix: nodeTypeKey not being used in NodeEventGenerator (#19631) (StyleShit)

Documentation

ca7a735 docs: update no-undef-init when not to use section (#19624) (Tanuj Kanti)
1b870c9 docs: use eslint-config-xo in the getting started guide (#19629) (Nitin Kumar)
5d4af16 docs: add types for multiple rule options (#19616) (Tanuj Kanti)
e8f8d57 docs: Update README (GitHub Actions Bot)
a40348f docs: no-use-before-define tweaks (#19622) (Kirk Waiblinger)
0ba3ae3 docs: Update README (GitHub Actions Bot)
865dbfe docs: ensure "learn more" deprecation links point to useful resource (#19590) (Kirk Waiblinger)
f80b746 docs: add known limitations for no-self-compare ([#19612](https://redirect.gith

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2025-04-29T11:21:22Z

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	`7c936c9`
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/68f3910f06071d0008de272a

github-actions · 2025-04-29T11:21:28Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 5 package(s) with unknown licenses.

See the Details below.

License Issues

experimental/license-inventory/package.json

Package	Version	License	Issue Type
@types/cors	^2.8.19	Null	Unknown License
@types/express	^5.0.3	Null	Unknown License
@types/node	^22.18.11	Null	Unknown License
@types/semver	^7.7.1	Null	Unknown License
@types/supertest	^6.0.3	Null	Unknown License

Allowed Licenses:
MIT, MIT-0, Apache-2.0, BSD-3-Clause, BSD-3-Clause-Clear, ISC, BSD-2-Clause, Unlicense, CC0-1.0, 0BSD, X11, MPL-2.0, MPL-1.0, MPL-1.1, MPL-2.0, OFL-1.1, Zlib

Excluded from license check:
pkg:npm/caniuse-lite

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@eslint/compat

^1.4.0

Unknown

npm/@eslint/js

^9.38.0

🟢 6.8

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 7	Found 21/27 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

npm/@jest/globals

^30.2.0

Unknown

npm/@types/cors

^2.8.19

🟢 6.9

Details

Check	Score	Reason
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 25/29 approved changesets -- score normalized to 8
License	🟢 9	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/express

^5.0.3

🟢 6.9

Details

Check	Score	Reason
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 25/29 approved changesets -- score normalized to 8
License	🟢 9	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/node

^22.18.11

🟢 6.9

Details

Check	Score	Reason
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 25/29 approved changesets -- score normalized to 8
License	🟢 9	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/semver

^7.7.1

🟢 6.9

Details

Check	Score	Reason
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 25/29 approved changesets -- score normalized to 8
License	🟢 9	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/supertest

^6.0.3

🟢 6.9

Details

Check	Score	Reason
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 25/29 approved changesets -- score normalized to 8
License	🟢 9	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@typescript-eslint/eslint-plugin

^8.46.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 23/29 approved changesets -- score normalized to 7
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	35 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/parser

^8.46.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 23/29 approved changesets -- score normalized to 7
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	35 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/cross-env

^10.1.0

🟢 4.9

Details

Check	Score	Reason
Maintained	🟢 10	14 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 3	Found 11/28 approved changesets -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 5	5 existing vulnerabilities detected

npm/dotenv

^17.2.3

🟢 4.8

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Maintained	🟢 10	26 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 3/17 approved changesets -- score normalized to 1
Security-Policy	🟢 9	security policy file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 8	2 existing vulnerabilities detected

npm/eslint

^9.38.0

🟢 6.8

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 7	Found 21/27 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

npm/eslint-config-prettier

^10.1.8

🟢 5.5

Details

Check	Score	Reason
Code-Review	🟢 4	Found 8/20 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 5	2 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 5
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/eslint-plugin-prettier

^5.5.4

🟢 5.9

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 2	Found 4/16 approved changesets -- score normalized to 2
Maintained	🟢 10	5 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/globals

^16.4.0

🟢 4.8

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 4	Found 11/25 approved changesets -- score normalized to 4
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 4	4 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 4
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/helmet

^8.1.0

🟢 7.5

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Code-Review	⚠️ 0	Found 2/28 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	12 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 9	1 existing vulnerabilities detected
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/lint-staged

^16.2.4

Unknown

npm/mongodb-memory-server-core

^10.2.3

Unknown

npm/mongoose

^8.19.1

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 7	Found 7/10 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 9	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 7	SAST tool detected but not run on all commits

npm/nodemon

^3.1.10

🟢 3.4

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Maintained	🟢 5	5 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 9	binaries present in source code
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	⚠️ 0	33 existing vulnerabilities detected

npm/pino

^9.14.0

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 7	Found 19/26 approved changesets -- score normalized to 7
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/pino-http

^10.5.0

🟢 5.6

Details

Check	Score	Reason
Code-Review	🟢 4	Found 7/16 approved changesets -- score normalized to 4
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	7 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	⚠️ 0	security policy file not detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/pino-pretty

^13.1.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 23/27 approved changesets -- score normalized to 8
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Security-Policy	⚠️ 0	security policy file not detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/prettier

^3.6.2

🟢 6.8

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/21 approved changesets -- score normalized to 0
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	🟢 10	0 existing vulnerabilities detected

npm/supertest

^7.1.4

Unknown

npm/ts-jest

^29.4.5

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	🟢 8	2 existing vulnerabilities detected

npm/tsc-alias

^1.8.16

🟢 4

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	⚠️ 1	1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 3	Found 11/28 approved changesets -- score normalized to 3
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 8	2 existing vulnerabilities detected

npm/typescript

^5.9.3

🟢 8.6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Packaging	⚠️ -1	packaging workflow not detected
Dependency-Update-Tool	🟢 10	update tool detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	⚠️ -1	internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
SAST	🟢 10	SAST tool is run on all commits
Fuzzing	🟢 10	project is fuzzed
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 34 contributing companies or organizations

npm/typescript-eslint

^8.46.1

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 7	Found 23/29 approved changesets -- score normalized to 7
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	⚠️ 0	35 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/zod

^3.25.76

🟢 4.3

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 5	Found 16/30 approved changesets -- score normalized to 5
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	⚠️ 0	12 existing vulnerabilities detected

Scanned Files

experimental/license-inventory/package.json

renovate · 2025-04-29T15:55:57Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: experimental/license-inventory/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @finos/[email protected]
npm error Found: @opentelemetry/[email protected]
npm error node_modules/@opentelemetry/core
npm error   @opentelemetry/core@"1.30.1" from @opentelemetry/[email protected]
npm error   node_modules/@opentelemetry/exporter-logs-otlp-grpc
npm error     @opentelemetry/exporter-logs-otlp-grpc@"0.57.2" from @opentelemetry/[email protected]
npm error     node_modules/@opentelemetry/sdk-node
npm error   @opentelemetry/core@"1.30.1" from @opentelemetry/[email protected]
npm error   node_modules/@opentelemetry/exporter-logs-otlp-http
npm error     @opentelemetry/exporter-logs-otlp-http@"0.57.2" from @opentelemetry/[email protected]
npm error     node_modules/@opentelemetry/sdk-node
npm error   40 more (@opentelemetry/exporter-logs-otlp-proto, ...)
npm error
npm error Could not resolve dependency:
npm error optional @opentelemetry/auto-instrumentations-node@"^0.65.0" from the root project
npm error
npm error Conflicting peer dependency: @opentelemetry/[email protected]
npm error node_modules/@opentelemetry/core
npm error   peer @opentelemetry/core@"^2.0.0" from @opentelemetry/[email protected]
npm error   node_modules/@opentelemetry/auto-instrumentations-node
npm error     optional @opentelemetry/auto-instrumentations-node@"^0.65.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2025-10-18T13_07_15_906Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2025-10-18T13_07_15_906Z-debug-0.log

codecov · 2025-04-29T15:59:40Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.40%. Comparing base (6ea37c1) to head (7c936c9).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #994   +/-   ##
=======================================
  Coverage   83.40%   83.40%           
=======================================
  Files          70       70           
  Lines        3007     3007           
  Branches      501      501           
=======================================
  Hits         2508     2508           
  Misses        396      396           
  Partials      103      103

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…ntory/package.json

github-actions bot added the fix label Apr 29, 2025

renovate bot force-pushed the renovate/license-inventory-manager branch from b84ddd8 to 63ea0ff Compare April 29, 2025 15:55

renovate bot force-pushed the renovate/license-inventory-manager branch 19 times, most recently from 1bf9433 to af1f571 Compare May 6, 2025 19:33

renovate bot force-pushed the renovate/license-inventory-manager branch 5 times, most recently from 87e242b to 5731c61 Compare May 8, 2025 15:36

renovate bot force-pushed the renovate/license-inventory-manager branch 15 times, most recently from 0623af5 to 9c3079b Compare October 13, 2025 15:06

renovate bot force-pushed the renovate/license-inventory-manager branch 13 times, most recently from 413a91a to 706728c Compare October 18, 2025 02:12

fix(deps): update npm - license-inventory - experimental/license-inve…

7c936c9

…ntory/package.json

renovate bot force-pushed the renovate/license-inventory-manager branch from 706728c to 7c936c9 Compare October 18, 2025 13:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update npm - license-inventory - experimental/license-inventory/package.json #994

fix(deps): update npm - license-inventory - experimental/license-inventory/package.json #994

renovate bot commented Apr 29, 2025 •

edited

Loading

Uh oh!

netlify bot commented Apr 29, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Apr 29, 2025 •

edited

Loading

Uh oh!

renovate bot commented Apr 29, 2025 •

edited

Loading

Uh oh!

codecov bot commented Apr 29, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

fix(deps): update npm - license-inventory - experimental/license-inventory/package.json #994

Are you sure you want to change the base?

fix(deps): update npm - license-inventory - experimental/license-inventory/package.json #994

Conversation

renovate bot commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Dependencies

Dependencies

Bug Fixes

Dependencies

Features

Dependencies

Bug Fixes

Dependencies

Features

Bug Fixes

Documentation

Chores

Features

Bug Fixes

Documentation

Chores

Features

Bug Fixes

Documentation

Chores

Features

Bug Fixes

Documentation

Chores

Bug Fixes

Chores

Features

Bug Fixes

Documentation

Configuration

Uh oh!

netlify bot commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Uh oh!

github-actions bot commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

License Issues

experimental/license-inventory/package.json

OpenSSF Scorecard

Scanned Files

Uh oh!

renovate bot commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: experimental/license-inventory/package-lock.json

Uh oh!

codecov bot commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Apr 29, 2025 •

edited

Loading

netlify bot commented Apr 29, 2025 •

edited

Loading

github-actions bot commented Apr 29, 2025 •

edited

Loading

renovate bot commented Apr 29, 2025 •

edited

Loading

codecov bot commented Apr 29, 2025 •

edited

Loading