Bump the all group across 3 directories with 7 updates by dependabot[bot] · Pull Request #2555 · radius-project/samples

dependabot · 2026-05-11T00:52:40Z

Bumps the all group with 1 update in the /playwright directory: @types/node.
Bumps the all group with 2 updates in the /samples/demo directory: @types/node and @azure/monitor-opentelemetry.
Bumps the all group with 6 updates in the /samples/demo/client directory:

Package	From	To
@types/node	`25.6.0`	`25.6.2`
react	`19.2.5`	`19.2.6`
react-dom	`19.2.5`	`19.2.6`
react-router	`7.14.2`	`7.15.0`
react-router-dom	`7.14.2`	`7.15.0`
vite	`8.0.10`	`8.0.11`

Updates @types/node from 25.6.0 to 25.6.2

Commits

See full diff in compare view

Updates @types/node from 25.6.0 to 25.6.2

Commits

See full diff in compare view

Updates @azure/monitor-opentelemetry from 1.16.0 to 1.17.0

Changelog

Sourced from @azure/monitor-opentelemetry's changelog.

1.17.0 (2026-05-07)

Features Added

Added GenAI main agent attribution: AzureMonitorSpanProcessor and AzureLogRecordProcessor now propagate microsoft.gen_ai.main_agent.* attributes (with fallback to gen_ai.agent.* / gen_ai.conversation.id) from parent spans to child spans, derive them on invoke_agent spans, and copy them from the active span onto emitted log records.

Added support for the AKS resource detector from @opentelemetry/resource-detector-azure.

Added AKS_RESOURCE_DETECTOR_POPULATION statsbeat feature signal to track when the AKS resource detector successfully populates resource attributes.

Bugs Fixed

Fixed Available Memory performance counter on Linux to report MemAvailable from /proc/meminfo instead of MemFree (via os.freemem()). MemAvailable accounts for reclaimable memory (page cache, buffers), providing a more accurate measure of memory available to processes.

Fixed standard metrics and performance counters recording 0ms duration for all sub-second requests. span.duration is an HrTime tuple [seconds, nanoseconds] but was incorrectly read as span.duration[0] (seconds only). Converted to milliseconds using hrTimeToMilliseconds() from @opentelemetry/core.

Other Changes

Restructured samples-dev to use the standard Azure SDK dev-tool format with @summary tags.

Updated to using exporter version 1.0.0-beta.40.

Commits

1cc3584 [Monitor OpenTelemetry] Remove azure functions instrumentation (#38461)
19734e9 [monitor] Update @azure/opentelemetry-instrumentation-azure-sdk dependencies ...
ac224e2 [Monitor OpenTelemetry][Monitor OpenTelemetry Exporter] Release Distro 1.17.0...
9be3be3 feat(monitor-opentelemetry): implement GenAI main agent attribution (#38445)
3de1abe Add imports field to all warp-built packages (#38391)
e8f0055 chore: Update registry for all package.json and adjust check rules (#38281)
7b834ea Add missing polyfillSuffix entries to warp.config.yml for .cts polyfill packa...
65c0ccc feat(warp): explicit CJS via moduleType, esbuild ESM→CJS transform (#37893)
0f1cd87 [Monitor OpenTelemetry] Linux Perf Counter Update (#37835)
2467920 [Monitor OpenTelemetry] Fix monitor-opentelemetry samples-dev to use standard...
Additional commits viewable in compare view

Updates @types/node from 25.6.0 to 25.6.2

Commits

See full diff in compare view

Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

Commits

eaf3e95 Version 19.2.6
See full diff in compare view

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

Commits

eaf3e95 Version 19.2.6
See full diff in compare view

Updates react-router from 7.14.2 to 7.15.0

Release notes

Sourced from react-router's releases.

v7.15.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150

Changelog

Sourced from react-router's changelog.

v7.15.0

Minor Changes

Stabilize unstable_defaultShouldRevalidate as defaultShouldRevalidate on <Link>, <Form>, useLinkClickHandler, useSubmit, fetcher.submit, and setSearchParams (a993f09)

⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

Stabilize the instrumentation APIs. unstable_instrumentations is now instrumentations and unstable_pattern is now pattern (a993f09)

The unstable_ServerInstrumentation, unstable_ClientInstrumentation, unstable_InstrumentRequestHandlerFunction, unstable_InstrumentRouterFunction, unstable_InstrumentRouteFunction, and unstable_InstrumentationHandlerResult types have had their unstable_ prefixes removed

⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

Stabilize unstable_mask as mask on <Link>, useLinkClickHandler, and useNavigate, and rename the corresponding Location.unstable_mask field to Location.mask (a993f09)

⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

Stabilize the unstable_normalizePath option on staticHandler.query and staticHandler.queryRoute as normalizePath (a993f09)

⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

Stabilize future.unstable_passThroughRequests as future.v8_passThroughRequests (a993f09)

⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

Remove unstable_subResourceIntegrity from the runtime FutureConfig type; the flag is now controlled by the top-level subResourceIntegrity option in react-router.config.ts (a993f09)

⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

Stabilize unstable_url as url on loader, action, and middleware function args (a993f09)

⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

Stabilize unstable_useTransitions as useTransitions on <BrowserRouter>, <HashRouter>, <HistoryRouter>, <MemoryRouter>, <Router>, <RouterProvider>, <HydratedRouter>, and useLinkClickHandler (a993f09)

⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

Patch Changes

Add nonce to <Scripts> <link rel="modulepreload"> elements (if provided) (af5d49b)

Fix a bug with unstable_defaultShouldRevalidate={false} where parent routes that did not export a shouldRevalidate function could be incorrectly included in the single fetch call for new child route data (#15012)

Improve server-side route matching performance by pre-computing flattened/cached route branches (#14967) (af5d49b)

Performance benchmarks showed roughly a 10-15% improvement in server-side request handling performance

Mark mask as an optional field in Location for easier mocking in unit tests (#14999)

Cache flattened/ranked route branches to optimize server-side route matching (#14967)

Improve route matching performance in Framework/Data Mode (#14971) (af5d49b)

Avoiding unnecessary calls to matchRoutes in data router scenarios

This includes adding back the optimization that was removed in 7.6.0 (#13562)

The issues that prompted the revert have been addressed by using the available router matches but always updating match.route to the latest route in the manifest

Leverage pre-computed pre-computing flattened/cached route branches during client side route matching

Performance benchmarks showed roughly a 15-30% improvement in server-side request handling performance

Commits

97c8de7 Release v7.15.0 (#15018)
af5d49b Update change files again
a993f09 Update change files
362635b Move chnageset to change file
e756132 chore: format
49295b5 Stabilize APIs (#14999)
5f61543 Client-side route matching optimizations (#14971)
67518cb Remove unnecessary hasShouldRevalidate condition for opting out (#15012)
6f18edd Add nonce to scripts modulepreload (#15002)
10a9686 Migrate changeset to change file
Additional commits viewable in compare view

Updates react-router-dom from 7.14.2 to 7.15.0

Changelog

Sourced from react-router-dom's changelog.

v7.15.0

Patch Changes

Updated dependencies:

react-router@7.15.0

Commits

97c8de7 Release v7.15.0 (#15018)
See full diff in compare view

Updates vite from 8.0.10 to 8.0.11

Release notes

Sourced from vite's releases.

v8.0.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.11 (2026-05-07)

Features

update rolldown to 1.0.0-rc.18 (#22360) (3f80524)

Bug Fixes

deps: update all non-major dependencies (#22334) (672c962)

deps: update all non-major dependencies (#22382) (5c0cfcb)

glob: align hmr matcher options with glob enumeration (#22306) (30028f9)

make separate object instance for each environment (#22276) (7c2aa3b)

Documentation

create-vite: list react-compiler templates in README (#22347) (7c3a61f)

explain mergeConfig skips null/undefined (#22325) (2151f70)

mention native config loader in CLI options (#22348) (0420c5d)

update evan's x handle (640202a)

Miscellaneous Chores

deps: update dependency tsdown to ^0.21.10 (#22333) (3b51e05)

deps: update rolldown-related dependencies (#22383) (555ff36)

deps: update transitive packages to fix npm audit alerts (#22316) (86aee62)

Code Refactoring

devtools integration (#22312) (3c8bf06)

remove unnecessary async (#22296) (b31fd35)

show direct path type in bad character warning (#22339) (0c162e9)

Tests

create-vite: use short help alias (#22389) (994ab66)

Commits

66f3194 release: v8.0.11
5c0cfcb fix(deps): update all non-major dependencies (#22382)
555ff36 chore(deps): update rolldown-related dependencies (#22383)
b31fd35 refactor: remove unnecessary async (#22296)
3c8bf06 refactor: devtools integration (#22312)
7c2aa3b fix: make separate object instance for each environment (#22276)
3f80524 feat: update rolldown to 1.0.0-rc.18 (#22360)
0c162e9 refactor: show direct path type in bad character warning (#22339)
672c962 fix(deps): update all non-major dependencies (#22334)
30028f9 fix(glob): align hmr matcher options with glob enumeration (#22306)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all group with 1 update in the /playwright directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Bumps the all group with 2 updates in the /samples/demo directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [@azure/monitor-opentelemetry](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/monitor/monitor-opentelemetry). Bumps the all group with 6 updates in the /samples/demo/client directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.6.2` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.6` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.14.2` | `7.15.0` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.14.2` | `7.15.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.10` | `8.0.11` | Updates `@types/node` from 25.6.0 to 25.6.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/node` from 25.6.0 to 25.6.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@azure/monitor-opentelemetry` from 1.16.0 to 1.17.0 - [Release notes](https://github.com/Azure/azure-sdk-for-js/releases) - [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/monitor/monitor-opentelemetry/CHANGELOG.md) - [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/monitor-opentelemetry_1.17.0/sdk/monitor/monitor-opentelemetry) Updates `@types/node` from 25.6.0 to 25.6.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `react` from 19.2.5 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react) Updates `react-dom` from 19.2.5 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom) Updates `react-router` from 7.14.2 to 7.15.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.15.0/packages/react-router) Updates `react-router-dom` from 7.14.2 to 7.15.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.15.0/packages/react-router-dom) Updates `vite` from 8.0.10 to 8.0.11 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.11/packages/vite) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all - dependency-name: "@types/node" dependency-version: 25.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all - dependency-name: "@azure/monitor-opentelemetry" dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: "@types/node" dependency-version: 25.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: react dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: react-dom dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: react-router dependency-version: 7.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: react-router-dom dependency-version: 7.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: vite dependency-version: 8.0.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-05-11T00:52:59Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

samples/demo/package.json

Package	Version	License	Issue Type
@azure/monitor-opentelemetry	^1.17.0	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@types/node

25.6.2

🟢 6.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Code-Review	🟢 7	Found 23/29 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 9	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@oxc-project/types

0.128.0

Unknown

npm/@rolldown/binding-android-arm64

1.0.0-rc.18

Unknown

npm/@rolldown/binding-darwin-arm64

1.0.0-rc.18

Unknown

npm/@rolldown/binding-darwin-x64

1.0.0-rc.18

Unknown

npm/@rolldown/binding-freebsd-x64

1.0.0-rc.18

Unknown

npm/@rolldown/binding-linux-arm-gnueabihf

1.0.0-rc.18

Unknown

npm/@rolldown/binding-linux-arm64-gnu

1.0.0-rc.18

Unknown

npm/@rolldown/binding-linux-arm64-musl

1.0.0-rc.18

Unknown

npm/@rolldown/binding-linux-ppc64-gnu

1.0.0-rc.18

Unknown

npm/@rolldown/binding-linux-s390x-gnu

1.0.0-rc.18

Unknown

npm/@rolldown/binding-linux-x64-gnu

1.0.0-rc.18

Unknown

npm/@rolldown/binding-linux-x64-musl

1.0.0-rc.18

Unknown

npm/@rolldown/binding-openharmony-arm64

1.0.0-rc.18

Unknown

npm/@rolldown/binding-wasm32-wasi

1.0.0-rc.18

Unknown

npm/@rolldown/binding-win32-arm64-msvc

1.0.0-rc.18

Unknown

npm/@rolldown/binding-win32-x64-msvc

1.0.0-rc.18

Unknown

npm/@rolldown/pluginutils

1.0.0-rc.18

Unknown

npm/@tybys/wasm-util

0.10.2

Unknown

npm/@types/node

25.6.2

🟢 6.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Code-Review	🟢 7	Found 23/29 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 9	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/postcss

8.5.14

🟢 6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Code-Review	⚠️ 1	Found 3/29 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 3	branch protection is not maximal on development and all release branches
SAST	🟢 6	SAST tool is not run on all commits -- score normalized to 6

npm/react

19.2.6

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 8	Found 25/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 2	SAST tool is not run on all commits -- score normalized to 2
Fuzzing	⚠️ 0	project is not fuzzed

npm/react-dom

19.2.6

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 8	Found 25/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 2	SAST tool is not run on all commits -- score normalized to 2
Fuzzing	⚠️ 0	project is not fuzzed

npm/react-router

7.15.0

🟢 5.1

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 4/30 approved changesets -- score normalized to 1
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/react-router-dom

7.15.0

🟢 5.1

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 4/30 approved changesets -- score normalized to 1
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/rolldown

1.0.0-rc.18

Unknown

npm/vite

8.0.11

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 8	Found 20/25 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 5	binaries present in source code
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@azure-rest/core-client

2.6.0

🟢 6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@azure/core-rest-pipeline

1.23.0

🟢 6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@azure/monitor-opentelemetry

1.17.0

🟢 6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@azure/monitor-opentelemetry-exporter

1.0.0-beta.40

🟢 6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@azure/opentelemetry-instrumentation-azure-sdk

1.0.0

🟢 6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@opentelemetry/api-logs

0.211.0

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	⚠️ 0	27 existing vulnerabilities detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 39 contributing companies or organizations

npm/@opentelemetry/core

2.7.1

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	⚠️ 0	27 existing vulnerabilities detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 39 contributing companies or organizations

npm/@opentelemetry/instrumentation

0.211.0

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	⚠️ 0	27 existing vulnerabilities detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 39 contributing companies or organizations

npm/@opentelemetry/resource-detector-azure

0.20.0

🟢 7.6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Signed-Releases	⚠️ -1	no releases found
License	🟢 10	license file detected
SAST	🟢 10	SAST tool is run on all commits
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	⚠️ 0	68 existing vulnerabilities detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 39 contributing companies or organizations

npm/@opentelemetry/resources

2.7.1

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	⚠️ 0	27 existing vulnerabilities detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 39 contributing companies or organizations

npm/@opentelemetry/sdk-metrics

2.7.1

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	⚠️ 0	27 existing vulnerabilities detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 39 contributing companies or organizations

npm/@opentelemetry/sdk-trace-base

2.7.1

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	⚠️ 0	27 existing vulnerabilities detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 39 contributing companies or organizations

npm/@opentelemetry/sdk-trace-web

2.7.1

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	🟢 10	security policy file detected
Vulnerabilities	⚠️ 0	27 existing vulnerabilities detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 39 contributing companies or organizations

npm/@types/node

25.6.2

🟢 6.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Code-Review	🟢 7	Found 23/29 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 9	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@typespec/ts-http-runtime

0.3.5

🟢 6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/body-parser

1.20.5

🟢 8.2

Details

Check	Score	Reason
Maintained	🟢 10	12 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Dependency-Update-Tool	🟢 10	update tool detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 9	Found 14/15 approved changesets -- score normalized to 9
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
SAST	🟢 10	SAST tool is run on all commits
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Branch-Protection	⚠️ 1	branch protection is not maximal on development and all release branches
CI-Tests	🟢 10	29 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 31 contributing companies or organizations

npm/qs

6.15.1

🟢 5.3

Details

Check	Score	Reason
Maintained	🟢 10	29 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 1	Found 5/30 approved changesets -- score normalized to 1
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	🟢 5	badge detected: Passing
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@azure/monitor-opentelemetry

^1.17.0

Unknown

npm/@types/node

^25.6.2

Unknown

Scanned Files

playwright/package-lock.json
samples/demo/client/package-lock.json
samples/demo/package-lock.json
samples/demo/package.json

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 11, 2026

dependabot Bot requested review from a team as code owners May 11, 2026 00:52

dependabot Bot added the dependencies Pull requests that update a dependency file label May 11, 2026

dependabot Bot requested a review from a team as a code owner May 11, 2026 00:52

dependabot Bot added the javascript Pull requests that update Javascript code label May 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the all group across 3 directories with 7 updates#2555

Bump the all group across 3 directories with 7 updates#2555
dependabot[bot] wants to merge 1 commit intoedgefrom
dependabot/npm_and_yarn/playwright/edge/all-6a5885e327

dependabot Bot commented on behalf of github May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 11, 2026

1.17.0 (2026-05-07)

Features Added

Bugs Fixed

Other Changes

19.2.6 (May 6th, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

v7.15.0

v7.15.0

Minor Changes

Patch Changes

v7.15.0

Patch Changes

v8.0.11

8.0.11 (2026-05-07)

Features

Bug Fixes

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Uh oh!

github-actions Bot commented May 11, 2026

Dependency Review

License Issues

samples/demo/package.json

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants