[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
prettier (source)	3.9.8 → 3.9.10

---

Release Notes

prettier/prettier (prettier)

v3.9.10

Compare Source

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

v3.9.9

Compare Source

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: edb0b84c-0e88-426f-ba62-784453f9378a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale comment

Security review

Outcome: No medium, high, or critical vulnerabilities identified in this change.

Scope reviewed: web/package-lock.json only — Prettier 3.9.8 → 3.9.9 (dev dependency, dev: true). No application, API, or auth code paths were modified.

Supply chain: Lockfile integrity hash and resolved tarball URL were updated together; no new packages or registry sources were introduced.

Prior threads: None from earlier automation runs on this PR.

No inline findings.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review

Outcome: No medium, high, or critical vulnerabilities identified in this PR.

Scope reviewed: web/package-lock.json only — lockfile bump of devDependency prettier from 3.9.8 to 3.9.9 (integrity hash updated accordingly). No application, API, or runtime code paths changed.

Assessment:

• Attack surface: Prettier is marked dev: true in the lockfile and is used as a local formatting tool during development/CI, not as a server-side sink for untrusted user input in Semaphore.
• Supply chain: Patch-level update from the official npm registry with an SRI integrity pin; no new packages or postinstall scripts introduced.
• Prior threads: No unresolved automation findings from earlier runs.

No inline findings to report.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review

Outcome: No medium, high, or critical vulnerabilities identified in this change.

Scope reviewed: web/package-lock.json only — Prettier 3.9.8 → 3.9.9 (dev: true). No application, API, authentication, or runtime dependency surface changed.

Prior threads: No open automation inline threads on this PR. Previous assessments (no findings) were re-validated against the current diff; nothing new to report.

Supply chain note: This is a patch-level dev-tool bump with an updated npm integrity hash. Prettier is used as a formatter in development/CI, not as a server-side parser of untrusted user input in the Semaphore UI runtime. No plausible attacker-controlled input → sink path was introduced by this diff.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review

Outcome: No medium, high, or critical vulnerabilities identified in this change.

Scope reviewed: web/package-lock.json only — devDependency prettier 3.9.8 → 3.9.9 (dev: true). No application, API, auth, or runtime code paths are modified.

Analysis:

• Prettier is a local formatting CLI used at development/CI time; it does not process untrusted end-user input in the deployed Semaphore UI.
• The lockfile update changes version, tarball URL, and SRI integrity hash only; package remains from the official npm registry with MIT license.
• No prior automation inline review threads were open on this PR; earlier top-level assessments remain superseded by this run.

Supply chain: Patch-level bump within the same major/minor line; no new advisories identified for this delta in the reviewed lockfile context.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review

Outcome: No medium, high, or critical vulnerabilities identified in this change.

Scope reviewed: web/package-lock.json only — devDependency prettier 3.9.8 → 3.9.10 (dev: true). Integrity hash and resolved tarball URL updated together. No application, API, authentication, or runtime code paths were modified.

Attack surface: Prettier is a local formatter used in development/CI; it is not a server-side sink for untrusted Semaphore user input in this repository. No new packages, registry sources, or install scripts were introduced by this diff.

Supply chain: Patch-level bump from registry.npmjs.org with npm integrity pinning. Public vulnerability databases (e.g. Snyk) report no direct CVEs for the prettier package at this version line; unrelated advisories (e.g. compromised eslint-config-prettier patch releases) do not apply to the unchanged eslint-config-prettier@10.1.8 lock entry.

Prior threads: No open automation inline threads; previous no-finding assessments re-validated against the current 3.9.10 diff.

No inline findings.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review

Outcome: No medium, high, or critical vulnerabilities identified in this change.

Scope reviewed: web/package-lock.json only — devDependency prettier 3.9.8 → 3.9.10 (dev: true). Integrity hash and resolved tarball URL updated together. No application, API, authentication, or runtime code paths were modified.

Attack surface: Prettier is a local formatter used in development/CI; it is not a server-side sink for untrusted Semaphore user input. No new packages, registry sources, or install scripts were introduced by this diff.

Supply chain: Patch-level bump from registry.npmjs.org with npm integrity pinning. No plausible attacker-controlled input → sink path was introduced.

Prior threads: No open automation inline threads; previous no-finding assessments re-validated against the current 3.9.10 diff.

No inline findings.

  

_{Sent by Cursor Automation: Find vulnerabilities}