chore(deps-dev): bump the dev-dependencies group with 5 updates by dependabot[bot] · Pull Request #10 · webcoderspeed/reixo

dependabot · 2026-03-16T03:38:41Z

Bumps the dev-dependencies group with 5 updates:

Package	From	To
@commitlint/cli	`20.4.4`	`20.5.0`
@commitlint/config-conventional	`20.4.4`	`20.5.0`
@commitlint/types	`20.4.4`	`20.5.0`
lint-staged	`16.3.4`	`16.4.0`
tsdown	`0.15.12`	`0.21.3`

Updates @commitlint/cli from 20.4.4 to 20.5.0

Release notes

Sourced from @commitlint/cli's releases.

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

fix(resolve-extends): always resolve extended parser presets for proper merging by @omar-y-abdi in conventional-changelog/commitlint#4647

fix(load): resolve async config exports in CJS projects by @omar-y-abdi in conventional-changelog/commitlint#4659

fix(cli): validate that --cwd directory exists before execution by @omar-y-abdi in conventional-changelog/commitlint#4658

Features

feat(cz-commitlint): add exclamation mark support for breaking changes by @mrt181 in conventional-changelog/commitlint#4655

New Contributors

@mrt181 made their first contribution in conventional-changelog/commitlint#4655

@omar-y-abdi made their first contribution in conventional-changelog/commitlint#4647

Full Changelog: conventional-changelog/commitlint@v20.4.4...v20.5.0

Changelog

Sourced from @commitlint/cli's changelog.

20.5.0 (2026-03-15)

Bug Fixes

cli: validate that --cwd directory exists before execution (#4658) (cf80f75), closes #4595

Commits

a7918e9 v20.5.0
cf80f75 fix(cli): validate that --cwd directory exists before execution (#4658)
See full diff in compare view

Updates @commitlint/config-conventional from 20.4.4 to 20.5.0

Release notes

Sourced from @commitlint/config-conventional's releases.

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

fix(resolve-extends): always resolve extended parser presets for proper merging by @omar-y-abdi in conventional-changelog/commitlint#4647

fix(load): resolve async config exports in CJS projects by @omar-y-abdi in conventional-changelog/commitlint#4659

fix(cli): validate that --cwd directory exists before execution by @omar-y-abdi in conventional-changelog/commitlint#4658

Features

feat(cz-commitlint): add exclamation mark support for breaking changes by @mrt181 in conventional-changelog/commitlint#4655

New Contributors

@mrt181 made their first contribution in conventional-changelog/commitlint#4655

@omar-y-abdi made their first contribution in conventional-changelog/commitlint#4647

Full Changelog: conventional-changelog/commitlint@v20.4.4...v20.5.0

Changelog

Sourced from @commitlint/config-conventional's changelog.

20.5.0 (2026-03-15)

Note: Version bump only for package @commitlint/config-conventional

Commits

a7918e9 v20.5.0
See full diff in compare view

Updates @commitlint/types from 20.4.4 to 20.5.0

Release notes

Sourced from @commitlint/types's releases.

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

fix(resolve-extends): always resolve extended parser presets for proper merging by @omar-y-abdi in conventional-changelog/commitlint#4647

fix(load): resolve async config exports in CJS projects by @omar-y-abdi in conventional-changelog/commitlint#4659

fix(cli): validate that --cwd directory exists before execution by @omar-y-abdi in conventional-changelog/commitlint#4658

Features

feat(cz-commitlint): add exclamation mark support for breaking changes by @mrt181 in conventional-changelog/commitlint#4655

New Contributors

@mrt181 made their first contribution in conventional-changelog/commitlint#4655

@omar-y-abdi made their first contribution in conventional-changelog/commitlint#4647

Full Changelog: conventional-changelog/commitlint@v20.4.4...v20.5.0

Changelog

Sourced from @commitlint/types's changelog.

20.5.0 (2026-03-15)

Features

cz-commitlint: add exclamation mark support for breaking changes (#4655) (3b124a7)

Commits

a7918e9 v20.5.0
3b124a7 feat(cz-commitlint): add exclamation mark support for breaking changes (#4655)
See full diff in compare view

Updates lint-staged from 16.3.4 to 16.4.0

Release notes

Sourced from lint-staged's releases.

v16.4.0

Minor Changes

#1739 687fc90 Thanks @hyperz111! - Replace micromatch with picomatch to reduce dependencies.

Changelog

Sourced from lint-staged's changelog.

16.4.0

Minor Changes

#1739 687fc90 Thanks @hyperz111! - Replace micromatch with picomatch to reduce dependencies.

Commits

445f9dd chore(changeset): release
d91be60 docs: update readme to use picomatch
b392a9f refactor: extract matchFiles and add unit tests
687fc90 refactor: replace micromatch with picomatch
See full diff in compare view

Updates tsdown from 0.15.12 to 0.21.3

Release notes

Sourced from tsdown's releases.

v0.21.3

   🚀 Features

copy: Add support for watching copy source files - by @schplitt in rolldown/tsdown#721 (7c23a)

   🐞 Bug Fixes

css: Watch inline CSS files in watch mode - by @sxzz (2051a)

exports: Sort inlined dependencies by package name - by @sxzz (0ec71)

publint: Support Yarn v1 - by @sxzz (4a291)

unbundle: Root should be lowest common ancestor of entry files - by @sxzz (f1823)

    View changes on GitHub

v0.21.2

   🚨 Breaking Changes

exe: Add exe.outDir for separate executable output dir, defaults to build - by @sxzz (d49ef)

Note: Executable is still an experimental feature and does not follow SemVer. Breaking changes may occur in any release.

   🚀 Features

Add root option for controlling output directory structure - by @sxzz (bad2d)

deps: Rename onlyAllowBundle to onlyBundle - by @peaklabs-dev and @sxzz in rolldown/tsdown#819 (cbd7b)

   🐞 Bug Fixes

css: Skip data URIs and external URLs in CSS url() rebasing - by @sxzz (13907)

    View changes on GitHub

v0.21.1

   🚨 Breaking Changes

css: Move all CSS support to @tsdown/css package - by @sxzz in rolldown/tsdown#809 (1b1a1)
[!IMPORTANT] If you are using CSS features (e.g., CSS imports), you now need to manually install the @tsdown/css package:
npm install @tsdown/css -D
# or
pnpm add @tsdown/css -D
Note: CSS support is still an experimental feature and does not follow SemVer. Breaking changes may occur in any release.
🚀 Features

css:

... (truncated)

Commits

6151433 chore: release v0.21.3
7c23ad8 feat(copy): add support for watching copy source files (#721)
f182324 fix(unbundle): root should be lowest common ancestor of entry files
0d2c9c9 docs: improve React Compiler integration
6d03e92 chore: upgrade deps
e6ff7b5 chore: add confirmation prompt to release script
280eaed docs(exe): fix output directory example (#828)
2051a40 fix(css): watch inline CSS files in watch mode
0ec719d fix(exports): sort inlined dependencies by package name
4a29176 fix(publint): support Yarn v1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dev-dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `20.4.4` | `20.5.0` | | [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `20.4.4` | `20.5.0` | | [@commitlint/types](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/types) | `20.4.4` | `20.5.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `16.3.4` | `16.4.0` | | [tsdown](https://github.com/rolldown/tsdown) | `0.15.12` | `0.21.3` | Updates `@commitlint/cli` from 20.4.4 to 20.5.0 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.5.0/@commitlint/cli) Updates `@commitlint/config-conventional` from 20.4.4 to 20.5.0 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.5.0/@commitlint/config-conventional) Updates `@commitlint/types` from 20.4.4 to 20.5.0 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/types/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.5.0/@commitlint/types) Updates `lint-staged` from 16.3.4 to 16.4.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v16.3.4...v16.4.0) Updates `tsdown` from 0.15.12 to 0.21.3 - [Release notes](https://github.com/rolldown/tsdown/releases) - [Commits](rolldown/tsdown@v0.15.12...v0.21.3) --- updated-dependencies: - dependency-name: "@commitlint/cli" dependency-version: 20.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@commitlint/config-conventional" dependency-version: 20.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@commitlint/types" dependency-version: 20.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: lint-staged dependency-version: 16.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: tsdown dependency-version: 0.21.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-03-16T03:38:42Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-03-16T03:38:57Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@babel/generator

8.0.0-rc.2

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/29 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@babel/helper-string-parser

8.0.0-rc.2

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/29 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@babel/helper-validator-identifier

8.0.0-rc.2

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/29 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@babel/parser

8.0.0-rc.2

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/29 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@babel/types

8.0.0-rc.2

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/29 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@commitlint/cli

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/config-conventional

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/config-validator

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/ensure

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/format

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/is-ignored

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/lint

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/load

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/parse

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/read

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/resolve-extends

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/rules

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@commitlint/types

20.5.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@types/jsesc

2.5.1

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 23/28 approved changesets -- score normalized to 8
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/ast-kit

3.0.0-beta.1

Unknown

npm/birpc

4.0.0

Unknown

npm/cac

7.0.0

🟢 5

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 3/30 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	28 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/hookable

6.1.0

🟢 3.9

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 6	8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 3/25 approved changesets -- score normalized to 1
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/import-without-cache

0.2.5

Unknown

npm/lint-staged

16.4.0

Unknown

npm/rolldown-plugin-dts

0.22.5

Unknown

npm/tsdown

0.21.3

Unknown

npm/unrun

0.2.32

Unknown

Scanned Files

package-lock.json

github-actions · 2026-03-16T03:39:15Z

size-limit report 📦

Path	Size
ESM (gzipped)	16.08 KB (0%)
CJS (gzipped)	-16 B (-100.1% 🔽)

dependabot · 2026-03-23T03:38:20Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot closed this Mar 23, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-cb3fb798be branch March 23, 2026 03:38

Navigation Menu

Repository navigation

chore(deps-dev): bump the dev-dependencies group with 5 updates - #10

chore(deps-dev): bump the dev-dependencies group with 5 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-cb3fb798be

dependabot Bot commented on behalf of github Mar 16, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Mar 16, 2026

Uh oh!

github-actions Bot commented Mar 16, 2026

Uh oh!

github-actions Bot commented Mar 16, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

Features

New Contributors

20.5.0 (2026-03-15)

Bug Fixes

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

Features

New Contributors

20.5.0 (2026-03-15)

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

Features

New Contributors

20.5.0 (2026-03-15)

Features

v16.4.0

Minor Changes

16.4.0

Minor Changes

v0.21.3

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v0.21.2

🚨 Breaking Changes

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v0.21.1

🚨 Breaking Changes

🚀 Features

Uh oh!

dependabot Bot commented on behalf of github Mar 16, 2026

Labels

Uh oh!

github-actions Bot commented Mar 16, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions Bot commented Mar 16, 2026

size-limit report 📦

Uh oh!

dependabot Bot commented on behalf of github Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Mar 16, 2026 •

edited

Loading