deps-dev(deps-dev): bump the testing group across 1 directory with 5 updates by dependabot[bot] · Pull Request #152 · osama1998H/lume

dependabot · 2026-07-27T03:06:34Z

Bumps the testing group with 5 updates in the / directory:

Package	From	To
@playwright/test	`1.56.0`	`1.62.0`
@testing-library/jest-dom	`6.9.1`	`7.0.0`
@testing-library/react	`16.3.0`	`16.3.2`
jest	`30.2.0`	`30.4.2`
jest-environment-jsdom	`30.2.0`	`30.4.1`

Updates @playwright/test from 1.56.0 to 1.62.0

Release notes

Sourced from @playwright/test's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:
test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});
Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:
const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });
Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:
// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:
</tr></table> 

... (truncated)

Commits

e3950d9 chore: mark v1.62.0 (#41981)
f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
2934858 fix: correct pending navigation log spacing (#41949)
4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
15c4f55 fix(mcp): identify downloads explicitly (#41933)
f5fa967 fix(network): request.postData() returns null for empty string body override ...
0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
244a1ff feat(firefox): roll to r1538 (#41938)
Additional commits viewable in compare view

Updates @testing-library/jest-dom from 6.9.1 to 7.0.0

Release notes

Sourced from @testing-library/jest-dom's releases.

v7.0.0

7.0.0 (2026-07-20)

Features

add toContainAnyBy* and toContainOneBy* query matchers (1e39089)

BREAKING CHANGES

@testing-library/dom is now a required peer dependency. The minimum supported Node.js version is now 22.

Repaired release for testing-library/jest-dom#731

v6.10.0

6.10.0 (2026-07-20)

Features

add toContainAnyBy* and toContainOneBy* query matchers (#731) (cae44df)

Commits

1e39089 feat: add toContainAnyBy* and toContainOneBy* query matchers
cae44df feat: add toContainAnyBy* and toContainOneBy* query matchers (#731)
55c07ce ci: switch release to npm trusted publishing (#726)
213256f docs: move toHaveSelection from the deprecated section (#717)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @testing-library/jest-dom since your current version.

Updates @testing-library/react from 16.3.0 to 16.3.2

Release notes

Sourced from @testing-library/react's releases.

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

Update 'onCaughtError' type inference in 'RenderOptions' to work with React v19 (#1438) (f32bd1b)

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

Switch to trusted publishing (#1437) (a2d37ff)

Commits

f32bd1b fix: Update 'onCaughtError' type inference in 'RenderOptions' to work with Re...
a2d37ff fix: Switch to trusted publishing (#1437)
cd6a175 chore: fix action permissions (#1436)
22b8c28 chore: fix release (#1435)
d996673 chore: new release workflow (#1434)
205ce17 chore: fix typo in jest.config.js (#1427)
aba5740 [test] Fix tests for react@experimental (#1424)
590bc18 [test] Fix npm run typecheck (#1423)
1c931a6 chore(deps): use npm-run-all2 (#1411)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @testing-library/react since your current version.

Updates jest from 30.2.0 to 30.4.2

Release notes

Sourced from jest's releases.

v30.4.2

Fixes

[jest-runtime] Fix named imports from CJS modules whose module.exports is a function with own-property exports (#16150)

Full Changelog: jestjs/jest@v30.4.1...v30.4.2

v30.4.1

Features

[jest-config, jest-core, jest-runner, jest-schemas, jest-types] Allow custom runner configuration options via tuple format ['runner-path', {options}] (#16141)

Fixes

[jest-runtime] Align CJS-from-ESM default export with Node: module.exports is always the ESM default, __esModule unwrapping is no longer applied (#16143)

Full Changelog: jestjs/jest@v30.4.0...v30.4.1

v30.4.0

Big release! 😀

Main feature is a rewrite of our custom runtime in preparation for stabilisation of native support of ESM. As part of that work require(esm) module is now supported on Node 24.9+ (still requires --experimental-vm-modules like before).

In addition we now support fake timers for the recently released Temporal API in Node v26.

React 19 is also supported properly in pretty-format, meaning snapshots of React components now work like they should.

Due to all the changes, there might be regressions that snuck in. Please report them!

Full list of changes below

Features

[babel-jest] Support collecting coverage from .mts, .cts (and other) files (#15994)

[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2, jest-types] Add --collect-tests flag to discover and list tests without executing them (#16006)

[jest-config, jest-runner, jest-worker] Add workerGracefulExitTimeout config option to control how long workers are given to exit before being force-killed (#15984)

[jest-config] Add support for jest.config.mts as a valid configuration file (#16005)

[jest-config, jest-core, jest-reporters, jest-runner] verbose and silent can now be set per-project; the project-level value overrides the global value for that project's tests (#16133)

[@jest/fake-timers] Accept Temporal.Duration in jest.advanceTimersByTime() and jest.advanceTimersByTimeAsync() (#16128)

[@jest/fake-timers] Accept Temporal.Instant and Temporal.ZonedDateTime in jest.setSystemTime() and useFakeTimers({now}) (#16128)

[@jest/fake-timers] Support faking Temporal.Now.* (#16131)

[jest-mock] Add clearMocksOnScope(scope) on ModuleMocker for clearing every mock function exposed on a scope object (#16088)

[jest-resolve] Add canResolveSync() on Resolver so callers can detect when a user-configured resolver only exports an async hook (#16064)

[jest-runtime] Use synchronous evaluate() for ES modules without top-level await on Node versions that support it (v24.9+), and prefer the synchronous transform path when a sync transformer is configured (#16062)

[jest-runtime] Support require() of ES modules on Node v24.9+ (#16074)

[jest-runtime] Validate TC39 import attributes (with { type: 'json' }) on ESM imports (#16127)

[@jest/transform] Add canTransformSync(filename) on ScriptTransformer so callers can pick the sync vs async transform path (#16062)

[jest-util] Add isError helper (#16076)

... (truncated)

Changelog

Sourced from jest's changelog.

30.4.2

Fixes

[jest-runtime] Fix named imports from CJS modules whose module.exports is a function with own-property exports (#16150)

30.4.1

Features

[jest-config, jest-core, jest-runner, jest-schemas, jest-types] Allow custom runner configuration options via tuple format ['runner-path', {options}] (#16141)

Fixes

[jest-runtime] Align CJS-from-ESM default export with Node: module.exports is always the ESM default, __esModule unwrapping is no longer applied (#16143)

30.4.0

Features

[babel-jest] Support collecting coverage from .mts, .cts (and other) files (#15994)

[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2, jest-types] Add --collect-tests flag to discover and list tests without executing them (#16006)

[jest-config, jest-runner, jest-worker] Add workerGracefulExitTimeout config option to control how long workers are given to exit before being force-killed (#15984)

[jest-config] Add support for jest.config.mts as a valid configuration file (#16005)

[jest-config, jest-core, jest-reporters, jest-runner] verbose and silent can now be set per-project; the project-level value overrides the global value for that project's tests (#16133)

[@jest/fake-timers] Accept Temporal.Duration in jest.advanceTimersByTime() and jest.advanceTimersByTimeAsync() (#16128)

[@jest/fake-timers] Accept Temporal.Instant and Temporal.ZonedDateTime in jest.setSystemTime() and useFakeTimers({now}) (#16128)

[@jest/fake-timers] Support faking Temporal.Now.* (#16131)

[jest-mock] Add clearMocksOnScope(scope) on ModuleMocker for clearing every mock function exposed on a scope object (#16088)

[jest-resolve] Add canResolveSync() on Resolver so callers can detect when a user-configured resolver only exports an async hook (#16064)

[jest-runtime] Use synchronous evaluate() for ES modules without top-level await on Node versions that support it (v24.9+), and prefer the synchronous transform path when a sync transformer is configured (#16062)

[jest-runtime] Support require() of ES modules on Node v24.9+ (#16074)

[jest-runtime] Validate TC39 import attributes (with { type: 'json' }) on ESM imports (#16127)

[@jest/transform] Add canTransformSync(filename) on ScriptTransformer so callers can pick the sync vs async transform path (#16062)

[jest-util] Add isError helper (#16076)

[pretty-format] Support React 19 (#16123)

Fixes

[expect-utils] Fix toStrictEqual failing on structuredClone results due to cross-realm constructor mismatch (#15959)

[@jest/expect-utils] Prevent toMatchObject/subset matching from throwing when encountering exotic iterables (#15952)

[fake-timers] Convert Date to milliseconds before passing to @sinonjs/fake-timers (#16029)

[jest] Export GlobalConfig and ProjectConfig TypeScript types (#16132)

[jest-circus] Prevent crash when asyncError is undefined for non-Error throws (#16003)

[jest-circus, jest-jasmine2] Include Error.cause in JSON failureMessages output (#15967)

[jest-config] Fix preset path resolution on Windows when the preset uses subpath exports (#15961)

[jest-config] Allow collectCoverage and coverageProvider in project config without a validation warning (#16132)

[jest-config] Project config validator now emits "is not supported in an individual project configuration" instead of "probably a typing mistake" for known global-only options (#16132)

[jest-environment-node] Fix --localstorage-file warning on Node 25+ (#16086)

[jest-reporters] Apply global coverage threshold to unmatched pattern files in addition to glob/path thresholds (#16137)

... (truncated)

Commits

746f2a0 v30.4.2
b3b4a09 v30.4.1
5cbb21e v30.4.0
db7141a fix: allow collectCoverage and coverageProvider in project config (#16132)
efb59c2 v30.3.0
96c53d3 feat(jest-config): add defineConfig and mergeConfig functions (#15844)
See full diff in compare view

Updates jest-environment-jsdom from 30.2.0 to 30.4.1

Release notes

Sourced from jest-environment-jsdom's releases.

v30.4.1

Features

[jest-config, jest-core, jest-runner, jest-schemas, jest-types] Allow custom runner configuration options via tuple format ['runner-path', {options}] (#16141)

Fixes

[jest-runtime] Align CJS-from-ESM default export with Node: module.exports is always the ESM default, __esModule unwrapping is no longer applied (#16143)

Full Changelog: jestjs/jest@v30.4.0...v30.4.1

v30.4.0

Big release! 😀

Main feature is a rewrite of our custom runtime in preparation for stabilisation of native support of ESM. As part of that work require(esm) module is now supported on Node 24.9+ (still requires --experimental-vm-modules like before).

In addition we now support fake timers for the recently released Temporal API in Node v26.

React 19 is also supported properly in pretty-format, meaning snapshots of React components now work like they should.

Due to all the changes, there might be regressions that snuck in. Please report them!

Full list of changes below

Features

[babel-jest] Support collecting coverage from .mts, .cts (and other) files (#15994)

[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2, jest-types] Add --collect-tests flag to discover and list tests without executing them (#16006)

[jest-config, jest-runner, jest-worker] Add workerGracefulExitTimeout config option to control how long workers are given to exit before being force-killed (#15984)

[jest-config] Add support for jest.config.mts as a valid configuration file (#16005)

[jest-config, jest-core, jest-reporters, jest-runner] verbose and silent can now be set per-project; the project-level value overrides the global value for that project's tests (#16133)

[@jest/fake-timers] Accept Temporal.Duration in jest.advanceTimersByTime() and jest.advanceTimersByTimeAsync() (#16128)

[@jest/fake-timers] Accept Temporal.Instant and Temporal.ZonedDateTime in jest.setSystemTime() and useFakeTimers({now}) (#16128)

[@jest/fake-timers] Support faking Temporal.Now.* (#16131)

[jest-mock] Add clearMocksOnScope(scope) on ModuleMocker for clearing every mock function exposed on a scope object (#16088)

[jest-resolve] Add canResolveSync() on Resolver so callers can detect when a user-configured resolver only exports an async hook (#16064)

[jest-runtime] Use synchronous evaluate() for ES modules without top-level await on Node versions that support it (v24.9+), and prefer the synchronous transform path when a sync transformer is configured (#16062)

[jest-runtime] Support require() of ES modules on Node v24.9+ (#16074)

[jest-runtime] Validate TC39 import attributes (with { type: 'json' }) on ESM imports (#16127)

[@jest/transform] Add canTransformSync(filename) on ScriptTransformer so callers can pick the sync vs async transform path (#16062)

[jest-util] Add isError helper (#16076)

[pretty-format] Support React 19 (#16123)

Fixes

[expect-utils] Fix toStrictEqual failing on structuredClone results due to cross-realm constructor mismatch (#15959)

[@jest/expect-utils] Prevent toMatchObject/subset matching from throwing when encountering exotic iterables (#15952)

[fake-timers] Convert Date to milliseconds before passing to @sinonjs/fake-timers (#16029)

[jest] Export GlobalConfig and ProjectConfig TypeScript types (#16132)

... (truncated)

Changelog

Sourced from jest-environment-jsdom's changelog.

30.4.1

Features

[jest-config, jest-core, jest-runner, jest-schemas, jest-types] Allow custom runner configuration options via tuple format ['runner-path', {options}] (#16141)

Fixes

[jest-runtime] Align CJS-from-ESM default export with Node: module.exports is always the ESM default, __esModule unwrapping is no longer applied (#16143)

30.4.0

Features

[babel-jest] Support collecting coverage from .mts, .cts (and other) files (#15994)

[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2, jest-types] Add --collect-tests flag to discover and list tests without executing them (#16006)

[jest-config, jest-runner, jest-worker] Add workerGracefulExitTimeout config option to control how long workers are given to exit before being force-killed (#15984)

[jest-config] Add support for jest.config.mts as a valid configuration file (#16005)

[jest-config, jest-core, jest-reporters, jest-runner] verbose and silent can now be set per-project; the project-level value overrides the global value for that project's tests (#16133)

[@jest/fake-timers] Accept Temporal.Duration in jest.advanceTimersByTime() and jest.advanceTimersByTimeAsync() (#16128)

[@jest/fake-timers] Accept Temporal.Instant and Temporal.ZonedDateTime in jest.setSystemTime() and useFakeTimers({now}) (#16128)

[@jest/fake-timers] Support faking Temporal.Now.* (#16131)

[jest-mock] Add clearMocksOnScope(scope) on ModuleMocker for clearing every mock function exposed on a scope object (#16088)

[jest-resolve] Add canResolveSync() on Resolver so callers can detect when a user-configured resolver only exports an async hook (#16064)

[jest-runtime] Use synchronous evaluate() for ES modules without top-level await on Node versions that support it (v24.9+), and prefer the synchronous transform path when a sync transformer is configured (#16062)

[jest-runtime] Support require() of ES modules on Node v24.9+ (#16074)

[jest-runtime] Validate TC39 import attributes (with { type: 'json' }) on ESM imports (#16127)

[@jest/transform] Add canTransformSync(filename) on ScriptTransformer so callers can pick the sync vs async transform path (#16062)

[jest-util] Add isError helper (#16076)

[pretty-format] Support React 19 (#16123)

Fixes

[expect-utils] Fix toStrictEqual failing on structuredClone results due to cross-realm constructor mismatch (#15959)

[@jest/expect-utils] Prevent toMatchObject/subset matching from throwing when encountering exotic iterables (#15952)

[fake-timers] Convert Date to milliseconds before passing to @sinonjs/fake-timers (#16029)

[jest] Export GlobalConfig and ProjectConfig TypeScript types (#16132)

[jest-circus] Prevent crash when asyncError is undefined for non-Error throws (#16003)

[jest-circus, jest-jasmine2] Include Error.cause in JSON failureMessages output (#15967)

[jest-config] Fix preset path resolution on Windows when the preset uses subpath exports (#15961)

[jest-config] Allow collectCoverage and coverageProvider in project config without a validation warning (#16132)

[jest-config] Project config validator now emits "is not supported in an individual project configuration" instead of "probably a typing mistake" for known global-only options (#16132)

[jest-environment-node] Fix --localstorage-file warning on Node 25+ (#16086)

[jest-reporters] Apply global coverage threshold to unmatched pattern files in addition to glob/path thresholds (#16137)

[jest-reporters, jest-runner, jest-runtime, jest-transform] Fix coverage report not showing correct code coverage when using projects config option (#16140)

[jest-runtime] Resolve expect and @jest/expect from the internal module registry so test-file imports share the same JestAssertionError as the global expect (#16130)

[jest-runtime] Improve CJS-from-ESM interop: __esModule/Babel default unwrap, broader named-export coverage, and shared CJS singleton across importers (#16050)

[jest-runtime] Load .js files with ESM syntax but no "type":"module" marker as native ESM (#16050)

[jest-runtime] Extend the .js-with-ESM-syntax fallback to require() on Node v24.9+ - falls back to require(esm) when the CJS parser rejects ESM syntax (#16078)

[jest-runtime] Fix deadlocks and double-evaluation in concurrent ESM and wasm imports (#16050)

... (truncated)

Commits

b3b4a09 v30.4.1
5cbb21e v30.4.0
efb59c2 v30.3.0
b5b0220 Remove unused dependencies from jest-environment-jsdom (#15928)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…updates Bumps the testing group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@playwright/test](https://github.com/microsoft/playwright) | `1.56.0` | `1.62.0` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.9.1` | `7.0.0` | | [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.0` | `16.3.2` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.2.0` | `30.4.2` | | [jest-environment-jsdom](https://github.com/jestjs/jest/tree/HEAD/packages/jest-environment-jsdom) | `30.2.0` | `30.4.1` | Updates `@playwright/test` from 1.56.0 to 1.62.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.56.0...v1.62.0) Updates `@testing-library/jest-dom` from 6.9.1 to 7.0.0 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v6.9.1...v7.0.0) Updates `@testing-library/react` from 16.3.0 to 16.3.2 - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](testing-library/react-testing-library@v16.3.0...v16.3.2) Updates `jest` from 30.2.0 to 30.4.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.4.2/packages/jest) Updates `jest-environment-jsdom` from 30.2.0 to 30.4.1 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.4.1/packages/jest-environment-jsdom) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.62.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: testing - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: testing - dependency-name: "@testing-library/react" dependency-version: 16.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: testing - dependency-name: jest dependency-version: 30.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: testing - dependency-name: jest-environment-jsdom dependency-version: 30.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: testing ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-27T03:06:35Z

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

chatgpt-codex-connector · 2026-07-27T03:06:37Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

github-actions · 2026-07-27T03:08:31Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.
⚠️ 2 packages with OpenSSF Scorecard issues.

See the Details below.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/brace-expansion

2.1.2

🟢 7.3

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 4	Found 7/16 approved changesets -- score normalized to 4
Maintained	🟢 10	18 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@babel/helper-plugin-utils

7.29.7

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 7	Found 22/30 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@babel/plugin-syntax-jsx

7.29.7

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 7	Found 22/30 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@babel/plugin-syntax-typescript

7.29.7

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 7	Found 22/30 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@emnapi/core

1.10.0

🟢 3.6

Details

Check	Score	Reason
Maintained	🟢 10	18 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 2	Found 6/30 approved changesets -- score normalized to 2
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@emnapi/runtime

1.10.0

🟢 3.6

Details

Check	Score	Reason
Maintained	🟢 10	18 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 2	Found 6/30 approved changesets -- score normalized to 2
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@emnapi/wasi-threads

1.2.1

🟢 3.6

Details

Check	Score	Reason
Maintained	🟢 10	18 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 2	Found 6/30 approved changesets -- score normalized to 2
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@jest/console

30.4.1

Unknown

npm/@jest/core

30.4.2

Unknown

npm/@jest/diff-sequences

30.4.0

Unknown

npm/@jest/environment

30.4.1

Unknown

npm/@jest/environment-jsdom-abstract

30.4.1

Unknown

npm/@jest/expect

30.4.1

Unknown

npm/@jest/expect-utils

30.4.1

Unknown

npm/@jest/fake-timers

30.4.1

Unknown

npm/@jest/globals

30.4.1

Unknown

npm/@jest/pattern

30.4.0

Unknown

npm/@jest/reporters

30.4.1

Unknown

npm/@jest/schemas

30.4.1

Unknown

npm/@jest/snapshot-utils

30.4.1

Unknown

npm/@jest/test-result

30.4.1

Unknown

npm/@jest/test-sequencer

30.4.1

Unknown

npm/@jest/transform

30.4.1

Unknown

npm/@jest/types

30.4.1

Unknown

npm/@napi-rs/wasm-runtime

1.1.6

🟢 5.1

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 1	Found 4/22 approved changesets -- score normalized to 1
Maintained	🟢 10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	⚠️ -1	packaging workflow not detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@pkgr/core

0.3.6

Unknown

npm/@playwright/test

1.62.0

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices	⚠️ 0	no badge detected
Vulnerabilities	🟢 10	no vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	no published package detected
Token-Permissions	⚠️ 0	non read-only tokens detected in GitHub workflows
Binary-Artifacts	🟢 6	binaries present in source code
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches

npm/@sinonjs/fake-timers

15.4.0

🟢 5.6

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 9	10 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 9
Code-Review	⚠️ 1	Found 5/27 approved changesets -- score normalized to 1
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@testing-library/jest-dom

7.0.0

🟢 5.7

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 8	Found 17/19 approved changesets -- score normalized to 8
Maintained	🟢 5	4 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@testing-library/react

16.3.2

🟢 3.7

Details

Check	Score	Reason
Code-Review	🟢 5	Found 15/29 approved changesets -- score normalized to 5
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@tybys/wasm-util

0.10.3

Unknown

npm/@unrs/resolver-binding-android-arm-eabi

1.12.2

Unknown

npm/@unrs/resolver-binding-android-arm64

1.12.2

Unknown

npm/@unrs/resolver-binding-darwin-arm64

1.12.2

Unknown

npm/@unrs/resolver-binding-darwin-x64

1.12.2

Unknown

npm/@unrs/resolver-binding-freebsd-x64

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-arm-gnueabihf

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-arm-musleabihf

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-arm64-gnu

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-arm64-musl

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-loong64-gnu

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-loong64-musl

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-ppc64-gnu

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-riscv64-gnu

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-riscv64-musl

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-s390x-gnu

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-x64-gnu

1.12.2

Unknown

npm/@unrs/resolver-binding-linux-x64-musl

1.12.2

Unknown

npm/@unrs/resolver-binding-openharmony-arm64

1.12.2

Unknown

npm/@unrs/resolver-binding-wasm32-wasi

1.12.2

Unknown

npm/@unrs/resolver-binding-win32-arm64-msvc

1.12.2

Unknown

npm/@unrs/resolver-binding-win32-ia32-msvc

1.12.2

Unknown

npm/@unrs/resolver-binding-win32-x64-msvc

1.12.2

Unknown

npm/babel-jest

30.4.1

Unknown

npm/babel-plugin-jest-hoist

30.4.0

Unknown

npm/babel-preset-jest

30.4.0

Unknown

npm/ci-info

4.4.0

⚠️ 2.9

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 5/30 approved changesets -- score normalized to 1
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/cjs-module-lexer

2.2.0

Unknown

npm/collect-v8-coverage

1.0.3

🟢 3.8

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	13 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 0/27 approved changesets -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/dedent

1.7.2

🟢 4.2

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 3	Found 11/29 approved changesets -- score normalized to 3
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/expect

30.4.1

Unknown

npm/glob

10.5.0

🟢 5.3

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 8	8 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
SAST	⚠️ 0	no SAST tool detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Security-Policy	🟢 10	security policy file detected

npm/jest

30.4.2

Unknown

npm/jest-changed-files

30.4.1

Unknown

npm/jest-circus

30.4.2

Unknown

npm/jest-cli

30.4.2

Unknown

npm/jest-config

30.4.2

Unknown

npm/jest-diff

30.4.1

Unknown

npm/jest-docblock

30.4.0

Unknown

npm/jest-each

30.4.1

Unknown

npm/jest-environment-jsdom

30.4.1

Unknown

npm/jest-environment-node

30.4.1

Unknown

npm/jest-haste-map

30.4.1

Unknown

npm/jest-leak-detector

30.4.1

Unknown

npm/jest-matcher-utils

30.4.1

Unknown

npm/jest-message-util

30.4.1

Unknown

npm/jest-mock

30.4.1

Unknown

npm/jest-regex-util

30.4.0

Unknown

npm/jest-resolve

30.4.1

Unknown

npm/jest-resolve-dependencies

30.4.2

Unknown

npm/jest-runner

30.4.2

Unknown

npm/jest-runtime

30.4.2

Unknown

npm/jest-snapshot

30.4.1

Unknown

npm/jest-util

30.4.1

Unknown

npm/jest-validate

30.4.1

Unknown

npm/jest-watcher

30.4.1

Unknown

npm/jest-worker

30.4.1

Unknown

npm/minimatch

9.0.9

🟢 5.1

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 1/28 approved changesets -- score normalized to 0
Maintained	⚠️ 1	0 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 1
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/minipass

7.1.3

🟢 3.4

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
SAST	⚠️ 0	no SAST tool detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected

npm/nwsapi

2.2.24

⚠️ 2.8

Details

Check	Score	Reason
Maintained	🟢 10	7 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 1/29 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/playwright

1.62.0

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices	⚠️ 0	no badge detected
Vulnerabilities	🟢 10	no vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	no published package detected
Token-Permissions	⚠️ 0	non read-only tokens detected in GitHub workflows
Binary-Artifacts	🟢 6	binaries present in source code
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches

npm/playwright-core

1.62.0

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices	⚠️ 0	no badge detected
Vulnerabilities	🟢 10	no vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	no published package detected
Token-Permissions	⚠️ 0	non read-only tokens detected in GitHub workflows
Binary-Artifacts	🟢 6	binaries present in source code
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches

npm/pretty-format

30.4.1

Unknown

npm/react-is-18

18.3.1

Unknown

npm/react-is-19

19.2.8

Unknown

npm/semver

7.8.5

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	17 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 14/15 approved changesets -- score normalized to 9
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	🟢 9	SAST tool detected but not run on all commits

npm/synckit

0.11.13

Unknown

npm/unrs-resolver

1.12.2

Unknown

npm/ws

8.21.1

🟢 5.5

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 0/29 approved changesets -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	17 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

package-lock.json

github-actions · 2026-07-27T03:11:29Z

📦 Bundle Size Report

Component	Base	PR	Change
React	1.4M	1.4M	➡️ No change
Electron	840K	840K	➡️ No change
Total	2.2MiB	2.2MiB	➡️ No change

_{🤖 This comment will be automatically updated on new commits}

dependabot Bot assigned osama1998H Jul 27, 2026

dependabot Bot added the dependencies label Jul 27, 2026

pull-request-size Bot added the size/S label Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps-dev(deps-dev): bump the testing group across 1 directory with 5 updates - #152

deps-dev(deps-dev): bump the testing group across 1 directory with 5 updates#152
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/testing-90b3dfb8fd

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

v1.62.0

🧱 New component testing model

🛑 Cancel operations with AbortSignal

🖼️ WebP screenshots

🧩 Custom test filtering with Reporter.preprocess()

v7.0.0

7.0.0 (2026-07-20)

Features

BREAKING CHANGES

v6.10.0

6.10.0 (2026-07-20)

Features

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

v30.4.2

Fixes

v30.4.1

Features

Fixes

v30.4.0

Features

30.4.2

Fixes

30.4.1

Features

Fixes

30.4.0

Features

Fixes

v30.4.1

Features

Fixes

v30.4.0

Features

Fixes

30.4.1

Features

Fixes

30.4.0

Features

Fixes

Uh oh!

dependabot Bot commented on behalf of github Jul 27, 2026

Labels

Uh oh!

chatgpt-codex-connector Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions Bot commented Jul 27, 2026

📦 Bundle Size Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant