chore(deps): bump the npm-dependencies group with 16 updates by dependabot[bot] · Pull Request #77 · JerrettDavis/SignalFeed

dependabot · 2026-08-04T13:14:59Z

Bumps the npm-dependencies group with 16 updates:

Package	From	To
jose	`6.2.3`	`6.2.7`
lucide-react	`1.25.0`	`1.28.0`
maplibre-gl	`5.24.0`	`6.1.0`
next	`16.2.10`	`16.2.12`
next-intl	`4.13.2`	`4.13.4`
react	`19.2.7`	`19.2.8`
@types/react	`19.2.17`	`19.2.18`
react-dom	`19.2.7`	`19.2.8`
@types/react-dom	`19.2.3`	`19.2.4`
resend	`6.17.2`	`6.18.1`
@playwright/test	`1.61.1`	`1.62.1`
@types/node	`26.1.1`	`26.1.2`
eslint	`10.7.0`	`10.8.0`
eslint-config-next	`16.2.10`	`16.2.12`
lint-staged	`17.0.8`	`17.3.0`
prettier	`3.9.5`	`3.9.6`

Updates jose from 6.2.3 to 6.2.7

Release notes

Sourced from jose's releases.

v6.2.7

Fixes

require own JOSE properties for presence checks (90ab09c)

Refactor

reduce bundle size (767d7f1)

v6.2.6

Fixes

types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

compare claim values for falsy validation options (eb86956)

forward key management parameters for a single JWE recipient (2d4f801)

handle a zero-length JWE additional authenticated data (16ca398)

reject a generateKeyPair crv option the algorithm does not imply (76364e9)

reject an unencoded payload in the JWS Compact Serialization (01d053f)

reject characters outside the Base64URL alphabet (0ebb971), references #879

reject duplicate "crit" values when producing (31d60e1)

reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)

reject truncated ASN.1 key data (7a16c66)

surface non-ASCII token segments as JOSE errors (194fe11)

types: correct JWK and CryptoKey types (62a196d)

types: correct key resolver and JWT header types (e95f8c4)

validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

correct subpaths and API documentation (2daec38)

document consumer-supplied type parameters (9e9f66c)

stop claiming the JWK "use" parameter is used during import (47a07b2)

update CHANGELOG.md (fc51bf5)

Refactor

assert key shape and type from the entry (971057e)

avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)

correct swapped JWE unprotected header type error messages (894c498)

describe each JWS algorithm once (7375028)

discriminate a key once (0b59a69)

fold single-consumer modules into their consumers (c2f0ca3)

generate and import keys from the entry (da69b68)

keep JWE out of the JWKS and embedded-JWK paths (241dd48)

keep JWS and JWE out of each other's bundles (2a98564)

parse a Protected Header in one place (30f72af)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.7 (2026-08-01)

Fixes

require own JOSE properties for presence checks (90ab09c)

Refactor

reduce bundle size (767d7f1)

6.2.6 (2026-07-31)

Fixes

types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

compare claim values for falsy validation options (eb86956)

forward key management parameters for a single JWE recipient (2d4f801)

handle a zero-length JWE additional authenticated data (16ca398)

reject a generateKeyPair crv option the algorithm does not imply (76364e9)

reject an unencoded payload in the JWS Compact Serialization (01d053f)

reject characters outside the Base64URL alphabet (0ebb971), references #879

reject duplicate "crit" values when producing (31d60e1)

reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)

reject truncated ASN.1 key data (7a16c66)

surface non-ASCII token segments as JOSE errors (194fe11)

types: correct JWK and CryptoKey types (62a196d)

types: correct key resolver and JWT header types (e95f8c4)

validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

correct subpaths and API documentation (2daec38)

document consumer-supplied type parameters (9e9f66c)

stop claiming the JWK "use" parameter is used during import (47a07b2)

update CHANGELOG.md (fc51bf5)

Refactor

assert key shape and type from the entry (971057e)

avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)

correct swapped JWE unprotected header type error messages (894c498)

describe each JWS algorithm once (7375028)

discriminate a key once (0b59a69)

fold single-consumer modules into their consumers (c2f0ca3)

generate and import keys from the entry (da69b68)

... (truncated)

Commits

60b941f chore(release): 6.2.7
90ab09c fix: require own JOSE properties for presence checks
767d7f1 refactor: reduce bundle size
8fc9a98 ci: fix post-release discussion body update
a544a03 chore: cleanup after release
a269a17 chore(release): 6.2.6
25c2a4f build: refactor postchangelog to a script
b48a15b fix(types): accept host CryptoKey declarations
de353df ci: track staged npm release availability
832c1af chore: cleanup after release
Additional commits viewable in compare view

Updates lucide-react from 1.25.0 to 1.28.0

Release notes

Sourced from lucide-react's releases.

Version 1.28.0

What's Changed

feat(icons): improve calendar icons centre of gravity by @karsa-mistmere in lucide-icons/lucide#4614

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

Version 1.27.0

What's Changed

feat(icons): removed brand names from tags & revised brand stopwords by @karsa-mistmere in lucide-icons/lucide#4575

fix(docs): Fix site build by @ericfennis in lucide-icons/lucide#4582

fix(icons): optimised square-scissors icons by @karsa-mistmere in lucide-icons/lucide#4581

fix(packages/angular): add more supported attributes for SVG nodes by @karsa-mistmere in lucide-icons/lucide#4570

feat(icons): added pending-cw icon by @NielsLazaroms in lucide-icons/lucide#4439

fix(icons): changed zap and zap-off icons by @kapowaz in lucide-icons/lucide#4536

feat(icons): add square-off icon by @october-learns in lucide-icons/lucide#4496

chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @dependabot[bot] in lucide-icons/lucide#4572

fix(icons): changed toolbox icon by @karsa-mistmere in lucide-icons/lucide#4571

feat(icons): add scan-square by @samuelalake in lucide-icons/lucide#4550

feat(icons): added user-shield icon by @MArtytraM99 in lucide-icons/lucide#3099

feat(icons): added mosque icon by @iskepr in lucide-icons/lucide#4494

fix(request-review): Remove pull_request_target by @ericfennis in lucide-icons/lucide#4593

fix(icons): changed feather icon by @karsa-mistmere in lucide-icons/lucide#4584

feat(ci): added custom prettier plugin for icon SVG files by @karsa-mistmere in lucide-icons/lucide#4576

ci(ci.yml): Remove concurrency in ci.yml by @ericfennis in lucide-icons/lucide#4595

fix(icons): changed barrel icon by @karsa-mistmere in lucide-icons/lucide#4592

feat(lab): Migrate lab to main repo. by @ericfennis in lucide-icons/lucide#4521

fix(icons): changed trophy icon by @karsa-mistmere in lucide-icons/lucide#4591

feat(analytics): add utm source and medium by @jguddas in lucide-icons/lucide#4596

feat(docs): Add lab requirement in pull_request_template.md by @danielbayley in lucide-icons/lucide#3651

feat(icons): replaces podcast icon with new mic-* icons by @karsa-mistmere in lucide-icons/lucide#4583

feat(icons): add layout-freeform by @samuelalake in lucide-icons/lucide#4543

New Contributors

@NielsLazaroms made their first contribution in lucide-icons/lucide#4439

@kapowaz made their first contribution in lucide-icons/lucide#4536

@october-learns made their first contribution in lucide-icons/lucide#4496

@samuelalake made their first contribution in lucide-icons/lucide#4550

@iskepr made their first contribution in lucide-icons/lucide#4494

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

Version 1.26.0

What's Changed

fix(docs): fix home page package links & accessible labels by @karsa-mistmere in lucide-icons/lucide#4540

fix(icons): changed columns-3-cog icon by @kamilasw in lucide-icons/lucide#4578

fix(icons): extended metadata of ad icon by @karsa-mistmere in lucide-icons/lucide#4579

fix(icons): changed book-open icons by @karsa-mistmere in lucide-icons/lucide#4565

feat(icons): added shield-keyhole icon by @karsa-mistmere in lucide-icons/lucide#4580

... (truncated)

Commits

See full diff in compare view

Updates maplibre-gl from 5.24.0 to 6.1.0

Release notes

Sourced from maplibre-gl's releases.

v6.1.0

✨ Features and improvements

Add support for updating an ImageSource with an already-decoded image (HTMLImageElement, HTMLCanvasElement, ImageBitmap or ImageData) directly via ImageSource.updateImage({image}), skipping the network request (#7944) (by @mondsichtung)

Add GeoJSONSource.getClusterOptions to get a source's current cluster options (cluster, clusterMaxZoom, clusterRadius) (#7948) (by @lazerg)

Support global-state expressions in sky.*, light.* and projection.type properties (#7966, #7967, #7968) (by @CommanderStorm)

Add MapOptions.rotateSpeed and MapOptions.pitchSpeed, the degrees the bearing/pitch change per pixel dragged (#7949) (by @clement-igonet)

Show a grab cursor over draggable markers, including on non-interactive maps (#8019) (by @hugosmoreira)

🐞 Bug fixes

Use role=img for non-interactive default markers and role=button when they become interactive (#7790) (by @cat0825)

Fix an error thrown when a paint property transitions between arrays of different length (#6606) (by @HarelM)

Fix renderer crash when RasterTileSource.setTiles/setUrl is called while the source contains errored tiles (#7911) (by @lazerg)

Fix 3D buildings disappearing when the camera pitches up to look near the horizon, by growing tile-culling bounds as the frustum's bottom edge (from pitch and FOV) approaches horizontal (#7633) (by @clement-igonet)

Fix globe latitude precision on some GPUs (e.g. Mali) by reformulating the mercator-to-sphere Y coordinate algebraically (exp + rational arithmetic instead of atan/sin/cos), avoiding float32 cancellation and imprecise hardware transcendentals near the equator; the runtime GPU atan-error measurement/correction this superseded has also been removed (#7419) (by @clement-igonet)

Fix a race in RasterTileSource.loadTile and ImageSource.load where a tile/image aborted during an awaited transformRequest passed an undefined AbortController into the image request queue, crashing it with TypeError: Cannot read properties of undefined (reading 'signal') (#8004) (by @jan-grzybek)

Fix setTerrain not destroying the previously active terrain when switching to a new configuration, which leaked its GPU resources and left the old source still configured as a terrain source (#7990) (by @lazerg)

Fix fill and line layers being rendered twice near the antimeridian on globe when looking at poles or when zoomed out (#6248) (by @pabueco)

v6.0.0

The following incorporates all the pre-releases for version 6 changes. Check-out our migration guide from v5 to v6 for more information.

✨ Features and improvements

⚠️ Switch to an ESM-only distribution (maplibre-gl.mjs). The UMD bundles (maplibre-gl.js, maplibre-gl-csp.js) are no longer published. The CSP-specific bundle is also dropped: the ESM build loads its worker as a real URL, so worker-src blob: is no longer required. Consumers using <script src=".../maplibre-gl.js"> must switch to <script type="module">, and consumers using import maplibregl from 'maplibre-gl' must switch to import * as maplibregl from 'maplibre-gl' or named imports. See the docs ESM section or our migration guide for migration steps. (#6254) (by @birkskyum)

⚠️ Interpolate the light position in spherical coordinates instead of cartesian ones, so that a transition keeps its radial distance. (#7919) (by @HarelM)

⚠️ styleimagemissing is now a notify-only event instead of the previous callback that allowed to provide an image. This aligns the event with standard event semantics (notify, not resolve). Use Map.setMissingStyleImageResolver to on-demand supply images instead via an function that can now also be async. (#7892) (by @birkskyum)

⚠️ Map now composes a Camera instead of extending it (Map extends Evented directly and forwards the camera API). The internal map.transform was removed — use map's public API instead or open a PR if you need something that's not exposed. Removed the internal transform.getMatrixForModel helper (#7800) (by @HarelM)

⚠️ All map events are now real classes that are instantiated when they are fired. Renamed the Maps' BoxZoom handler from MapLibreZoomEvent to MapBoxZoomEvent, added the rollstart/roll/rollend and style.load (as MapStyleLoadEvent) events to MapEventType, and added event classes and type-map for Marker, Popup, GeolocateControl and FullscreenControl. Removed MapDataEvent: the data/dataloading/dataabort events are now MapSourceDataEvent | MapStyleDataEvent, so source data events carry the full source info (sourceId, tile, sourceDataType, …). Added MapMovementEvent as the type for all camera-transition events (move/zoom/rotate/pitch/roll/drag and their start/end variants). Evented is now generic over an event-type map (Evented<EventType>) and is abstract, so subclasses get strongly-typed on/once/off automatically without re-declaring overloads — this also types the events on Camera/Style (via MapEventType) and on the sources (via the new SourceEventType) (#7789) (by @HarelM)

⚠️ Update maplibre-gl-style-spec to version 25, which now throws an error with warning severity instead of silently failing on encoutering legacy expressions (#7792) (by @HarelM)

⚠️ Removed the remaining mapbox references in the code and in the tests. This changes the #pragma mapbox to #pragma maplibre in case you have shader code that relied on it. (#7761) (by @HarelM)

⚠️ zoomLevelsToOverscale default value was changed to 4 to support better handling of high level zoom with dense labels. This might have a side effect of changing a bit the results of queryRenderedFeatures and some rendering of polygon center label. To revert this change, set the value to undefined (#7537) (by @HarelM)

⚠️ Remove the second parameter from GeoJSONSource.setData (waitForCompletion) and remove the return value of this to allow future changes to the API (#7538) (by @HarelM)

⚠️ The TypeScript target has been updated to ES2022. This results in smaller bundles and improved runtime performance by relying on modern JavaScript features and reducing transpilation. Consumers targeting browsers or using some tooling released before 2022 may need to transpile MapLibre or update. This change also aligns all internal build configurations to a single target instead of ES2016 + ES2019, avoiding inconsistencies in emitted code. (#7404) (by @CommanderStorm)

⚠️ WebGL (v1) support has been removed; WebGL2 is now required. In practical terms, this will not change how you interact with the map. This enables performance improvements (e.g. line opacity), Terrain3D enhancements, and several bug fixes. WebGL2 support has been widely available for years, and usage of the legacy path had plateaued, so maintaining it no longer justified the added complexity. To ease this breaking change, we have also refactored how we handle the case that no webgl is avaliable (e.g. due to browser restrictions). You can now listen to the webgl error via .on("error"). See caniuse.com/webgl2 for ecosystem support and our RFC for details. (#7453) (by @CommanderStorm)

⚠️ Support geojson nested objects, this is a breaking change as it encodes __$json__ before properties that used to be an object. It also parses them back, but this is still a breaking change if you assumed this bug existed. (#6992) (by HarelM)

⚠️ Improve types for {get,set}LayoutProperty, {get,set}PaintProperty to be the actual type instead of string/any (#7481) (by @CommanderStorm)

⚠️ Refactored the Hash-based location control (the option that syncs map state to the URL like #map=5/1/2) to use URLSearchParams internally. This improves extensibility for custom use cases, but may break existing code that relies on the previous implementation. It also changes how certain edge cases are parsed—for example, strings like [#10](https://github.com/maplibre/maplibre-gl-js/issues/10)%2F3.00%2F-1.00 are now accepted, and hashes like #foo are normalized to #foo=. (#7073) (by @CommanderStorm)

Validate the terrain passed to map.setTerrain, which was previously applied unchecked (#7941) (by @HarelM)

... (truncated)

Changelog

Sourced from maplibre-gl's changelog.

6.1.0

✨ Features and improvements

Add support for updating an ImageSource with an already-decoded image (HTMLImageElement, HTMLCanvasElement, ImageBitmap or ImageData) directly via ImageSource.updateImage({image}), skipping the network request (#7944) (by @mondsichtung)

Add GeoJSONSource.getClusterOptions to get a source's current cluster options (cluster, clusterMaxZoom, clusterRadius) (#7948) (by @lazerg)

Support global-state expressions in sky.*, light.* and projection.type properties (#7966, #7967, #7968) (by @CommanderStorm)

Add MapOptions.rotateSpeed and MapOptions.pitchSpeed, the degrees the bearing/pitch change per pixel dragged (#7949) (by @clement-igonet)

Show a grab cursor over draggable markers, including on non-interactive maps (#8019) (by @hugosmoreira)

🐞 Bug fixes

Use role=img for non-interactive default markers and role=button when they become interactive (#7790) (by @cat0825)

Fix an error thrown when a paint property transitions between arrays of different length (#6606) (by @HarelM)

Fix renderer crash when RasterTileSource.setTiles/setUrl is called while the source contains errored tiles (#7911) (by @lazerg)

Fix 3D buildings disappearing when the camera pitches up to look near the horizon, by growing tile-culling bounds as the frustum's bottom edge (from pitch and FOV) approaches horizontal (#7633) (by @clement-igonet)

Fix globe latitude precision on some GPUs (e.g. Mali) by reformulating the mercator-to-sphere Y coordinate algebraically (exp + rational arithmetic instead of atan/sin/cos), avoiding float32 cancellation and imprecise hardware transcendentals near the equator; the runtime GPU atan-error measurement/correction this superseded has also been removed (#7419) (by @clement-igonet)

Fix a race in RasterTileSource.loadTile and ImageSource.load where a tile/image aborted during an awaited transformRequest passed an undefined AbortController into the image request queue, crashing it with TypeError: Cannot read properties of undefined (reading 'signal') (#8004) (by @jan-grzybek)

Fix setTerrain not destroying the previously active terrain when switching to a new configuration, which leaked its GPU resources and left the old source still configured as a terrain source (#7990) (by @lazerg)

Fix fill and line layers being rendered twice near the antimeridian on globe when looking at poles or when zoomed out (#6248) (by @pabueco)

6.0.0

The following incorporates all the pre-releases for version 6 changes. Check-out our migration guide from v5 to v6 for more information.

✨ Features and improvements

⚠️ Switch to an ESM-only distribution (maplibre-gl.mjs). The UMD bundles (maplibre-gl.js, maplibre-gl-csp.js) are no longer published. The CSP-specific bundle is also dropped: the ESM build loads its worker as a real URL, so worker-src blob: is no longer required. Consumers using <script src=".../maplibre-gl.js"> must switch to <script type="module">, and consumers using import maplibregl from 'maplibre-gl' must switch to import * as maplibregl from 'maplibre-gl' or named imports. See the docs ESM section or our migration guide for migration steps. (#6254) (by @birkskyum)

⚠️ Interpolate the light position in spherical coordinates instead of cartesian ones, so that a transition keeps its radial distance. (#7919) (by @HarelM)

⚠️ styleimagemissing is now a notify-only event instead of the previous callback that allowed to provide an image. This aligns the event with standard event semantics (notify, not resolve). Use Map.setMissingStyleImageResolver to on-demand supply images instead via an function that can now also be async. (#7892) (by @birkskyum)

⚠️ Map now composes a Camera instead of extending it (Map extends Evented directly and forwards the camera API). The internal map.transform was removed — use map's public API instead or open a PR if you need something that's not exposed. Removed the internal transform.getMatrixForModel helper (#7800) (by @HarelM)

⚠️ All map events are now real classes that are instantiated when they are fired. Renamed the Maps' BoxZoom handler from MapLibreZoomEvent to MapBoxZoomEvent, added the rollstart/roll/rollend and style.load (as MapStyleLoadEvent) events to MapEventType, and added event classes and type-map for Marker, Popup, GeolocateControl and FullscreenControl. Removed MapDataEvent: the data/dataloading/dataabort events are now MapSourceDataEvent | MapStyleDataEvent, so source data events carry the full source info (sourceId, tile, sourceDataType, …). Added MapMovementEvent as the type for all camera-transition events (move/zoom/rotate/pitch/roll/drag and their start/end variants). Evented is now generic over an event-type map (Evented<EventType>) and is abstract, so subclasses get strongly-typed on/once/off automatically without re-declaring overloads — this also types the events on Camera/Style (via MapEventType) and on the sources (via the new SourceEventType) (#7789) (by @HarelM)

⚠️ Update maplibre-gl-style-spec to version 25, which now throws an error with warning severity instead of silently failing on encoutering legacy expressions (#7792) (by @HarelM)

⚠️ Removed the remaining mapbox references in the code and in the tests. This changes the #pragma mapbox to #pragma maplibre in case you have shader code that relied on it. (#7761) (by @HarelM)

⚠️ zoomLevelsToOverscale default value was changed to 4 to support better handling of high level zoom with dense labels. This might have a side effect of changing a bit the results of queryRenderedFeatures and some rendering of polygon center label. To revert this change, set the value to undefined (#7537) (by @HarelM)

⚠️ Remove the second parameter from GeoJSONSource.setData (waitForCompletion) and remove the return value of this to allow future changes to the API (#7538) (by @HarelM)

⚠️ The TypeScript target has been updated to ES2022. This results in smaller bundles and improved runtime performance by relying on modern JavaScript features and reducing transpilation. Consumers targeting browsers or using some tooling released before 2022 may need to transpile MapLibre or update. This change also aligns all internal build configurations to a single target instead of ES2016 + ES2019, avoiding inconsistencies in emitted code. (#7404) (by @CommanderStorm)

⚠️ WebGL (v1) support has been removed; WebGL2 is now required. In practical terms, this will not change how you interact with the map. This enables performance improvements (e.g. line opacity), Terrain3D enhancements, and several bug fixes. WebGL2 support has been widely available for years, and usage of the legacy path had plateaued, so maintaining it no longer justified the added complexity. To ease this breaking change, we have also refactored how we handle the case that no webgl is avaliable (e.g. due to browser restrictions). You can now listen to the webgl error via .on("error"). See caniuse.com/webgl2 for ecosystem support and our RFC for details. (#7453) (by @CommanderStorm)

⚠️ Support geojson nested objects, this is a breaking change as it encodes __$json__ before properties that used to be an object. It also parses them back, but this is still a breaking change if you assumed this bug existed. (#6992) (by HarelM)

⚠️ Improve types for {get,set}LayoutProperty, {get,set}PaintProperty to be the actual type instead of string/any (#7481) (by @CommanderStorm)

⚠️ Refactored the Hash-based location control (the option that syncs map state to the URL like #map=5/1/2) to use URLSearchParams internally. This improves extensibility for custom use cases, but may break existing code that relies on the previous implementation. It also changes how certain edge cases are parsed—for example, strings like [#10](https://github.com/maplibre/maplibre-gl-js/issues/10)%2F3.00%2F-1.00 are now accepted, and hashes like #foo are normalized to #foo=. (#7073) (by @CommanderStorm)

Validate the terrain passed to map.setTerrain, which was previously applied unchecked (#7941) (by @HarelM)

... (truncated)

Commits

3d50bcf Bump js version to 6.1.0 (#8058)
5d50057 chore(deps-dev): bump rollup from 4.62.2 to 4.62.3 (#8055)
8ad192c chore(deps-dev): bump globals from 17.7.0 to 17.8.0 (#8056)
b143343 fix: clip z0 tile at antimeridian on globe to prevent double rendering (#7896)
7e8e1e4 Add a Vitest bench lane for micro benchmarks (#8047)
985df32 Show grab cursor for draggable markers (#8023)
cb32014 chore(deps-dev): bump postcss from 8.5.22 to 8.5.23 (#8042)
1ab477c chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 in the eslint group (#8040)
cb98660 Fix npm run benchmark (#8027)
b2e4cc1 chore(deps): bump github/codeql-action/analyze from 4.37.2 to 4.37.3 (#8036)
Additional commits viewable in compare view

Updates next from 16.2.10 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Updates next-intl from 4.13.2 to 4.13.4

Release notes

Sourced from next-intl's releases.

v4.13.4

4.13.4 (2026-07-23)

Bug Fixes

Avoid usePathname() reads for non-locale-switching links, avoiding unnecessary <Suspense> wrappers with partial prefetching (#2362) (82de47f) – by @ceolinwill

v4.13.3

4.13.3 (2026-07-21)

Bug Fixes

Next.js 16.3 compatibility preparation (only update locale cookie for document requests and not prefetches) (#2355) (0555ace) – by @amannn

Changelog

Sourced from next-intl's changelog.

4.13.4 (2026-07-23)

Bug Fixes

Avoid usePathname() reads for non-locale-switching links, avoiding unnecessary <Suspense> wrappers with partial prefetching (#2362) (82de47f) – by @ceolinwill

4.13.3 (2026-07-21)

Bug Fixes

Next.js 16.3 compatibility preparation (only update locale cookie for document requests and not prefetches) (#2355) (0555ace) – by @amannn

Commits

7fa175d v4.13.4
82de47f fix: Avoid usePathname() reads for non-locale-switching links, avoiding unn...
89ae783 v4.13.3
0555ace fix: Next.js 16.3 compatibility preparation (only update locale cookie for do...
89c72b1 docs: Add AI agents page, integrate eloqnt studio, and update nav (#2357)
See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

See full diff in compare view

Updates resend from 6.17.2 to 6.18.1

Release notes

Sourced from resend's releases.

v6.18.1

What's Changed

feat(webhooks): add suppression webho...
Description has been truncated

Bumps the npm-dependencies group with 16 updates: | Package | From | To | | --- | --- | --- | | [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.7` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.28.0` | | [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) | `5.24.0` | `6.1.0` | | [next](https://github.com/vercel/next.js) | `16.2.10` | `16.2.12` | | [next-intl](https://github.com/amannn/next-intl) | `4.13.2` | `4.13.4` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` | | [resend](https://github.com/resend/resend-node) | `6.17.2` | `6.18.1` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` | | [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.8.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.10` | `16.2.12` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.3.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.5` | `3.9.6` | Updates `jose` from 6.2.3 to 6.2.7 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.3...v6.2.7) Updates `lucide-react` from 1.25.0 to 1.28.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react) Updates `maplibre-gl` from 5.24.0 to 6.1.0 - [Release notes](https://github.com/maplibre/maplibre-gl-js/releases) - [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md) - [Commits](maplibre/maplibre-gl-js@v5.24.0...v6.1.0) Updates `next` from 16.2.10 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.10...v16.2.12) Updates `next-intl` from 4.13.2 to 4.13.4 - [Release notes](https://github.com/amannn/next-intl/releases) - [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md) - [Commits](amannn/next-intl@v4.13.2...v4.13.4) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `resend` from 6.17.2 to 6.18.1 - [Release notes](https://github.com/resend/resend-node/releases) - [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md) - [Commits](resend/resend-node@v6.17.2...v6.18.1) Updates `@playwright/test` from 1.61.1 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.62.1) Updates `@types/node` from 26.1.1 to 26.1.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `eslint` from 10.7.0 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.7.0...v10.8.0) Updates `eslint-config-next` from 16.2.10 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/eslint-config-next) Updates `lint-staged` from 17.0.8 to 17.3.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.8...v17.3.0) Updates `prettier` from 3.9.5 to 3.9.6 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.5...3.9.6) --- updated-dependencies: - dependency-name: jose dependency-version: 6.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: lucide-react dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: maplibre-gl dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: next-intl dependency-version: 4.13.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: resend dependency-version: 6.18.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@playwright/test" dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/node" dependency-version: 26.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: eslint-config-next dependency-version: 16.2.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: lint-staged dependency-version: 17.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-04T13:15:00Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

vercel · 2026-08-04T13:15:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
signal-feed	Error		Aug 4, 2026 1:15pm

github-actions · 2026-08-04T13:15:39Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 3 package(s) with unknown licenses.

See the Details below.

License Issues

package-lock.json

Package	Version	License	Issue Type
icu-minify	4.13.5	Null	Unknown License
next-intl-swc-plugin-extractor	4.13.5	Null	Unknown License
use-intl	4.13.5	Null	Unknown License

Denied Licenses:
GPL-3.0, AGPL-3.0

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@eslint/config-helpers

0.7.0

Unknown

npm/@formatjs/icu-messageformat-parser

3.5.16

🟢 3.8

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/28 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
License	⚠️ 0	license file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@mapbox/jsonlint-lines-primitives

2.0.3

🟢 4.8

Details

Check	Score	Reason
Code-Review	⚠️ 2	Found 8/28 approved changesets -- score normalized to 2
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	⚠️ 1	2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
SAST	🟢 3	SAST tool is not run on all commits -- score normalized to 3

npm/@mapbox/tiny-sdf

2.2.0

🟢 5.5

Details

Check	Score	Reason
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Maintained	🟢 3	4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 5	Found 11/21 approved changesets -- score normalized to 5
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
SAST	🟢 6	SAST tool is not run on all commits -- score normalized to 6

npm/@mapbox/unitbezier

1.0.0

🟢 5.2

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 3	4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Code-Review	⚠️ 2	Found 3/11 approved changesets -- score normalized to 2
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
SAST	🟢 6	SAST tool is not run on all commits -- score normalized to 6

npm/@mapbox/vector-tile

3.0.0

🟢 6.2

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 5	Found 8/15 approved changesets -- score normalized to 5
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@maplibre/geojson-vt

6.1.1

Unknown

npm/@maplibre/maplibre-gl-style-spec

26.2.1

Unknown

npm/@maplibre/mlt

1.1.12

Unknown

npm/@maplibre/vt-pbf

4.3.2

Unknown

npm/@next/env

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/eslint-plugin-next

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-darwin-arm64

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-darwin-x64

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-arm64-gnu

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-arm64-musl

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-x64-gnu

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-x64-musl

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-win32-arm64-msvc

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-win32-x64-msvc

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@playwright/test

1.62.1

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices	⚠️ 0	no badge detected
Vulnerabilities	🟢 10	no vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	no published package detected
Token-Permissions	⚠️ 0	non read-only tokens detected in GitHub workflows
Binary-Artifacts	🟢 6	binaries present in source code
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches

npm/@types/node

26.1.2

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/29 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
License	🟢 9	license file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/react

19.2.18

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/29 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
License	🟢 9	license file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/react-dom

19.2.4

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/29 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
License	🟢 9	license file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/earcut

3.2.3

🟢 5.9

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/17 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9

npm/eslint

10.8.0

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 22/27 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

npm/eslint-config-next

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/fsevents

2.3.2

🟢 3.1

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review	🟢 3	Found 7/22 approved changesets -- score normalized to 3
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/icu-minify

4.13.5

Unknown

npm/intl-messageformat

11.2.13

🟢 3.8

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/28 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
License	⚠️ 0	license file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/jose

6.2.7

🟢 6.9

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 2/26 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	🟢 10	security policy file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
SAST	🟢 6	SAST tool is not run on all commits -- score normalized to 6

npm/kdbush

4.1.0

🟢 3.5

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 5	6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Code-Review	⚠️ 0	Found 2/28 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/lint-staged

17.3.0

Unknown

npm/lucide-react

1.28.0

🟢 4.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/29 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 9	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	🟢 3	SAST tool is not run on all commits -- score normalized to 3

npm/maplibre-gl

6.1.0

🟢 6.6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) out of 30 and 21 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all last 30 commits are reviewed through GitHub
CII-Best-Practices	⚠️ 0	no badge detected
Vulnerabilities	🟢 10	no vulnerabilities detected
Signed-Releases	⚠️ 0	0 out of 5 artifacts are signed or have provenance
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
Dependency-Update-Tool	🟢 10	update tool detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	non read-only tokens detected in GitHub workflows
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Packaging	🟢 10	publishing workflow detected

npm/next

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/next-intl

4.13.4

🟢 4.1

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Maintained	🟢 10	29 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 9	binaries present in source code
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Packaging	🟢 10	packaging workflow detected

npm/next-intl-swc-plugin-extractor

4.13.5

Unknown

npm/pbf

5.1.2

🟢 7.4

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9

npm/playwright

1.62.1

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices	⚠️ 0	no badge detected
Vulnerabilities	🟢 10	no vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	no published package detected
Token-Permissions	⚠️ 0	non read-only tokens detected in GitHub workflows
Binary-Artifacts	🟢 6	binaries present in source code
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches

npm/playwright-core

1.62.1

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices	⚠️ 0	no badge detected
Vulnerabilities	🟢 10	no vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	no published package detected
Token-Permissions	⚠️ 0	non read-only tokens detected in GitHub workflows
Binary-Artifacts	🟢 6	binaries present in source code
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches

npm/postal-mime

2.7.5

Unknown

npm/prettier

3.9.6

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 4	Found 6/13 approved changesets -- score normalized to 4
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

npm/react

19.2.8

Unknown

npm/react-dom

19.2.8

Unknown

npm/resend

6.18.1

Unknown

npm/use-intl

4.13.5

Unknown

Scanned Files

package-lock.json

vercel Bot had a problem deploying to Preview August 4, 2026 13:15 Failure

Navigation Menu

chore(deps): bump the npm-dependencies group with 16 updates - #77

chore(deps): bump the npm-dependencies group with 16 updates#77
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-bd7ccdfebc

dependabot Bot commented on behalf of github Aug 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 4, 2026

Uh oh!

vercel Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 4, 2026

v6.2.7

Fixes

Refactor

v6.2.6

Fixes

v6.2.5

Fixes

Documentation

Refactor

6.2.7 (2026-08-01)

Fixes

Refactor

6.2.6 (2026-07-31)

Fixes

6.2.5 (2026-07-29)

Fixes

Documentation

Refactor

Version 1.28.0

What's Changed

Version 1.27.0

What's Changed

New Contributors

Version 1.26.0

What's Changed

v6.1.0

✨ Features and improvements

🐞 Bug fixes

v6.0.0

✨ Features and improvements

6.1.0

✨ Features and improvements

🐞 Bug fixes

6.0.0

✨ Features and improvements

v16.2.12

What's Changed

v16.2.11

v4.13.4

4.13.4 (2026-07-23)

Bug Fixes

v4.13.3

4.13.3 (2026-07-21)

Bug Fixes

4.13.4 (2026-07-23)

Bug Fixes

4.13.3 (2026-07-21)

Bug Fixes

19.2.8 (July 21st, 2026)

React Server Components

19.2.8 (July 21st, 2026)

React Server Components

v6.18.1

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Aug 4, 2026

Labels

Uh oh!

vercel Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026

Dependency Review

License Issues

package-lock.json

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Aug 4, 2026 •

edited

Loading