Skip to content

Bump the development-dependencies group across 1 directory with 12 updates - #201

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-baaeb4afc6
Open

Bump the development-dependencies group across 1 directory with 12 updates#201
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-baaeb4afc6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the development-dependencies group with 11 updates in the / directory:

Package From To
@cloudflare/vitest-pool-workers 0.8.71 0.20.2
@cloudflare/workers-types 4.20250910.0 5.20260804.1
@types/semver 7.7.1 7.8.0
@typescript-eslint/eslint-plugin 8.40.0 8.66.0
eslint 9.34.0 10.8.0
eslint-plugin-prettier 5.5.4 5.5.6
prettier 3.6.2 3.9.6
ts-loader 9.5.4 9.6.2
typescript 5.9.2 7.0.2
vitest 3.2.4 4.1.10
wrangler 4.35.0 4.119.0

Updates @cloudflare/vitest-pool-workers from 0.8.71 to 0.20.2

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.20.2

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.1

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.0

Minor Changes

  • #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

    • wrappedBindings
    • cacheWarnUsage
    • fetchMock: you should use outboundService instead
    • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

    Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

@​cloudflare/vitest-pool-workers@​0.19.1

Patch Changes

@​cloudflare/vitest-pool-workers@​0.19.0

Minor Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.20.2

Patch Changes

0.20.1

Patch Changes

0.20.0

Minor Changes

  • #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

    • wrappedBindings
    • cacheWarnUsage
    • fetchMock: you should use outboundService instead
    • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

    Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

0.19.1

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cloudflare/vitest-pool-workers since your current version.


Updates @cloudflare/workers-types from 4.20250910.0 to 5.20260804.1

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cloudflare/workers-types since your current version.


Updates @types/semver from 7.7.1 to 7.8.0

Commits

Updates @typescript-eslint/eslint-plugin from 8.40.0 to 8.66.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

  • typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
  • website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
  • typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.66.0 (2026-08-03)

🩹 Fixes

  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.65.0 (2026-07-20)

🚀 Features

  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

🚀 Features

  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)

... (truncated)

Commits
  • e51b11b chore(release): publish 8.66.0
  • 20cb15e chore(eslint-plugin): split prefer-optional-chain.test.ts in multiple files (...
  • 780a8c5 docs(eslint-plugin): [member-ordering] add lacking commas in default member t...
  • 08dd427 fix(eslint-plugin): [class-literal-property-style] preserve type annotations ...
  • 6be25d3 fix(eslint-plugin): [no-unnecessary-type-parameters] check MappedType key rem...
  • 8826d0e fix(eslint-plugin): [no-useless-default-assignment] don't report defaults use...
  • 7aecc1c fix(eslint-plugin): [prefer-nullish-coalescing] handle shadowed Boolean calls...
  • 5ffa760 fix(eslint-plugin): [no-unnecessary-type-conversion] ignore shadowed built-in...
  • f282f84 chore(eslint-plugin): fix all eslint-plugin/require-test-error-positions (#...
  • c8cafa4 docs: [unified-signatures] caveats regarding signatures merging (#12581)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​typescript-eslint/eslint-plugin since your current version.


Updates @typescript-eslint/parser from 8.40.0 to 8.66.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

  • typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
  • website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
  • typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.66.0 (2026-08-03)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

... (truncated)

Commits
  • e51b11b chore(release): publish 8.66.0
  • 63ba81b chore(release): publish 8.65.0
  • eaf4576 feat: add warning when TS 7 is detected (#12529)
  • d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
  • 0d06406 chore: add attw validation to repo (#12437)
  • c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
  • 414d9ab chore(release): publish 8.64.0
  • 290cf6c chore(release): publish 8.63.0
  • 3ea32f4 chore(release): publish 8.62.1
  • 54e2857 chore(release): publish 8.62.0
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​typescript-eslint/parser since your current version.


Updates eslint from 9.34.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

  • 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits

Updates eslint-plugin-prettier from 5.5.4 to 5.5.6

Release notes

Sourced from eslint-plugin-prettier's releases.

v5.5.6

Patch Changes

v5.5.5

Patch Changes

Changelog

Sourced from eslint-plugin-prettier's changelog.

5.5.6

Patch Changes

5.5.5

Patch Changes

Commits
  • 4f33ea5 chore: release eslint-plugin-prettier (#792)
  • 4745b54 ci: declare workflow-level contents: read on 2 workflows (#790)
  • b5c96a3 chore: bump all (dev)Dependencies (#791)
  • e867680 chore(deps): update all dependencies (#766)
  • e8e2f7f chore: testing eslint v10 (#779)
  • ca076d9 chore: update dev dependencies (#780)
  • 42e6369 build(deps): Bump the actions group with 2 updates (#778)
  • 53ff214 Remove empty NPM_TOKEN from relea...

    Description has been truncated

@dependabot
Bump the development-dependencies group across 1 directory with 12 up…
f99c4cf 
…dates

Bumps the development-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.8.71` | `0.20.2` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20250910.0` | `5.20260804.1` |
| [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.40.0` | `8.66.0` |
| [eslint](https://github.com/eslint/eslint) | `9.34.0` | `10.8.0` |
| [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) | `5.5.4` | `5.5.6` |
| [prettier](https://github.com/prettier/prettier) | `3.6.2` | `3.9.6` |
| [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.5.4` | `9.6.2` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.2` | `7.0.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `4.1.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.35.0` | `4.119.0` |



Updates `@cloudflare/vitest-pool-workers` from 0.8.71 to 0.20.2
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.2/packages/vitest-pool-workers)

Updates `@cloudflare/workers-types` from 4.20250910.0 to 5.20260804.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@types/semver` from 7.7.1 to 7.8.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver)

Updates `@typescript-eslint/eslint-plugin` from 8.40.0 to 8.66.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.40.0 to 8.66.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/parser)

Updates `eslint` from 9.34.0 to 10.8.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.34.0...v10.8.0)

Updates `eslint-plugin-prettier` from 5.5.4 to 5.5.6
- [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases)
- [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/eslint-plugin-prettier@v5.5.4...v5.5.6)

Updates `prettier` from 3.6.2 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.6.2...3.9.6)

Updates `ts-loader` from 9.5.4 to 9.6.2
- [Release notes](https://github.com/TypeStrong/ts-loader/releases)
- [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md)
- [Commits](TypeStrong/ts-loader@v9.5.4...v9.6.2)

Updates `typescript` from 5.9.2 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `vitest` from 3.2.4 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `wrangler` from 4.35.0 to 4.119.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.119.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.20.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260804.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: "@types/semver"
  dependency-version: 7.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.66.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.66.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: eslint
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: eslint-plugin-prettier
  dependency-version: 5.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: ts-loader
  dependency-version: 9.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: wrangler
  dependency-version: 4.119.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file npm labels Aug 10, 2026
@socket-security

socket-security Bot commented Aug 10, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​typescript-eslint/​parser@​8.40.0 ⏵ 8.66.010010072 +198100
Updated@​types/​semver@​7.7.1 ⏵ 7.8.010010074 +187100
Updatedvitest@​3.2.4 ⏵ 4.1.1098 +1100 +7579 +197100
Updated@​typescript-eslint/​eslint-plugin@​8.40.0 ⏵ 8.66.099 +110080 +198100
Updated@​cloudflare/​vitest-pool-workers@​0.8.71 ⏵ 0.20.299 +110080 +396 -4100
Updatedtypescript@​5.9.2 ⏵ 7.0.29910089 -1100 +1100 +10
Updatedeslint-plugin-prettier@​5.5.4 ⏵ 5.5.6100 +1100100 +191 +4100
Updatedwrangler@​4.35.0 ⏵ 4.119.098100 +1692 -296 +1100
Updatedts-loader@​9.5.4 ⏵ 9.6.299 +110010093 +3100
Updated@​cloudflare/​workers-types@​4.20250910.0 ⏵ 5.20260804.110010096 -499 -1100
Updatedeslint@​9.34.0 ⏵ 10.8.09710010097 +1100
Updatedprettier@​3.6.2 ⏵ 3.9.698 +110097 +197 -1100

View full report

@socket-security

socket-security Bot commented Aug 10, 2026

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block High
High CVE: npm undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

CVE: GHSA-4cwx-7wf7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives (HIGH)

Affected versions: >= 7.0.0 < 7.29.0; >= 8.0.0 < 8.9.0

Patched version: 7.29.0

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/undici@7.28.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.28.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm @cloudflare/vitest-pool-workers in module node:child_process

Module: node:child_process

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/vitest-pool-workers@0.20.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-darwin-arm64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-darwin-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-darwin-x64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-darwin-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-arm has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-linux-arm@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-arm64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-linux-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-ppc64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-linux-ppc64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-ppc64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-riscv64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-linux-riscv64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-riscv64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-s390x has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-linux-s390x@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-s390x@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-x64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-linux-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linuxmusl-arm64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-linuxmusl-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linuxmusl-x64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-linuxmusl-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @img/sharp-wasm32 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-wasm32@0.35.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: npm @img/sharp-wasm32

Eval Type: Function

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/@img/sharp-wasm32@0.35.2

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @cloudflare/vitest-pool-workers is 66.0% likely to have a medium risk anomaly

Notes: Overall, this module is internal-style Vitest worker infrastructure that processes untrusted request headers and WebSocket payloads and reconstructs complex objects from that input. Its dominant risk signal is deliberate dynamic code execution: it enables an unsafe eval mode and globally patches Function to route to unsafeEval.newFunction. While there is no clear evidence of classic malware/exfiltration in the snippet, the presence of an unsafe eval/Function execution surface combined with network-fed deserialization warrants a high-suspicion review and strict assurance that inputs and unsafeEval configuration cannot be attacker-controlled.

Confidence: 0.66

Severity: 0.65

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/vitest-pool-workers@0.20.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @cloudflare/vitest-pool-workers is 66.0% likely to have a medium risk anomaly

Notes: This module is primarily a cross-platform process-launch helper and shows no direct evidence of stealthy malware behavior (no exfiltration, persistence, or credential theft). However, it has a security-relevant capability: on Windows/WSL it executes PowerShell with -ExecutionPolicy Bypass -EncodedCommand using a dynamically constructed script that incorporates caller-provided target/app/arguments. If upstream callers pass attacker-controlled input without strict validation/allowlisting, the encoded PowerShell execution path can become an injection risk. Treat as moderate risk for untrusted-input scenarios and ensure consumers sanitize/allowlist target/app values.

Confidence: 0.66

Severity: 0.53

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/vitest-pool-workers@0.20.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @vitest/snapshot is 74.0% likely to have a medium risk anomaly

Notes: Not obviously malware, but this snapshot module contains a high-impact dynamic code execution primitive: it evaluates snapshot file contents using new Function('exports', snapshotContents). If snapshot contents can be influenced by an attacker, it becomes a direct arbitrary code execution vector during test execution. It also writes/deletes snapshot and test files via the provided snapshot environment; otherwise it performs typical snapshot comparison/serialization logic with no network exfiltration indicators.

Confidence: 0.74

Severity: 0.63

From: package-lock.json → npm/vitest@4.1.10 → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@vitest/snapshot@4.1.10

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/snapshot@4.1.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 75.0% likely to have a medium risk anomaly

Notes: The code represents a conventional, non-obfuscated part of AJV’s custom keyword support. No direct malicious actions are evident within this module. Security concerns mainly arise from the broader supply chain: the external rule implementation (dotjs/custom), the definition schema, and any user-supplied keyword definitions. The dynamic compilation path (compile(metaSchema, true)) should be exercised with trusted inputs. Recommended follow-up: review the contents of the external modules and monitor the inputs supplied to addKeyword/definitionSchema to ensure no unsafe behavior is introduced during validation or data handling.

Confidence: 0.75

Severity: 0.55

From: package-lock.json → npm/eslint@10.8.0 → npm/ajv@6.15.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 65.0% likely to have a medium risk anomaly

Notes: The code is a straightforward build script to bundle and minify a specified package using Browserify and UglifyJS. The primary security concern is potential path manipulation: json.main is used to form a require path without validating that it stays within the target package directory. If a malicious or misconfigured package.json includes an absolute path or traversal outside the package, the script could bundle unintended files. Otherwise, the script does not perform network access, data exfiltration, or backdoor actions, and there is no hard-coded secrets or dynamic code execution beyond standard bundling/minification.

Confidence: 0.65

Severity: 0.58

From: package-lock.json → npm/eslint@10.8.0 → npm/ajv@6.15.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 61.0% likely to have a medium risk anomaly

Notes: The code augments a meta-schema to permit remote dereferencing of keyword schemas via a hardcoded data.json resource. This introduces network dependency and potential changes to validation semantics at runtime. While not inherently malicious, the remote reference constitutes a notable security and reliability risk that should be mitigated with local fallbacks, input validation, and explicit remote-resource governance.

Confidence: 0.61

Severity: 0.60

From: package-lock.json → npm/eslint@10.8.0 → npm/ajv@6.15.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm es-module-lexer is 66.0% likely to have a medium risk anomaly

Notes: This wrapper is a WASM-backed parser, but it conditionally executes eval() on substrings extracted from attacker-controlled input when those substrings look like quoted literals. This creates a direct code-execution risk within the calling process (or at minimum enables attacker-controlled evaluation semantics). Additionally, it can include input excerpts in thrown errors. No explicit network/filesystem sabotage is visible in the JS wrapper; the embedded WASM behavior is largely opaque.

Confidence: 0.66

Severity: 0.70

From: package-lock.json → npm/ts-loader@9.6.2 → npm/vitest@4.1.10 → npm/es-module-lexer@2.3.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm es-module-lexer is 72.0% likely to have a medium risk anomaly

Notes: An embedded WebAssembly-based parser extracts substrings from untrusted input and passes them to (0, eval) at runtime, creating a code-execution risk where attacker-controlled input can lead to arbitrary JavaScript execution and potential leakage through error messages. The threat remains even though parsing occurs inside the WASM module; the root cause is unsafe dynamic evaluation of attacker-influenced substrings. Avoid running parse() on untrusted data or sandbox/avoid eval-enabled builds.

Confidence: 0.72

Severity: 0.88

From: package-lock.json → npm/ts-loader@9.6.2 → npm/vitest@4.1.10 → npm/es-module-lexer@2.3.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm esbuild is 90.0% likely to have a medium risk anomaly

Notes: The esbuild package uses a postinstall install.js script to download platform-specific binaries from registry sources and verify them via hashes. While hash verification reduces risk, the elevated postinstall action creates a potential code-execution surface if the script is tampered with. Audit install.js and its endpoints, ensure artifacts are strictly verified against known hashes, and test in controlled environments before deployment.

Confidence: 0.90

Severity: 0.60

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0 → npm/esbuild@0.28.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esbuild@0.28.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm prettier is 60.0% likely to have a medium risk anomaly

Notes: No direct evidence of embedded malware (no eval/new Function, no credential theft, no obvious backdoor/persistence, no explicit network exfiltration) is visible in this fragment. The dominant security concern is supply-chain/execution risk: the code dynamically imports and executes formatter plugins based on user/config-supplied plugin identifiers and resolution rooted at process.cwd(). Additionally, it can read/write local files (including writing formatted output back to caller-specified paths) and uses predictable temp JSON files that may be susceptible to interference in shared environments. Security posture depends heavily on whether plugin inputs and file paths are trusted/validated and whether dependency/plugin resolution is constrained.

Confidence: 0.60

Severity: 0.55

From: package-lock.json → npm/prettier@3.9.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/prettier@3.9.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 7 more rows in the dashboard

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@mackenly mackenly

Labels

dependencies Pull requests that update a dependency file npm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mackenly