build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by dependabot[bot] · Pull Request #196 · microsoft/AI-Engineering-Coach

dependabot · 2026-07-22T01:14:50Z

Bumps the dev-dependencies group with 3 updates in the / directory: knip, lint-staged and typescript-eslint.

Updates knip from 6.26.0 to 6.29.0

Release notes

Release 6.29.0

fix(glob): do not follow symbolic links in async glob (#1900) (b7d5ce2f545d91953a97733aa1567e8728b20644) - thanks @mogelbrod!

Add built-in compiler for tsrx (db05e0142a41fad2ad45d62ba5106e0d97c92b45)

Fix -u shortcut for --duration (932b9262af275d209923a5efab1b6f23067bb006)

Release 6.28.0

Update oxc-resolver (resolve #1889) (1444f6aaf04d42ad07ee0b88da4dfae0e116043a)

Keep entry-exported members public (resolve #1890) (94967c13a589a7e83408b1495c31323ac126fcab)

Don't un-ignore sibling paths on unrelated gitignore negations (resolve #1891) (5c026ba50c1e89804fc5094a52dc4c4c37d92bc2)

Memoize the gitignore shadowed-pattern check (a5fa3b0ebb7f84c107dba1c1ca9a9b73995f668f)

Ignore nested files under a gitignore dir/* pattern (404a53e3e49fa7c1f51b60bcb30ea50450f75aab)

Track types referenced by JSDoc imports (resolve #1888) (6ae48aadbe03952690c8608e6df42bd039cf6624)

Update oxc-parser (02ca17a72c3f0afa7df32297d2dd2f5463ac6e00)

feat: markdownlint-cli2 (#1887) (323b96f55b38b53f5e4648d72fecd968fae35147) - thanks @Zamiell!

Update rolldown snapshot (009e509dee6a5013fd3937abb4ec81684601b023)

Resolve $GITHUB_ACTION_PATH in GHA composite actions (ead489f066733f701acfe5b81eac0a6c813fb5c5)

Don't report node: specifiers as unlisted dependencies (1a7114f0a159fe82328041e11fc61c5c1730cc01)

Discover tsdown CLI entries (0d47a45bfc518a7bf73a4b4878aeab236d6f9791)

Discover Convex function modules (e01f21c44773186e7ad74e7badf9fc81b82edfb5)

Ignore common system binaries (cd003065fda5422550a412bba07ebbb1f9bae126)

Add OpenClaw plugin (73a2d7dd45f65ea312fde38cb4fa4f5a4fc34bf2)

Discover Tailwind CLI input stylesheet (resolve #1551) (9ae5feed922ecb7e8c436545e9b45125bd73b457)

Discover Angular global stylesheets from angular.json (fb9e0488f6f21284714d0651fcf1dd2de02d425a)

Hint when project patterns exclude a compiled extension (74de516d3d73839536fc2a43c2c0ec38a6299631)

Ignore common global binaries (a99a206015fe414a4de12016cc62499910afaf6f)

Run multiple preprocessors in sequence (844358367e9d1939bbf47f8dcb97d810741f56c1)

fix(nuxt): resolve nuxt module paths (#1896) (3c8594f5ffc641b00575b6d7455990db1277ac75) - thanks @danielroe!

Report unused re-exports when ignoreExportsUsedInFile is set (#1895) (a113a5f4eedc81ef56b00a3e488cc94febefede5) - thanks @mlm20!

Pass -w to pnpm add in sentry ecosystem test (ea8c8ac6fe9519f00ca6a61131b345f5de521704)

Update sentry snapshot (b75768d544d9f869ebce8f8c6dd8490f3db87023)

Record all traversed dirs in glob cache (resolve #1897) (81be1d436eae15518df764cbcb443899e11a9569)

Invalidate glob cache when .gitignore changes (baff301f2dceda97bf8bf73809d811cc44c72c8c)

Improve Nuxt and Nitro plugin resolution (86ffab7bcdd095631d6b0b17254e8acd6b5022bc)

fix: don't treat [-]-c[heck] as config flag for prettier (#1902) (b7266ee8240a9b8686e91a44a4706d3605d094c4) - thanks @davidkna-sap!

Use Entra ID to publish VS Code extension (4236253482f884d92cfde2ccf85c7fb9aca17f7e)

Remove obsolete trust policy exclusions (630d5f9835f4303ec9aa7d090ad40a177808c4fb)

Update dependencies (810147b5aa21bb57ad103fd19ba92844e42cd84c)

Migrate from typescript/native-preview to typescript (140a25a577a64273a7a77f2ff2c8f224118ac298)

Release 6.27.0

Add Temporal plugin (98191a04aad0572bead191b101bfecef75067b0c)

Handle -d alias for react-email dir argument (53d1fec3213db8d6a84dfa7a82050b122782e065)

Expand pnpm script references with forwarded arguments (33e9799df39450033061b9c4c07daf22f5d15721)

Treat path-shaped script tokens as file references, extend known global binaries (d9508c282ab81351beda4b2f859435b49f142c51)

Mark tsdown neverBundle dependencies as referenced (5fd863ba12e68842f91ab1a94e7e30d1e571da92)

Support TanStack Start in tanstack-router plugin (bd63cd8af88dac03a98aa17f1add322f7bdf4a94)

Mark vite ssr.external dependencies as referenced (91de938032062cb667bced0eadef9e67d1e20b1f)

Expand bun, npm, and yarn script references with forwarded arguments (b5a31767a83e2cec3fb20c3b146d94c0412a4fd6)

Add Latitude as sponsor (42676759cad5fb10ac96fd7c0457037e906f4b68)

Regenerate plugin list in docs (1d2cdffb4d4151f848c44e066eff43e9efbf44fe)

... (truncated)

Commits

d9a6fe0 Release knip@6.29.0
932b926 Fix -u shortcut for --duration
db05e01 Add built-in compiler for tsrx
b7d5ce2 fix(glob): do not follow symbolic links in async glob (#1900)
fc16b38 Release knip@6.28.0
140a25a Migrate from typescript/native-preview to typescript
810147b Update dependencies
b7266ee fix: don't treat [-]-c[heck] as config flag for prettier (#1902)
86ffab7 Improve Nuxt and Nitro plugin resolution
baff301 Invalidate glob cache when .gitignore changes
Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.2.0

Release notes

Sourced from lint-staged's releases.

v17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};
Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};
v17.1.1

Patch Changes

#1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

v17.1.0

Minor Changes
#1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

Before:

Size of node_modules/ after installing: 1561.7 kB with 29 packages.

Fancy interactive spinners, but output dynamically changes:
✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...
✔ Staging changes from tasks...
✔ Cleaning up temporary files...

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};
Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};
17.1.1

Patch Changes

#1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

17.1.0

Minor Changes
#1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

Before:

Size of node_modules/ after installing: 1561.7 kB with 29 packages.

Fancy interactive spinners, but output dynamically changes:
✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...

... (truncated)

Commits

fb540fb Merge pull request #1824 from lint-staged/changeset-release/main
dc0a738 chore(changeset): release
60cbb88 Merge pull request #1823 from lint-staged/reimplement-chunk-files
2354dc4 build(deps): update dependencies
0516e7f docs: adjust debug logs
e22f6ed style: run oxfmt on README.md
37e8e1a fix: restore chunking of git add command after running tasks
2c75f1d chore: remove unused file
ee156cc feat: add improved lazy-chunking of command strings
baa7c98 feat: remove current chunkFiles implementation
Additional commits viewable in compare view

Updates typescript-eslint from 8.64.0 to 8.65.0

Release notes

Sourced from typescript-eslint's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

add warning when TS 7 is detected (#12529)

eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)

eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)

parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)

eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)

eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

Evyatar Daud @StyleShit

Josh Goldberg ✨

Kirk Waiblinger @kirkwaiblinger

Serhii Leniv @Serhii-Leniv

송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.65.0 (2026-07-20)

🚀 Features

add warning when TS 7 is detected (#12529)

❤️ Thank You

Josh Goldberg ✨

Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

63ba81b chore(release): publish 8.65.0
eaf4576 feat: add warning when TS 7 is detected (#12529)
0d06406 chore: add attw validation to repo (#12437)
c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
See full diff in compare view

Copilot

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates several devDependencies to newer patch/minor versions.

Changes:

Bump knip from 6.26.0 to 6.27.0
Bump lint-staged from 17.0.8 to 17.1.0
Bump typescript-eslint from 8.64.0 to 8.65.0

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-07-22T01:15:05Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@emnapi/core

1.11.2

🟢 3.6

Details

Check	Score	Reason
Maintained	🟢 10	18 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 2	Found 6/30 approved changesets -- score normalized to 2
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@emnapi/runtime

1.11.2

🟢 3.6

Details

Check	Score	Reason
Maintained	🟢 10	18 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 2	Found 6/30 approved changesets -- score normalized to 2
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@oxc-parser/binding-android-arm-eabi

0.140.0

Unknown

npm/@oxc-parser/binding-android-arm64

0.140.0

Unknown

npm/@oxc-parser/binding-darwin-arm64

0.140.0

Unknown

npm/@oxc-parser/binding-darwin-x64

0.140.0

Unknown

npm/@oxc-parser/binding-freebsd-x64

0.140.0

Unknown

npm/@oxc-parser/binding-linux-arm-gnueabihf

0.140.0

Unknown

npm/@oxc-parser/binding-linux-arm-musleabihf

0.140.0

Unknown

npm/@oxc-parser/binding-linux-arm64-gnu

0.140.0

Unknown

npm/@oxc-parser/binding-linux-arm64-musl

0.140.0

Unknown

npm/@oxc-parser/binding-linux-ppc64-gnu

0.140.0

Unknown

npm/@oxc-parser/binding-linux-riscv64-gnu

0.140.0

Unknown

npm/@oxc-parser/binding-linux-riscv64-musl

0.140.0

Unknown

npm/@oxc-parser/binding-linux-s390x-gnu

0.140.0

Unknown

npm/@oxc-parser/binding-linux-x64-gnu

0.140.0

Unknown

npm/@oxc-parser/binding-linux-x64-musl

0.140.0

Unknown

npm/@oxc-parser/binding-openharmony-arm64

0.140.0

Unknown

npm/@oxc-parser/binding-wasm32-wasi

0.140.0

Unknown

npm/@oxc-parser/binding-win32-arm64-msvc

0.140.0

Unknown

npm/@oxc-parser/binding-win32-ia32-msvc

0.140.0

Unknown

npm/@oxc-parser/binding-win32-x64-msvc

0.140.0

Unknown

npm/@oxc-project/types

0.140.0

Unknown

npm/@oxc-resolver/binding-android-arm-eabi

11.24.2

Unknown

npm/@oxc-resolver/binding-android-arm64

11.24.2

Unknown

npm/@oxc-resolver/binding-darwin-arm64

11.24.2

Unknown

npm/@oxc-resolver/binding-darwin-x64

11.24.2

Unknown

npm/@oxc-resolver/binding-freebsd-x64

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-arm-gnueabihf

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-arm-musleabihf

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-arm64-gnu

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-arm64-musl

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-ppc64-gnu

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-riscv64-gnu

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-riscv64-musl

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-s390x-gnu

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-x64-gnu

11.24.2

Unknown

npm/@oxc-resolver/binding-linux-x64-musl

11.24.2

Unknown

npm/@oxc-resolver/binding-openharmony-arm64

11.24.2

Unknown

npm/@oxc-resolver/binding-wasm32-wasi

11.24.2

Unknown

npm/@oxc-resolver/binding-win32-arm64-msvc

11.24.2

Unknown

npm/@oxc-resolver/binding-win32-x64-msvc

11.24.2

Unknown

npm/@typescript-eslint/eslint-plugin

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/parser

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/project-service

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/scope-manager

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/tsconfig-utils

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/type-utils

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/types

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/typescript-estree

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/utils

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@typescript-eslint/visitor-keys

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/brace-expansion

5.0.8

🟢 7.3

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 4	Found 7/16 approved changesets -- score normalized to 4
Maintained	🟢 10	18 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/knip

6.29.0

Unknown

npm/lint-staged

17.2.0

Unknown

npm/oxc-parser

0.140.0

Unknown

npm/oxc-resolver

11.24.2

Unknown

npm/smol-toml

1.7.0

Unknown

npm/typescript-eslint

8.65.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 20/22 approved changesets -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/unbash

4.0.3

Unknown

Scanned Files

package-lock.json

…ith 3 updates Bumps the dev-dependencies group with 3 updates in the / directory: [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip), [lint-staged](https://github.com/lint-staged/lint-staged) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `knip` from 6.26.0 to 6.29.0 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.29.0/packages/knip) Updates `lint-staged` from 17.0.8 to 17.2.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.8...v17.2.0) Updates `typescript-eslint` from 8.64.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: knip dependency-version: 6.27.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: lint-staged dependency-version: 17.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 22, 2026

Copilot AI review requested due to automatic review settings July 22, 2026 01:14

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 22, 2026

Copilot AI reviewed Jul 22, 2026

View reviewed changes

dependabot Bot changed the title ~~build(deps-dev): bump the dev-dependencies group with 3 updates~~ build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates Jul 24, 2026

Copilot AI review requested due to automatic review settings July 24, 2026 15:20

dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-728d72217a branch from 123efa2 to 99573ad Compare July 24, 2026 15:20

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates#196

build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates#196
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-728d72217a

dependabot Bot commented on behalf of github Jul 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 6.29.0

Release 6.28.0

Release 6.27.0

v17.2.0

Minor Changes

v17.1.1

Patch Changes

v17.1.0

Minor Changes

17.2.0

Minor Changes

17.1.1

Patch Changes

17.1.0

Minor Changes

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

🩹 Fixes

❤️ Thank You

8.65.0 (2026-07-20)

🚀 Features

❤️ Thank You

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading