Skip to content

chore(deps-dev): bump the dev-tooling group across 1 directory with 3 updates - #519

Merged
NesiciCoding merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-tooling-a5a08f0f55
Sep 15, 2026
Merged

NesiciCoding merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-tooling-a5a08f0f55

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-tooling group with 3 updates in the / directory: supabase, typescript-eslint and vite.

Updates supabase from 2.116.0 to 2.117.0

Release notes

Sourced from supabase's releases.

v2.117.0

Supabase CLI v2.117.0 — 2026-09-07

This release debuts experimental Workers commands for Edge Function management, introduces config management commands (diff and pull), and publishes the @​supabase/config package to npm for programmatic config access. The release also includes performance improvements, bug fixes across auth and database sync, and infrastructure updates.

Highlights

  • Supabase Workers suite (experimental) — Manage Edge Functions from the CLI with new supabase experimental workers subcommands: new, list, status, delete, push (with --no-wait to skip build wait), and logs. Includes exposure control and instance configuration. (#6261, #6262, #6263, #6349, #6371, #6389, #6410, #6432)

  • Config management suitesupabase config diff shows what would change before pushing; supabase config pull fetches your remote configuration locally. Config push now applies changes as diffs and confirms branch targets upfront. (#6295, #6438, #6446, #6454)

  • @​supabase/config npm package — Programmatic access to config validation and diffing logic. (#6423, #6339, #6366, #6447)

New features

  • Function slug in served functions — Function slugs are now available as environment variables. (#6345)

  • Slim Docker images — Set SUPABASE_USE_SLIM_IMAGES=true to use smaller GHCR images locally. (#6382)

  • Shadow baseline cache opt-out — Caching is now on by default; add --no-cache-baseline to disable. (#6403)

  • Bundled pg-delta as standard — The bundled pg-delta engine is now the only implementation. (#6487)

Improvements

  • SUPABASE_API_* environment variable overrides now work. (#6467)

  • PowerShell users see a warning if the shell corrupts piped database dumps. (#6418)

  • Parallel provisioning speeds up pg-delta schema diffs. (#6215)

  • Unified output across workers commands. (#6389)

  • ProjectConfig now covers hosted-field configuration. (#6451)

Bug fixes

  • CLI accepts sbp_v0 tokens. (#6360)

  • Auth email content_path restricted to project root. (#6489)

  • Extension-managed database objects properly deleted in declarative sync. (#6449)

  • Colliding schema names no longer skipped. (#6394)

  • Provisioned ledger DDL statements now skipped. (#6422)


Plus multiple dependency updates and internal improvements.

... (truncated)

Commits
  • 21db855 test(cli): cover config push and unlink (CLI-2293, CLI-2326) (#6494)
  • 6689867 fix(cli): honor SUPABASE_API_* overrides (CLI-2318) (#6467)
  • 3095e91 feat(cli): make the bundled pg-delta engine the only pg-delta implementation ...
  • 8773536 refactor(config): consolidate command-family helpers (CLI-2292) (#6491)
  • ad95a9a fix(cli): confine auth email content_path to project root (CLI-2320) (#6489)
  • 3343c2f fix(cli): hedge config's 404 message, align push load errors (#6490)
  • 5ba4bc8 chore: restructured cli directory - flatten src/legacy/* into src/ (#6486)
  • 25ffc73 fix(cli): honour deletion of extension-managed objects in declarative sync (#...
  • 2c66579 feat(workers): add exposure control and new --instances flag (#6432)
  • adc1dfa test(cli): narrow config pull live pin (CLI-2324) (#6468)
  • Additional commits viewable in compare view

Updates typescript-eslint from 8.69.0 to 8.70.0

Release notes

Sourced from typescript-eslint's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

  • eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
  • website: generate per-page social preview cards (#12734)

🩹 Fixes

  • use stable release of pnpm 12 (#12808)
  • update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
  • eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
  • eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
  • project-service: avoid discarded tsserver logs (#12748)
  • typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.70.0 (2026-09-07)

🩹 Fixes

  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • 7ee7608 chore(release): publish 8.70.0
  • 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
  • See full diff in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

Bug Fixes

  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

v8.3.0-beta.0

Features

  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
  • devtools: enable dev server integration (#23333) (68aeb8a)
  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
  • worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)
  • config: close bundles when generation fails (#23256) (6bacc95)
  • css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
  • deps: update all non-major dependencies (#23337) (d550815)
  • deps: update all non-major dependencies (#23404) (238ad81)
  • deps: update rolldown-related dependencies (#23338) (76e8082)
  • deps: update rolldown-related dependencies (#23405) (b882566)
  • dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
  • hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
  • utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
  • utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 72e6fa4b-ce63-4a6d-adc6-99918d98a2e8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@oxc-project/types 0.149.0 UnknownUnknown
npm/@rolldown/binding-android-arm-eabi 1.2.8 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.2.8 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.2.8 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.2.8 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.2.8 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.2.8 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.2.8 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.2.8 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.2.8 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.2.8 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.2.8 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.2.8 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.2.8 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.2.8 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.2.8 UnknownUnknown
npm/@supabase/cli-darwin-arm64 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/@supabase/cli-darwin-x64 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/@supabase/cli-linux-arm64 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/@supabase/cli-linux-arm64-musl 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/@supabase/cli-linux-x64 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/@supabase/cli-linux-x64-musl 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/@supabase/cli-windows-arm64 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/@supabase/cli-windows-x64 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/@typescript-eslint/eslint-plugin 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/parser 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/project-service 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/scope-manager 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/tsconfig-utils 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/type-utils 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/types 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/typescript-estree 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/utils 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@typescript-eslint/visitor-keys 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/ignore 7.0.9 🟢 3.8
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/29 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/jose 6.2.12 🟢 7.5
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/27 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Signed-Releases🟢 42 out of the last 4 releases have a total of 2 signed artifacts.
SAST🟢 10SAST tool is run on all commits
npm/nanoid 3.3.19 🟢 6.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 5SAST tool is not run on all commits -- score normalized to 5
npm/postcss 8.5.28 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 3Found 11/30 approved changesets -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/rolldown 1.2.8 UnknownUnknown
npm/supabase 2.117.0 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License⚠️ 0license file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
npm/typescript-eslint 8.70.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/vite 8.3.0 🟢 7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Code-Review🟢 9Found 22/24 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 7detected GitHub workflow tokens with excessive permissions
Binary-Artifacts⚠️ 1binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits

Scanned Files

  • package-lock.json

@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown

Coverage Report

Status Category Percentage Covered / Total
🟢 Lines 99.71% (🎯 65%) 13731 / 13770
🟢 Statements 99.65% (🎯 65%) 16068 / 16123
🟢 Functions 99.56% (🎯 60%) 5505 / 5529
🟢 Branches 99.48% (🎯 58%) 12542 / 12607
File CoverageNo changed files found.
Generated in workflow #1474 for commit 01c2c2a by the Vitest Coverage Report Action

… updates

Bumps the dev-tooling group with 3 updates in the / directory: [supabase](https://github.com/supabase/cli/tree/HEAD/apps/cli), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `supabase` from 2.116.0 to 2.117.0
- [Release notes](https://github.com/supabase/cli/releases)
- [Changelog](https://github.com/supabase/cli/blob/develop/apps/cli/docs/release-process.md)
- [Commits](https://github.com/supabase/cli/commits/v2.117.0/apps/cli)

Updates `typescript-eslint` from 8.69.0 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/typescript-eslint)

Updates `vite` from 8.2.2 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

---
updated-dependencies:
- dependency-name: supabase
  dependency-version: 2.117.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: typescript-eslint
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps-dev): bump the dev-tooling group with 3 updates chore(deps-dev): bump the dev-tooling group across 1 directory with 3 updates Sep 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-tooling-a5a08f0f55 branch from da3a6c8 to 01c2c2a Compare September 14, 2026 17:54
@NesiciCoding
NesiciCoding merged commit 18d8640 into main Sep 15, 2026
15 checks passed
@NesiciCoding
NesiciCoding deleted the dependabot/npm_and_yarn/dev-tooling-a5a08f0f55 branch September 15, 2026 06:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant