Skip to content

build(deps-dev): bump the npm-development group across 1 directory with 10 updates - #22

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-development-e1f2eb4eda
Open

build(deps-dev): bump the npm-development group across 1 directory with 10 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-development-e1f2eb4eda

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-development group with 8 updates in the / directory:

Package From To
@playwright/test 1.57.0 1.59.1
@rollup/plugin-commonjs 29.0.0 29.0.2
@typescript-eslint/eslint-plugin 8.53.1 8.59.2
es-module-lexer 2.0.0 2.1.0
eslint-plugin-no-only-tests 3.3.0 3.4.0
prettier 3.8.0 3.8.3
rollup 4.55.3 4.60.3
semver 7.7.3 7.7.4

Updates @playwright/test from 1.57.0 to 1.59.1

Release notes

Sourced from @​playwright/test's releases.

v1.59.1

Bug Fixes

  • [Windows] Reverted hiding console window when spawning browser processes, which caused regressions including broken codegen, --ui and show commands (#39990)

v1.59.0

🎬 Screencast

New page.screencast API provides a unified interface for capturing page content with:

  • Screencast recordings
  • Action annotations
  • Visual overlays
  • Real-time frame capture
  • Agentic video receipts

Screencast recording — record video with precise start/stop control, as an alternative to the recordVideo option:

await page.screencast.start({ path: 'video.webm' });
// ... perform actions ...
await page.screencast.stop();

Action annotations — enable built-in visual annotations that highlight interacted elements and display action titles during recording:

await page.screencast.showActions({ position: 'top-right' });

screencast.showActions() accepts position ('top-left', 'top', 'top-right', 'bottom-left', 'bottom', 'bottom-right'), duration (ms per annotation), and fontSize (px). Returns a disposable to stop showing actions.

Action annotations can also be enabled in test fixtures via the video option:

// playwright.config.ts
export default defineConfig({
  use: {
    video: {
      mode: 'on',
      show: {
        actions: { position: 'top-left' },
        test: { position: 'top-right' },
      },
</tr></table>

... (truncated)

Commits
  • d466ac5 chore: mark v1.59.1 (#40005)
  • 530e7e5 cherry-pick(#4004): fix(cli): kill-all should kill dashboard
  • 9aa216c cherry-pick(#39994): Revert "fix(windows): hide console window when spawning ...
  • 01b2b15 cherry-pick(#39980): chore: more release notes fixes
  • a5cb6c9 cherry-pick(#39972): chore: expose browser.bind and browser.unbind APIs
  • 99a17b5 cherry-pick(#39975): chore: support opening .trace files via .link indirection
  • 43607c3 cherry-pick(#39974): chore(webkit): update Safari user-agent version to 26.4
  • 62cabe1 cherry-pick(#39969): chore(npm): include all *.md from lib (#39970)
  • 0c65a75 cherry-pick(#39968): chore: screencast.showActions api
  • f04155b cherry-pick(#39958): chore: release notes for langs v1.59
  • Additional commits viewable in compare view

Updates @rollup/plugin-commonjs from 29.0.0 to 29.0.2

Changelog

Sourced from @​rollup/plugin-commonjs's changelog.

v29.0.2

2026-03-06

Bugfixes

  • commonjs: conditional exports (#1952)

v29.0.1

2026-03-05

Bugfixes

  • commonjs: correctly replaces shorthand "global" property in object (#1957)
Commits
  • 2de0d62 chore(release): commonjs v29.0.2
  • ab65325 fix(commonjs): conditional exports (#1952)
  • 7d22981 chore(repo): add rollup-plugin keyword in package.json (#1955)
  • a79ae55 chore(release): commonjs v29.0.1
  • bb41cfd chore(release): commonjs v29.0.1
  • 14ae186 fix(commonjs): correctly replaces shorthand "global" property in object (#1957)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​rollup/plugin-commonjs since your current version.


Updates @typescript-eslint/eslint-plugin from 8.53.1 to 8.59.2

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.59.2

8.59.2 (2026-05-04)

🩹 Fixes

  • eslint-plugin: [no-unsafe-type-assertion] handle crash on recursive template literal types (#12150)
  • eslint-plugin: [no-deprecated] object destructuring values should be treated as declarations (#12292)
  • rule-tester: add TypeScript as a peer dependency (#12288)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.1

8.59.1 (2026-04-27)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-type-assertion] fix crash "TypeError: checker.getTypeArguments is not a function" (#12246)
  • eslint-plugin: [no-unnecessary-type-assertion] preserve index signatures in undefined unions (#12257)
  • eslint-plugin: [no-unnecessary-type-assertion] preserve phantom type arguments in generic inference (#12269)
  • eslint-plugin: [no-unnecessary-type-assertion] avoid false positive in logical assignment assertions (#12278)
  • eslint-plugin: [no-unnecessary-type-arguments] handle instantiation expressions (#12220)
  • eslint-plugin: [no-unnecessary-condition] treat void as nullish in no-unnecessary-condition (#12241)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.0

8.59.0 (2026-04-20)

🚀 Features

  • eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.59.2 (2026-05-04)

🩹 Fixes

  • eslint-plugin: [no-deprecated] object destructuring values should be treated as declarations (#12292)
  • eslint-plugin: [no-unsafe-type-assertion] handle crash on recursive template literal types (#12150)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.1 (2026-04-27)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-condition] treat void as nullish in no-unnecessary-condition (#12241)
  • eslint-plugin: [no-unnecessary-type-arguments] handle instantiation expressions (#12220)
  • eslint-plugin: [no-unnecessary-type-assertion] avoid false positive in logical assignment assertions (#12278)
  • eslint-plugin: [no-unnecessary-type-assertion] preserve phantom type arguments in generic inference (#12269)
  • eslint-plugin: [no-unnecessary-type-assertion] preserve index signatures in undefined unions (#12257)
  • eslint-plugin: [no-unnecessary-type-assertion] fix crash "TypeError: checker.getTypeArguments is not a function" (#12246)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.0 (2026-04-20)

🚀 Features

  • eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789)

❤️ Thank You

  • Ulrich Stark

See GitHub Releases for more information.

... (truncated)

Commits
  • 2ec35f1 chore(release): publish 8.59.2
  • ec3ef25 test: make no-useless-empty-export tests fully static (#12260)
  • 60d0a51 chore(eslint-plugin): switch auto-generated test cases to hand-written in no-...
  • 5c53da2 fix(eslint-plugin): [no-deprecated] object destructuring values should be tre...
  • 80c28a1 fix(eslint-plugin): [no-unsafe-type-assertion] handle crash on recursive temp...
  • b7b2670 test: make no-this-alias tests fully static (#12258)
  • 5245793 chore(release): publish 8.59.1
  • 3cef124 chore(eslint-plugin): switch auto-generated test cases to hand-written in dot...
  • 27c507b test: make sort-type-constituents tests fully static (#12262)
  • a03b31d chore(eslint-plugin): switch auto-generated test cases to hand-written in no-...
  • Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.53.1 to 8.60.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.60.1

8.60.1 (2026-06-01)

🩹 Fixes

  • eslint-plugin: respect ECMAScript line terminators in ts-comment rules (#12352)
  • eslint-plugin: [no-shadow] correct rule to match ESLint v10 handling (#12182)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.0

8.60.0 (2026-05-25)

🚀 Features

  • rule-tester: added updates of RuleTester from upstream (#12291)

🩹 Fixes

  • playground TS version selector is not working (#12326, #12325)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.4

8.59.4 (2026-05-18)

🩹 Fixes

  • eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#12294)
  • project-service: throw error cause in getParsedConfigFileFromTSServer (#12321)
  • typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.60.1 (2026-06-01)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.60.0 (2026-05-25)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.4 (2026-05-18)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.3 (2026-05-11)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.2 (2026-05-04)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.1 (2026-04-27)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.0 (2026-04-20)

... (truncated)

Commits

Updates es-module-lexer from 2.0.0 to 2.1.0

Release notes

Sourced from es-module-lexer's releases.

2.1.0

What's Changed

New Contributors

Full Changelog: guybedford/es-module-lexer@2.0.0...2.1.0

Commits

Updates eslint-plugin-no-only-tests from 3.3.0 to 3.4.0

Release notes

Sourced from eslint-plugin-no-only-tests's releases.

v3.4.0

What's Changed

New Contributors

Full Changelog: levibuzolic/eslint-plugin-no-only-tests@v3.3.0...v3.4.0

Changelog

Sourced from eslint-plugin-no-only-tests's changelog.

v3.4.0

Added

  • Add CLI E2E coverage for both ESLint and Oxlint, including --fix verification and config-specific assertions
  • Add a package-contents check to ensure test assets are never published

Changed

  • Optimize Oxlint usage by adopting Oxlint's performance-focused createOnce entrypoint while preserving ESLint compatibility

Internal

  • Switch repository tooling from Yarn to Bun
  • Replace Biome/Prettier usage with Oxlint and Oxfmt
  • Update GitHub Actions to use Bun and a modern Node test matrix
  • Move test infrastructure into a dedicated test/ directory
  • Tighten package metadata and improve JSDoc/type coverage

v3.0.0

Added

  • Block scope matchers can accept a trailing * to optionally match blocks by prefix #35

Breaking

  • Block matchers no longer match prefixes of blocks by default, can now be configured via options #35

v2.6.0

  • Disable auto fixing by default, allow it to be optionally enabled. #26

v2.5.0

v2.4.0

  • Add support for defining 2 levels deep in blocks (ie. ava.default)

v2.3.1

  • Bump js-yaml from 3.13.0 to 3.13.1 due to security vulnerability - #11

v2.3.0

  • Allow test block names to be specified in options - #10

v2.2.0

... (truncated)

Commits
  • 2279c51 Merge pull request #62 from levibuzolic/levi/fix-github-release-action
  • e234e55 Use Publish environment for npm release
  • d304af4 Fix npm release auth
  • 435b3a2 Merge pull request #61 from levibuzolic/fix-release-script
  • 968e9d9 Switch release workflow to published events
  • a0edb1a Merge pull request #60 from levibuzolic/fix-release-script
  • 42ca3d8 Remove npm registry auth from publish workflow
  • b7051fc Merge pull request #59 from levibuzolic/fix-release-script
  • 36e23a2 Update GitHub Actions for npm trusted publishing
  • 17f7389 Fix release script
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-plugin-no-only-tests since your current version.


Updates playwright from 1.57.0 to 1.59.1

Release notes

Sourced from playwright's releases.

v1.59.1

Bug Fixes

  • [Windows] Reverted hiding console window when spawning browser processes, which caused regressions including broken codegen, --ui and show commands (#39990)

v1.59.0

🎬 Screencast

New page.screencast API provides a unified interface for capturing page content with:

  • Screencast recordings
  • Action annotations
  • Visual overlays
  • Real-time frame capture
  • Agentic video receipts

Screencast recording — record video with precise start/stop control, as an alternative to the recordVideo option:

await page.screencast.start({ path: 'video.webm' });
// ... perform actions ...
await page.screencast.stop();

Action annotations — enable built-in visual annotations that highlight interacted elements and display action titles during recording:

await page.screencast.showActions({ position: 'top-right' });

screencast.showActions() accepts position ('top-left', 'top', 'top-right', 'bottom-left', 'bottom', 'bottom-right'), duration (ms per annotation), and fontSize (px). Returns a disposable to stop showing actions.

Action annotations can also be enabled in test fixtures via the video option:

// playwright.config.ts
export default defineConfig({
  use: {
    video: {
      mode: 'on',
      show: {
        actions: { position: 'top-left' },
        test: { position: 'top-right' },
      },
</tr></table>

... (truncated)

Commits
  • d466ac5 chore: mark v1.59.1 (#40005)
  • 530e7e5 cherry-pick(#4004): fix(cli): kill-all should kill dashboard
  • 9aa216c cherry-pick(#39994): Revert "fix(windows): hide console window when spawning ...
  • 01b2b15 cherry-pick(#39980): chore: more release notes fixes
  • a5cb6c9 cherry-pick(#39972): chore: expose browser.bind and browser.unbind APIs
  • 99a17b5 cherry-pick(#39975): chore: support opening .trace files via .link indirection
  • 43607c3 cherry-pick(#39974): chore(webkit): update Safari user-agent version to 26.4
  • 62cabe1 cherry-pick(#39969): chore(npm): include all *.md from lib (#39970)
  • 0c65a75 cherry-pick(#39968): chore: screencast.showActions api
  • f04155b cherry-pick(#39958): chore: release notes for langs v1.59
  • Additional commits viewable in compare view

Updates prettier from 3.8.0 to 3.8.3

Release notes

Sourced from prettier's releases.

3.8.3

🔗 Changelog

3.8.2

  • Support Angular v21.2

🔗 Changelog

3.8.1

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.8.3

diff

SCSS: Prevent trailing comma in if() function (#18471 by @​kovsu)

// Input
$value: if(sass(false): 1; else: -1);
// Prettier 3.8.2
$value: if(
sass(false): 1; else: -1,
);
// Prettier 3.8.3
$value: if(sass(false): 1; else: -1);

3.8.2

diff

Angular: Support Angular v21.2 (#18722, #19034 by @​fisker)

Exhaustive typechecking with @default never;

<!-- Input -->
@switch (foo) {
  @case (1) {}
  @default never;
}
<!-- Prettier 3.8.1 -->
SyntaxError: Incomplete block "default never". If you meant to write the @ character, you should use the "&#64;" HTML entity instead. (3:3)
<!-- Prettier 3.8.2 -->
@​switch (foo) {
@​case (1) {}
@​default never;
}

arrow function and instanceof expressions.

</tr></table>

... (truncated)

Commits

Updates rollup from 4.55.3 to 4.60.3

Release notes

Sourced from rollup's releases.

v4.60.2

4.60.2

2026-04-18

Bug Fixes

  • Resolve a variable rendering bug when generating different formats from the same build (#6350)

Pull Requests

v4.60.1

4.60.1

2026-03-30

Bug Fixes

  • Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.60.3

2026-05-04

Bug Fixes

  • Ensure nested "exports" variables are not renamed (#6360)

Pull Requests

4.60.2

2026-04-18

Bug Fixes

  • Resolve a variable rendering bug when generating different formats from the same build (#6350)

Pull Requests

4.60.1

2026-03-30

... (truncated)

Commits
  • b47bdab 4.60.3
  • 15c5f33 Add again some unneeded dev dependencies, to make some builds succeed
  • 12195dc fix: do not rename nested "exports" bindings that do not conflict (#6360)
  • b74aa39 Migrate instructions to AGENTS.md
  • aa5a377 fix(deps): update minor/patch updates (#6365)
  • 197e68b chore(deps): update msys2/setup-msys2 digest to e989830 (#6364)
  • cded70a fix(deps): update swc monorepo (major) (#6366)
  • bb2b8a5 docs: add missing backticks in plugin-development (#6368)

@dependabot
build(deps-dev): bump the npm-development group across 1 directory wi…
355b6b9 
…th 10 updates

Bumps the npm-development group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.57.0` | `1.59.1` |
| [@rollup/plugin-commonjs](https://github.com/rollup/plugins/tree/HEAD/packages/commonjs) | `29.0.0` | `29.0.2` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.53.1` | `8.59.2` |
| [es-module-lexer](https://github.com/guybedford/es-module-lexer) | `2.0.0` | `2.1.0` |
| [eslint-plugin-no-only-tests](https://github.com/levibuzolic/eslint-plugin-no-only-tests) | `3.3.0` | `3.4.0` |
| [prettier](https://github.com/prettier/prettier) | `3.8.0` | `3.8.3` |
| [rollup](https://github.com/rollup/rollup) | `4.55.3` | `4.60.3` |
| [semver](https://github.com/npm/node-semver) | `7.7.3` | `7.7.4` |



Updates `@playwright/test` from 1.57.0 to 1.59.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.57.0...v1.59.1)

Updates `@rollup/plugin-commonjs` from 29.0.0 to 29.0.2
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/commonjs/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/commonjs-v29.0.2/packages/commonjs)

Updates `@typescript-eslint/eslint-plugin` from 8.53.1 to 8.59.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.2/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.53.1 to 8.60.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.60.1/packages/parser)

Updates `es-module-lexer` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/guybedford/es-module-lexer/releases)
- [Commits](guybedford/es-module-lexer@2.0.0...2.1.0)

Updates `eslint-plugin-no-only-tests` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/levibuzolic/eslint-plugin-no-only-tests/releases)
- [Changelog](https://github.com/levibuzolic/eslint-plugin-no-only-tests/blob/main/CHANGELOG.md)
- [Commits](levibuzolic/eslint-plugin-no-only-tests@v3.3.0...v3.4.0)

Updates `playwright` from 1.57.0 to 1.59.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.57.0...v1.59.1)

Updates `prettier` from 3.8.0 to 3.8.3
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.0...3.8.3)

Updates `rollup` from 4.55.3 to 4.60.3
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.55.3...v4.60.3)

Updates `semver` from 7.7.3 to 7.7.4
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.7.3...v7.7.4)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.59.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: "@rollup/plugin-commonjs"
  dependency-version: 29.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.59.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.60.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: es-module-lexer
  dependency-version: 2.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: eslint-plugin-no-only-tests
  dependency-version: 3.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: playwright
  dependency-version: 1.59.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: prettier
  dependency-version: 3.8.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development
- dependency-name: rollup
  dependency-version: 4.60.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: semver
  dependency-version: 7.7.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 4, 2026
@socket-security

socket-security Bot commented Jun 4, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​web/​test-runner-puppeteer@​0.18.0851006685100
Added@​web/​test-runner-playwright@​0.11.11001007186100
Added@​typescript-eslint/​parser@​8.60.11001007198100
Added@​types/​semver@​7.7.11001007581100
Added@​lezer/​highlight@​1.2.31001007681100
Added@​types/​mocha@​10.0.101001007780100
Addedvscode-languageserver-protocol@​3.17.51001007995100
Added@​codemirror/​state@​6.5.41001007982100
Addedrollup-plugin-copy@​3.5.09910010080100
Added@​typescript-eslint/​eslint-plugin@​8.59.2991008098100
Added@​esm-bundle/​chai@​4.3.4991008285100
Addedclean-css@​5.3.39810010082100
Addedeslint-plugin-no-only-tests@​3.4.010010010083100
Addedcomlink@​4.4.210010010083100
Addedes-module-lexer@​2.1.010010010084100
Addedeslint-plugin-import@​2.32.09810010084100
Added@​rollup/​plugin-terser@​0.4.41001009484100
Added@​rollup/​plugin-replace@​6.0.310010010085100
Updatedtslib@​1.14.1 ⏵ 2.8.110010010085100
Added@​rollup/​plugin-node-resolve@​16.0.39910010085100
Added@​web/​test-runner@​0.20.2991009185100
Added@​web/​dev-server@​0.4.6991008985100
Added@​codemirror/​view@​6.39.111001008594100
Addedwireit@​0.14.1210010010086100
Addedparse5@​7.3.01001008688100
Added@​lit/​reactive-element@​2.1.21001009787100
Addedlit-element@​4.2.21001008887100
Addedlit-html@​3.3.21001009091100
Addedtypescript@​5.9.3100100909590
Addedlit@​3.3.21001009291100
Updatedsemver@​6.3.0 ⏵ 7.7.4100 +1100 +16100 +192 +1100
Addedfuse.js@​7.1.01001009294100
See 7 more rows in the dashboard

View full report

@socket-security

socket-security Bot commented Jun 4, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method in npm basic-ftp

CVE: GHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() method (CRITICAL)

Affected versions: < 5.2.0

Patched version: 5.2.0

From: package-lock.json → npm/@web/test-runner-puppeteer@0.18.0 → npm/@web/test-runner@0.20.2 → npm/basic-ftp@5.1.0

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/basic-ftp@5.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: package-lock.json → npm/parse5@7.3.0 → npm/entities@6.0.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants