feat(deps-dev): bump the development-dependencies group across 1 directory with 3 updates by dependabot[bot] · Pull Request #529 · kroqdotdev/webhooks-cc

dependabot · 2026-10-23T19:26:56Z

Bumps the development-dependencies group with 3 updates in the / directory: turbo, typescript-eslint and postcss.

Updates turbo from 2.11.8 to 2.11.10

Release notes

Turborepo v2.11.10

What's Changed

Changelog

fix: Allow non-recursive Turbo commands in root tasks by @sahyl in vercel/turborepo#14814

chore: Release Turborepo 2.11.9 by @github-actions[bot] in vercel/turborepo#14824

chore(deps): Update dependency @vercel/geistdocs to v2 by @vercel-gh-bot-4[bot] in vercel/turborepo#14417

chore: Update with-gatsby example by @vercel-gh-bot-3[bot] in vercel/turborepo#14796

fix: Avoid pnpm batch-shim shutdown hangs on Windows by @sahyl in vercel/turborepo#14819

chore(deps): Update dependency @vercel/geistdocs to v2.11.0 by @vercel-gh-bot-3[bot] in vercel/turborepo#14832

fix: Exclude tool-managed directories from local dependency inputs by @PedroRosalba in vercel/turborepo#14696

fix: Match git's text=auto binary detection in file hashing by @PedroRosalba in vercel/turborepo#14697

fix: Drop @react-router/dev from Remix match list by @Pcmhacker-piro in vercel/turborepo#14800

fix: Match package configuration files and directory inputs in task-level affected detection by @PedroRosalba in vercel/turborepo#14804

fix: Parse pnpm 8 single-project lockfiles by @PedroRosalba in vercel/turborepo#14806

fix: Keep task env vars in the hash when globalEnv excludes inferred vars by @PedroRosalba in vercel/turborepo#14805

docs: Generate the sitemap from Geistdocs sources by @molebox in vercel/turborepo#14865

fix: Restore cached symlinks when outputs are already on disk by @PedroRosalba in vercel/turborepo#14807

chore: Remove CODEOWNERS file by @anthonyshew with @Copilot in vercel/turborepo#14810

feat: Enable WebMCP for Turborepo docs by @anthonyshew in vercel/turborepo#14828

fix: Exit quietly when turbo ls output is piped to a closed reader by @drakeo338 in vercel/turborepo#14868

fix: Distrust compromised eMudhra intermediate certificates by @anthonyshew in vercel/turborepo#14876

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

chore: Release Turborepo 2.11.8 by @github-actions[bot] in vercel/turborepo#14789

perf: Prefetch Cargo metadata during lazy graph construction by @anthonyshew in vercel/turborepo#14497

perf: Compute Berry lockfile closures once across workspaces by @anthonyshew in vercel/turborepo#14499

perf: Check cache hit outputs in place instead of on the blocking pool by @anthonyshew in vercel/turborepo#14524

perf: Speed up Berry lockfile loading by @anthonyshew in vercel/turborepo#14500

perf: Parse bun.lock without building a JSON syntax tree by @anthonyshew in vercel/turborepo#14502

perf: Skip the dry run cache batch window when there is no remote cache by @anthonyshew in vercel/turborepo#14505

perf: Emit lockfile closures pre-sorted and cheapen closure interning by @anthonyshew in vercel/turborepo#14525

perf: Reuse configuration derived from turbo.json between the shim and the CLI by @anthonyshew in vercel/turborepo#14521

feat: Report locked tools-only setup plans by @anthonyshew in vercel/turborepo#14483

perf: Compute Bun lockfile closures once across workspaces by @anthonyshew in vercel/turborepo#14501

perf: Reuse open parent directories when restoring cache archives by @anthonyshew in vercel/turborepo#14506

perf: Skip dropping the run right before turbo run exits by @anthonyshew in vercel/turborepo#14507

perf: Match literal input exclusions without compiling globs by @anthonyshew in vercel/turborepo#14510

perf: Copy pruned package files in parallel by @anthonyshew in vercel/turborepo#14512

feat: Report proposed first-lock and refresh setup plans by @anthonyshew in vercel/turborepo#14571

perf: Compress large cache archives with multithreaded zstd by @anthonyshew in vercel/turborepo#14698

perf: Read tracked file stats from directory listings on Windows by @anthonyshew in vercel/turborepo#14633

... (truncated)

Commits

e521641 publish 2.11.10 to registry
aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
b42cc68 chore: Remove CODEOWNERS file (#14810)
921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
d926d6a fix: Match package configuration files and directory inputs in task-level aff...
Additional commits viewable in compare view

Updates typescript-eslint from 8.71.2 to 8.72.0

Release notes

Sourced from typescript-eslint's releases.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

eslint-plugin: lazy load rules (#13010)

eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)

typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)

eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)

eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)

eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)

eslint-plugin: [require-array-sort-compare] check tuples (#13058)

eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)

type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)

typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

Evyatar Daud @StyleShit

Junichiro Kasuya @jksy

Mitch Fultz @fitchmultz

Shaan GS @ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

a4c2603 chore(release): publish 8.72.0
See full diff in compare view

Updates postcss from 8.5.30 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

Changelog

Sourced from postcss's changelog.

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

Commits

d190857 Release 8.5.31 version
4ef6d8c Update dependencies
6abd674 Call the builder with every node when the output is escaped (#2175)
See full diff in compare view

coderabbitai · 2026-10-23T19:27:06Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: ac5836e9-6091-40bd-99a1-5d53d1537ca7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-23T19:27:11Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/postcss

8.5.31

🟢 7.4

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 2	Found 7/30 approved changesets -- score normalized to 2
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	⚠️ 1	SAST tool is not run on all commits -- score normalized to 1

npm/@turbo/darwin-64

2.11.10

Unknown

npm/@turbo/darwin-arm64

2.11.10

Unknown

npm/@turbo/linux-64

2.11.10

Unknown

npm/@turbo/linux-arm64

2.11.10

Unknown

npm/@turbo/windows-64

2.11.10

Unknown

npm/@turbo/windows-arm64

2.11.10

Unknown

npm/@typescript-eslint/eslint-plugin

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/parser

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/project-service

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/scope-manager

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/tsconfig-utils

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/type-utils

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/types

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/typescript-estree

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/utils

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/@typescript-eslint/visitor-keys

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/ignore

7.0.13

🟢 4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	⚠️ 2	Found 6/24 approved changesets -- score normalized to 2
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 9	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/turbo

2.11.10

Unknown

npm/typescript-eslint

8.72.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 13/14 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

Scanned Files

apps/web/package.json
pnpm-lock.yaml

…ctory with 3 updates Bumps the development-dependencies group with 3 updates in the / directory: [turbo](https://github.com/vercel/turborepo), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [postcss](https://github.com/postcss/postcss). Updates `turbo` from 2.11.8 to 2.11.10 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.11.8...v2.11.10) Updates `typescript-eslint` from 8.71.2 to 8.72.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint) Updates `postcss` from 8.5.30 to 8.5.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.30...8.5.31) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.31 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: turbo dependency-version: 2.11.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: typescript-eslint dependency-version: 8.72.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

…curity pins (#547) * chore(deps): the open Dependabot bumps, and undici 8 and body-parser 2 security pins Folds the open Dependabot PRs into one change, so they need one CI run instead of a rebase of every PR after each merge: - posthog-js 1.438 (#537), @radix-ui/react-slot 1.5.0 (#536), @radix-ui/react-alert-dialog 1.2.1 (#535), @radix-ui/react-dropdown-menu 2.2.1 (#534), resend 6.34.1 (#533), lucide-react 1.61.0 (#532) - development group: turbo 2.11.10, typescript-eslint 8.72.0, postcss 8.5.31 (#529) Security overrides for transitive dependencies: - undici 8 to >=8.12.2 (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472), pulled in by @apidevtools/json-schema-ref-parser - body-parser 2 to >=2.4.0 (GHSA-27r3-jxmh-p828), pulled in by express 5 under @modelcontextprotocol/sdk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: indent the new overrides Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

dependabot · 2026-10-25T10:34:00Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 23, 2026

dependabot Bot changed the title ~~feat(deps-dev): bump the development-dependencies group with 3 updates~~ feat(deps-dev): bump the development-dependencies group across 1 directory with 3 updates Oct 23, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-ec3b67154b branch 8 times, most recently from c7a6170 to 2148a4c Compare October 25, 2026 10:04

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-ec3b67154b branch from 2148a4c to 0165026 Compare October 25, 2026 10:10

kroqdotdev mentioned this pull request Oct 25, 2026

chore(deps): open Dependabot bumps, and undici 8 and body-parser 2 security pins #547

Merged

dependabot Bot closed this Oct 25, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/development-dependencies-ec3b67154b branch October 25, 2026 10:34

Navigation Menu

Repository navigation

feat(deps-dev): bump the development-dependencies group across 1 directory with 3 updates - #529

feat(deps-dev): bump the development-dependencies group across 1 directory with 3 updates#529
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-ec3b67154b

dependabot Bot commented on behalf of github Oct 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Turborepo v2.11.10

What's Changed

Changelog

Turborepo v2.11.9

What's Changed

Changelog

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

🩹 Fixes

❤️ Thank You

8.72.0 (2026-10-19)

8.5.31

8.5.31

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading