feat(deps): bump the production-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #531 · kroqdotdev/webhooks-cc

dependabot · 2026-10-23T19:29:33Z

Bumps the production-dependencies group with 5 updates in the / directory:

Package	From	To
jose	`6.2.12`	`6.2.13`
@scalar/api-reference-react	`0.9.80`	`0.9.82`
next	`16.4.1`	`16.4.2`
nodemailer	`10.1.2`	`10.1.7`
@modelcontextprotocol/sdk	`1.32.0`	`1.32.1`

Updates jose from 6.2.12 to 6.2.13

Release notes

Sourced from jose's releases.

v6.2.13

Refactor

align terminology with JOSE specifications (bafcb74)

preserve underlying error causes (724ba24), closes #908

Changelog

Sourced from jose's changelog.

6.2.13 (2026-10-20)

Refactor

align terminology with JOSE specifications (bafcb74)

preserve underlying error causes (724ba24), closes #908

Commits

316b7f2 chore(release): 6.2.13
8106395 chore: bump packages
724ba24 refactor: preserve underlying error causes
b112a5e chore: bump packages
2a3a525 chore(deps-dev): bump workerd in /tap/workerd
8f540d8 chore(deps): bump the actions group with 3 updates
8d6c02b chore(deps-dev): bump electron from 44.0.0 to 44.4.5 in /tap/electron
55c959f ci: use gh run rerun for retries
5b00c64 ci: address zizmor findings and bump shared workflows
1761d7f chore: bump packages
Additional commits viewable in compare view

Updates @scalar/api-reference-react from 0.9.80 to 0.9.82

Changelog

Sourced from @scalar/api-reference-react's changelog.

0.9.82

0.9.81

Commits

See full diff in compare view

Updates next from 16.4.1 to 16.4.2

Release notes

Sourced from next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

Commits

2864b17 v16.4.2
a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
Additional commits viewable in compare view

Updates nodemailer from 10.1.2 to 10.1.7

Release notes

Sourced from nodemailer's releases.

v10.1.7

10.1.7 (2026-10-18)

Bug Fixes

mime-funcs: encode parameter values that look like encoded words (651d79b)

v10.1.6

10.1.6 (2026-10-18)

Bug Fixes

addressparser: read groups in the same pass as the rest of the list (ddf0de1)

v10.1.5

10.1.5 (2026-10-18)

Bug Fixes

addressparser: handle an address list without copying it per address (6bd09b3)

addressparser: tokenize into offsets instead of an object per token (3fd3f50)

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)

addressparser: bound group nesting at ten levels (ce63303)

addressparser: drop the obsolete route from an angle-addr (3dbc730)

addressparser: end a comment only at the ")" that closes the outermost one (0a87617)

addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)

addressparser: never read a mailbox out of a comment (a1538ea)

addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)

addressparser: read the first addr-spec of the display text (038940a)

split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

format References and strip URLs in linear time, release any number of streams (2f18641)

Changelog

Sourced from nodemailer's changelog.

10.1.7 (2026-10-18)

Bug Fixes

mime-funcs: encode parameter values that look like encoded words (651d79b)

10.1.6 (2026-10-18)

Bug Fixes

addressparser: read groups in the same pass as the rest of the list (ddf0de1)

10.1.5 (2026-10-18)

Bug Fixes

addressparser: handle an address list without copying it per address (6bd09b3)

addressparser: tokenize into offsets instead of an object per token (3fd3f50)

10.1.4 (2026-10-18)

Bug Fixes

addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)

addressparser: bound group nesting at ten levels (ce63303)

addressparser: drop the obsolete route from an angle-addr (3dbc730)

addressparser: end a comment only at the ")" that closes the outermost one (0a87617)

addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)

addressparser: never read a mailbox out of a comment (a1538ea)

addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)

addressparser: read the first addr-spec of the display text (038940a)

split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

format References and strip URLs in linear time, release any number of streams (2f18641)

Commits

7613a86 chore(master): release 10.1.7 (#1900)
651d79b fix(mime-funcs): encode parameter values that look like encoded words
84849fa test(addressparser): pin how an angle-addr followed by a group is read
a13654e chore(master): release 10.1.6 (#1899)
ddf0de1 fix(addressparser): read groups in the same pass as the rest of the list
7ab9ac1 chore(master): release 10.1.5 (#1898)
3fd3f50 fix(addressparser): tokenize into offsets instead of an object per token
6bd09b3 fix(addressparser): handle an address list without copying it per address
2a7e952 chore(master): release 10.1.4 (#1897)
038940a fix(addressparser): read the first addr-spec of the display text
Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.32.0 to 1.32.1

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

[v1.x] docs: state the principles in CLAUDE.md by @claude[bot] in modelcontextprotocol/typescript-sdk#2939

[v1.x] docs: point the README at v2 and say what v1.x supports by @claude[bot] in modelcontextprotocol/typescript-sdk#2942

chore: bump version to 1.32.1 by @claude[bot] in modelcontextprotocol/typescript-sdk#2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

Commits

ff07b00 chore: bump version to 1.32.1 (#2954)
8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
See full diff in compare view

coderabbitai · 2026-10-23T19:29:42Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 97e2996a-7245-4b55-bf97-cec1de52af12

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-23T19:30:16Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@scalar/api-reference-react

^0.9.82

Unknown

npm/jose

^6.2.13

Unknown

npm/next

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/nodemailer

^10.1.7

Unknown

npm/@ai-sdk/gateway

3.0.139

Unknown

npm/@ai-sdk/provider

3.0.12

Unknown

npm/@ai-sdk/provider-utils

4.0.62

Unknown

npm/@ai-sdk/vue

3.0.214

Unknown

npm/@codemirror/autocomplete

6.20.4

Unknown

npm/@codemirror/view

6.43.15

Unknown

npm/@modelcontextprotocol/sdk

1.32.1

Unknown

npm/@next/env

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@next/swc-darwin-arm64

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@next/swc-darwin-x64

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@next/swc-linux-arm64-gnu

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@next/swc-linux-arm64-musl

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@next/swc-linux-x64-gnu

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@next/swc-linux-x64-musl

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@next/swc-win32-arm64-msvc

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@next/swc-win32-x64-msvc

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/@opentelemetry/api

1.10.0

🟢 7.3

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool	🟢 10	update tool detected
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
License	🟢 10	license file detected
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Vulnerabilities	⚠️ 1	9 existing vulnerabilities detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Security-Policy	🟢 10	security policy file detected
Fuzzing	⚠️ 0	project is not fuzzed
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 40 contributing companies or organizations

npm/@scalar/agent-chat

0.12.45

Unknown

npm/@scalar/api-client

3.23.2

Unknown

npm/@scalar/api-reference

1.75.1

Unknown

npm/@scalar/api-reference-react

0.9.82

Unknown

npm/@scalar/asyncapi-upgrader

0.1.18

Unknown

npm/@scalar/blocks

0.5.4

Unknown

npm/@scalar/code-highlight

0.4.10

Unknown

npm/@scalar/components

0.32.1

Unknown

npm/@scalar/helpers

0.16.4

Unknown

npm/@scalar/icons

0.7.7

Unknown

npm/@scalar/json-magic

0.16.1

Unknown

npm/@scalar/localization

0.2.8

Unknown

npm/@scalar/oas-utils

0.20.14

Unknown

npm/@scalar/openapi-to-markdown

1.6.1

Unknown

npm/@scalar/openapi-upgrader

0.4.5

Unknown

npm/@scalar/schemas

0.14.0

Unknown

npm/@scalar/sidebar

0.12.2

Unknown

npm/@scalar/snippetz

0.10.10

Unknown

npm/@scalar/themes

0.19.2

Unknown

npm/@scalar/types

0.24.0

Unknown

npm/@scalar/use-hooks

0.4.21

Unknown

npm/@scalar/workspace-store

0.68.5

Unknown

npm/@vercel/oidc

3.2.0

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 9	Found 25/26 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Binary-Artifacts	🟢 6	binaries present in source code
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3

npm/ai

6.0.214

Unknown

npm/baseline-browser-mapping

2.11.30

Unknown

npm/caniuse-lite

1.0.30001818

🟢 4.2

Details

Check	Score	Reason
Maintained	🟢 7	9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Code-Review	⚠️ 0	Found 2/27 approved changesets -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/next

16.4.2

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/28 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Fuzzing	🟢 10	project is fuzzed

npm/nodemailer

10.1.7

🟢 5.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Code-Review	⚠️ 0	Found 0/24 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@modelcontextprotocol/sdk

^1.32.1

Unknown

Scanned Files

apps/web/package.json
packages/mcp/package.json
pnpm-lock.yaml

… with 5 updates Bumps the production-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [jose](https://github.com/panva/jose) | `6.2.12` | `6.2.13` | | [@scalar/api-reference-react](https://github.com/scalar/scalar/tree/HEAD/packages/api-reference-react) | `0.9.80` | `0.9.82` | | [next](https://github.com/vercel/next.js) | `16.4.1` | `16.4.2` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.1.2` | `10.1.7` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.32.0` | `1.32.1` | Updates `jose` from 6.2.12 to 6.2.13 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.12...v6.2.13) Updates `@scalar/api-reference-react` from 0.9.80 to 0.9.82 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/packages/api-reference-react/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/packages/api-reference-react) Updates `next` from 16.4.1 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.1...v16.4.2) Updates `nodemailer` from 10.1.2 to 10.1.7 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.1.2...v10.1.7) Updates `@modelcontextprotocol/sdk` from 1.32.0 to 1.32.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.32.0...1.32.1) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@scalar/api-reference-react" dependency-version: 0.9.82 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: jose dependency-version: 6.2.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: nodemailer dependency-version: 10.1.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-25T09:13:50Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 23, 2026

dependabot Bot changed the title ~~feat(deps): bump the production-dependencies group with 5 updates~~ feat(deps): bump the production-dependencies group across 1 directory with 5 updates Oct 23, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-bf8f2a52eb branch 3 times, most recently from 7b254b2 to 46df958 Compare October 24, 2026 15:26

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-bf8f2a52eb branch from 46df958 to b487609 Compare October 24, 2026 16:27

dependabot Bot closed this Oct 25, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-bf8f2a52eb branch October 25, 2026 09:14

Navigation Menu

Repository navigation

feat(deps): bump the production-dependencies group across 1 directory with 5 updates - #531

feat(deps): bump the production-dependencies group across 1 directory with 5 updates#531
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-bf8f2a52eb

dependabot Bot commented on behalf of github Oct 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.2.13

Refactor

6.2.13 (2026-10-20)

Refactor

0.9.82

0.9.81

v16.4.2

What's Changed

v10.1.7

10.1.7 (2026-10-18)

Bug Fixes

v10.1.6

10.1.6 (2026-10-18)

Bug Fixes

v10.1.5

10.1.5 (2026-10-18)

Bug Fixes

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

10.1.7 (2026-10-18)

Bug Fixes

10.1.6 (2026-10-18)

Bug Fixes

10.1.5 (2026-10-18)

Bug Fixes

10.1.4 (2026-10-18)

Bug Fixes

10.1.3 (2026-10-18)

Bug Fixes

1.32.1

What's Changed

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading