Skip to content

chore(deps): update all non-major dependencies - #446

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#446
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Apr 5, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@antfu/eslint-config ^9.1.0 → ^9.2.0 age confidence pnpm.catalog.default minor
@nuxt/devtools-kit (source) ^3.2.4 → ^3.4.0 age confidence pnpm.catalog.default minor
@nuxt/module-builder ^1.0.2 → ^1.0.3 age confidence pnpm.catalog.default patch
@nuxt/test-utils ^4.0.3 → ^4.1.0 age confidence pnpm.catalog.default minor
@paypal/paypal-js (source) ^10.0.3 → ^10.1.0 age confidence pnpm.catalog.default minor
@shikijs/langs (source) ^4.3.1 → ^4.4.1 age confidence pnpm.catalog.default minor
@shikijs/themes (source) ^4.3.1 → ^4.4.1 age confidence pnpm.catalog.default minor
@types/google.maps (source) ^3.65.2 → ^3.65.3 age confidence pnpm.catalog.default patch 3.65.4
@types/google.maps (source) ^3.58.1 → ^3.65.3 age confidence peerDependencies minor 3.65.4
@types/node (source) ^26.1.1 → ^26.1.2 age confidence pnpm.catalog.default patch
@types/youtube (source) ^0.1.0 → ^0.3.0 age confidence peerDependencies minor
@vueuse/core (source) ^14.3.0 → ^14.4.0 age confidence pnpm.catalog.default minor
@vueuse/shared (source) ^14.3.0 → ^14.4.0 age confidence pnpm.catalog.default minor
Hebilicious/reproduire v0.0.9-mp → v0.0.9 age confidence action patch
actions/stale v10.0.0 → v10.4.0 age confidence action minor
eslint (source) ^10.7.0 → ^10.8.0 age confidence pnpm.catalog.default minor
eslint-plugin-harlanzw ^0.17.0 → ^0.17.1 age confidence pnpm.catalog.default patch
happy-dom ^20.11.0 → ^20.11.1 age confidence pnpm.catalog.default patch
magic-string ^1.0.0 → ^1.1.0 age confidence pnpm.catalog.default minor
oxc-parser (source) ^0.140.0 → ^0.142.0 age confidence pnpm.catalog.default minor
oxc-walker ^1.0.0 → ^1.1.1 age confidence pnpm.catalog.default minor
playwright-core (source) ^1.61.1 → ^1.62.1 age confidence pnpm.catalog.default minor
pnpm (source) 11.15.1 → 11.18.0 age confidence packageManager minor
posthog-js (source) ^1.404.1 → ^1.409.5 age confidence pnpm.catalog.default minor
posthog-js (source) ^1.0.0 → ^1.409.5 age confidence peerDependencies minor
rollup (source) ^4.62.2 → ^4.62.3 age confidence pnpm.catalog.default patch 4.62.4
shiki (source) ^4.3.1 → ^4.4.1 age confidence pnpm.catalog.default minor
unhead-v3-fixture>@unhead/vue (source) ^3.0.0 → ^3.2.3 age confidence pnpm-workspace.overrides minor
unimport ^6.3.0 → ^6.4.0 age confidence pnpm.catalog.default minor
vue-tsc (source) ^3.3.7 → ^3.3.9 age confidence pnpm.catalog.default patch

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v9.2.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
nuxt/devtools (@​nuxt/devtools-kit)

v3.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v3.3.1

Compare Source

No significant changes

    View changes on GitHub
nuxt/module-builder (@​nuxt/module-builder)

v1.0.3

Compare Source

v1.0.3 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes
  • update command defaults and descriptions (#​677)
📦 Build
🏡 Chore
  • migrate to pnpm v11 (#​738)
  • remove shamefully-hoist (#​580)
  • migrate resolutions/pnpm.overrides to pnpm-workspace.yaml (cfb45fb)
  • migrate npm badges and links to npmx.dev (afcf2fa)
  • revert pnpm trust policy and restore provenance action (aeb1d38)
  • update pnpm to 10.21 and enable trust policy (92eb2af)
✅ Tests
  • accept nuxt/app specifier for NuxtError in snapshot (809c89f)
  • update v4.5 error type as well (9412c91)
  • accept either #app or nuxt/app in generated declarations (#​727)
🤖 CI
  • use uppt release workflow (604d5b3)
  • add agent-scan workflow to flag bot-authored PRs (4442a14)
  • rename workflow (f7be1a6)
  • avoid checkout in reproduction (57e7ce9)
  • pin github actions to full-length commit shas (c3c8e72)
  • add provenance action to check for downgrades in provenance (d87d217)
  • run tests on node 20 (54c5f13)
🎉 New Contributors
❤️ Contributors
nuxt/test-utils (@​nuxt/test-utils)

v4.1.0

Compare Source

4.1.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements
  • e2e: Silence server logs and allow customising log level (#​1735)
  • runtime: Improve app.root and app.teleports html tag setup (#​1726)
🩹 Fixes
  • e2e: Add warning message for e2e in nuxt vitest setup (#​1691)
  • runtime-utils: Ensure RouterLink stub works with pages: false (#​1687)
  • config: Patch ssr.resolve.conditions to remove import (#​1732)
  • config: Browser setup in defineVitestProject (#​1724)
  • config: Inline config for useRuntimeConfig() composable (#​1737)
  • config: Nested browser-mode Nuxt Vitest projects with viteEnvironmentApi (#​1708)
📦 Build
🏡 Chore
  • Drop pkg.pr.new nitro resolution (#​1681)
  • Migrate to pnpm v11 (#​1701)
  • Move h3-next to optional dependencies (#​1733)
✅ Tests
  • Add test for autoImport: false (#​1688)
🤖 CI
  • Add agent-scan workflow to flag bot-authored PRs (13dd49cde)
  • Migrate agentscan-action to v2 (08f8ee220)
❤️ Contributors
paypal/paypal-js (@​paypal/paypal-js)

v10.1.0

Compare Source

Minor Changes
  • d9c0200: Narrow PayPalMessagesSession.fetchContent to return Promise<MessageContent> (previously Promise<MessageContent | null>). The evergreen SDK never resolves to null — on an API error it returns an empty sentinel MessageContent (empty messageItems) so the <paypal-message> element recognizes the error state and collapses. Existing === null checks against the result become dead code but continue to compile.
Patch Changes
  • 09f2994: Fix incomplete prototype-pollution protection in processOptions. The environment option was still read via destructuring, which reads through the prototype chain, so Object.prototype.environment = "sandbox" could downgrade a production checkout to the sandbox SDK URL. environment is now read with a hasOwnProperty guard, matching the existing sdkBaseUrl protection.
shikijs/shiki (@​shikijs/langs)

v4.4.1

Compare Source

   🚀 Features
    View changes on GitHub

v4.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
vueuse/vueuse (@​vueuse/core)

v14.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
Hebilicious/reproduire (Hebilicious/reproduire)

v0.0.9

Compare Source

compare changes

actions/stale (actions/stale)

v10.4.0

Compare Source

What's Changed

Bug Fix
Dependency Updates
  • Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in #​1342

New Contributors

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

Compare Source

What's Changed

Bug Fix
Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.3.0

v10.2.0

Compare Source

What's Changed

Bug Fix
Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.2.0

v10.1.1

Compare Source

What's Changed

Bug Fix
Improvement
Dependency Upgrades

New Contributors

Full Changelog: actions/stale@v10...v10.1.1

v10.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/stale@v10...v10.1.0

eslint/eslint (eslint)

v10.8.0

Compare Source

Features

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)
harlan-zw/eslint-plugin-harlanzw (eslint-plugin-harlanzw)

v0.17.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
capricorn86/happy-dom (happy-dom)

v20.11.1

Compare Source

Rich-Harris/magic-string (magic-string)

v1.1.0

Compare Source

Bug Fixes
  • trim replacements longer than the range they replace (#​312) (ec1a139)
Performance Improvements
oxc-project/oxc (oxc-parser)

v0.142.0

🚀 Features
  • 11f5d1f ast_visit: Add Utf8ToUtf16::convert_program_and_comments (#​24859) (overlookmotel)
🐛 Bug Fixes
  • e80574f estree: Handle empty spans serializing ImportMeta and NewTarget (#​24775) (overlookmotel)

v0.141.0

💥 BREAKING CHANGES
  • 54cc121 ast: [BREAKING] Split MetaProperty into ImportMeta and NewTarget (#​24557) (camc314)
🚀 Features
oxc-project/oxc-walker (oxc-walker)

v1.1.1

Compare Source

Bug Fixes
microsoft/playwright (playwright-core)

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}
🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});
New APIs
Browser and Context
  • New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.
Actions
  • New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.
Network

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Apr 5, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
scripts-docs Error Error Aug 1, 2026 7:00pm
scripts-playground Ready Ready Preview Aug 1, 2026 7:00pm

Request Review

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 9c4e39b to 5bfebea Compare April 5, 2025 00:30
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 5bfebea to 7804f68 Compare April 6, 2025 09:08
@renovate renovate Bot changed the title chore(deps): update resolutions typescript to v5.8.3 chore(deps): update all non-major dependencies Apr 6, 2025
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 7804f68 to 2d975ff Compare April 7, 2025 04:48
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 2d975ff to 0104ff1 Compare April 7, 2025 08:22
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 0104ff1 to 8120e32 Compare April 7, 2025 15:15
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 8120e32 to 5ec9f5e Compare April 7, 2025 18:22
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 5ec9f5e to efcb3b7 Compare April 8, 2025 08:39
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from efcb3b7 to 1a61aec Compare April 10, 2025 00:28
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 1a61aec to cf8e7f8 Compare April 10, 2025 09:47
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from cf8e7f8 to 2b13cf8 Compare April 11, 2025 01:12
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 6132302 to 360e116 Compare April 16, 2025 14:05
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 360e116 to aa97a8b Compare April 17, 2025 00:59
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from aa97a8b to 714cf9d Compare April 17, 2025 08:46
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 714cf9d to bdbb60c Compare April 17, 2025 18:14
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from bdbb60c to 9343bf3 Compare April 18, 2025 20:28
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 9343bf3 to fb7fea7 Compare April 21, 2025 12:46
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from fb7fea7 to 556aaae Compare April 21, 2025 16:40
@pkg-pr-new

pkg-pr-new Bot commented Jul 16, 2025 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/scripts@446

commit: 193bd9c

vercel[bot]
vercel Bot reviewed Sep 20, 2025
View reviewed changes
Comment thread pnpm-lock.yaml Outdated
vercel[bot]
vercel Bot reviewed Nov 25, 2025
View reviewed changes
Comment thread docs/package.json Outdated
"@nuxt/image": "^1.11.0",
"@nuxt/scripts": "workspace:*",
"@nuxt/ui": "4.0.0",
"@nuxt/ui": "4.2.1",

@vercel vercel Bot Nov 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"@nuxt/ui": "4.2.1",
"@nuxt/ui": "^4.2.1",

The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.

View Details

Analysis

Inconsistent version pinning for @nuxt/ui dependency

What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.

How to reproduce:

cat docs/package.json | grep -A 15 '"dependencies"'

Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:

  • "@nuxt/content": "^3.8.2"
  • "@nuxt/fonts": "^0.12.1"
  • "@nuxthq/studio": "^2.2.1"
  • All other 10 dependencies also use ^ prefix

Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.

Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.

vercel[bot]
vercel Bot reviewed Jan 15, 2026
View reviewed changes
Comment thread package.json Outdated
"posthog-js": "^1.0.0"
"@types/youtube": "^0.1.2",
"@unhead/vue": "^2.1.2",
"posthog-js": "^1.321.2"

@vercel vercel Bot Jan 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"posthog-js": "^1.321.2"
"posthog-js": "^1.0.0"

The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).

View Details

Analysis

Overly restrictive posthog-js peer dependency breaks backward compatibility

What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.

How to reproduce:

# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2

Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"

Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:

  • Code only uses posthog.init() and basic config options (api_host, capture_pageview, disable_session_recording) available since 1.0.0
  • The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
  • Peer dependencies should be permissive to maximize compatibility
  • Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible

This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.

@socket-security

socket-security Bot commented Apr 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm eslint-plugin-jsdoc is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@antfu/eslint-config@9.2.0 → npm/eslint-plugin-jsdoc@63.3.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-jsdoc@63.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm happy-dom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/happy-dom@20.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@socket-security

socket-security Bot commented Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedhappy-dom@​20.11.1661008896100
Added@​shikijs/​themes@​4.4.11001007697100
Addedshiki@​4.4.11001007798100
Added@​shikijs/​langs@​4.4.11001007897100
Addedeslint-plugin-harlanzw@​0.17.17810010095100
Added@​nuxt/​test-utils@​4.1.0971007990100
Added@​types/​google.maps@​3.65.31001007987100
Addedplaywright-core@​1.62.199100799980
Added@​types/​node@​26.1.21001008196100
Added@​nuxt/​module-builder@​1.0.39810010087100
Updatedoxc-parser@​0.139.0 ⏵ 0.142.090100100 +196 +1100
Addedvue-tsc@​3.3.91001009197100
Added@​antfu/​eslint-config@​9.2.09710010092100
Addedunimport@​6.4.09810010095100
Added@​unhead/​vue@​3.2.310010010095100
Addedeslint@​10.8.09710010095100
Addedrollup@​4.62.39610010098100
Added@​paypal/​paypal-js@​10.1.010010010099100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vercel vercel[bot] vercel[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants