Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 12, 2026

Bumps c8 from 7.12.0 to 10.1.3.

Release notes

Sourced from c8's releases.

v10.1.3

10.1.3 (2024-12-10)

Bug Fixes

  • deps: update bcoe/v8-coverage addressing v8 issue (#552) (b32a563)

v10.1.2

10.1.2 (2024-06-13)

Bug Fixes

  • deps: make monocart-coverage-reports an optional with meta defined (3b91fda)

v10.1.1

10.1.1 (2024-06-11)

Bug Fixes

  • stop installing monocart-coverage-reports (#535) (13979a7)

v10.1.0

10.1.0 (2024-06-11)

Features

v10.0.0

10.0.0 (2024-06-10)

⚠ BREAKING CHANGES

  • deps: Node 18 is now the minimum supported Node.js version

Bug Fixes

  • deps: update test-exclude with new glob / minimatch (#531) (e33cf30)

v9.1.0

9.1.0 (2024-01-11)

Features

... (truncated)

Changelog

Sourced from c8's changelog.

10.1.3 (2024-12-10)

Bug Fixes

  • deps: update bcoe/v8-coverage addressing v8 issue (#552) (b32a563)

10.1.2 (2024-06-13)

Bug Fixes

  • deps: make monocart-coverage-reports an optional with meta defined (3b91fda)

10.1.1 (2024-06-11)

Bug Fixes

  • stop installing monocart-coverage-reports (#535) (13979a7)

10.1.0 (2024-06-11)

Features

10.0.0 (2024-06-10)

⚠ BREAKING CHANGES

  • deps: Node 18 is now the minimum supported Node.js version

Bug Fixes

  • deps: update test-exclude with new glob / minimatch (#531) (e33cf30)

9.1.0 (2024-01-11)

Features

  • support passing reporter options from config (#459) (88db5db)

Bug Fixes

  • refactor: remove stale check for createDynamicModule (5e18365)

... (truncated)

Commits
  • 1ec3cc4 chore(main): release 10.1.3 (#553)
  • b32a563 fix(deps): update bcoe/v8-coverage addressing v8 issue (#552)
  • 75fa99f chore(deps): update dependency @​types/node to v22 (#548)
  • ff146b4 chore(main): release 10.1.2 (#538)
  • 3b91fda fix(deps): make monocart-coverage-reports an optional with meta defined
  • e3560e1 chore(main): release 10.1.1 (#536)
  • 13979a7 fix: stop installing monocart-coverage-reports (#535)
  • 15ac690 chore(main): release 10.1.0 (#533)
  • 96e869f build(deps-dev): bump braces from 3.0.2 to 3.0.3 (#534)
  • 2e5e297 feat: add experimental monocart reports (#521)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 12, 2026

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jan 12, 2026
@github-actions
Copy link

github-actions bot commented Jan 12, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/c8 10.1.3 🟢 4.3
Details
CheckScoreReason
Code-Review🟢 5Found 10/17 approved changesets -- score normalized to 5
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/cliui 8.0.1 🟢 4.1
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 3Found 6/16 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/yargs 17.7.2 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 8Found 23/27 approved changesets -- score normalized to 8
Maintained🟢 40 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/yargs-parser 21.1.1 🟢 4.7
Details
CheckScoreReason
Maintained⚠️ 10 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 1
Code-Review🟢 8Found 12/15 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • package-lock.json

@github-actions
Copy link

github-actions bot commented Jan 12, 2026

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 57.24% 316 / 552
🔵 Statements 57.24% 316 / 552
🔵 Functions 86.36% 38 / 44
🔵 Branches 85.18% 69 / 81
File CoverageNo changed files found.
Generated in workflow #271 for commit 1fb8d51 by the Vitest Coverage Report Action

@github-actions
Copy link

🔒 NPM Security Audit Results

Found 9 vulnerabilities:

  • Critical: 0
  • High: 5
  • Moderate: 4
  • Low: 0

🔧 Suggested Fixes

Run npm audit fix to automatically fix vulnerabilities that don't require breaking changes.

For vulnerabilities requiring manual review, run npm audit fix --force.

Preview of automatic fixes
add fsevents 2.3.3
add @rollup/rollup-win32-x64-msvc 4.39.0
add @rollup/rollup-win32-ia32-msvc 4.39.0
add @rollup/rollup-win32-arm64-msvc 4.39.0
add @rollup/rollup-linux-s390x-gnu 4.39.0
add @rollup/rollup-linux-riscv64-musl 4.39.0
add @rollup/rollup-linux-riscv64-gnu 4.39.0
add @rollup/rollup-linux-powerpc64le-gnu 4.39.0
add @rollup/rollup-linux-loongarch64-gnu 4.39.0
add @rollup/rollup-linux-arm64-musl 4.39.0
add @rollup/rollup-linux-arm64-gnu 4.39.0
add @rollup/rollup-linux-arm-musleabihf 4.39.0
add @rollup/rollup-linux-arm-gnueabihf 4.39.0
add @rollup/rollup-freebsd-x64 4.39.0
add @rollup/rollup-freebsd-arm64 4.39.0
add @rollup/rollup-darwin-x64 4.39.0
add @rollup/rollup-darwin-arm64 4.39.0
add @rollup/rollup-android-arm64 4.39.0
add @rollup/rollup-android-arm-eabi 4.39.0
add @esbuild/win32-x64 0.21.5
add @esbuild/win32-ia32 0.21.5
add @esbuild/win32-arm64 0.21.5
add @esbuild/sunos-x64 0.21.5
add @esbuild/openbsd-x64 0.21.5
add @esbuild/netbsd-x64 0.21.5
add @esbuild/linux-s390x 0.21.5
add @esbuild/linux-riscv64 0.21.5
add @esbuild/linux-ppc64 0.21.5
add @esbuild/linux-mips64el 0.21.5
add @esbuild/linux-loong64 0.21.5
add @esbuild/linux-ia32 0.21.5
add @esbuild/linux-arm64 0.21.5
add @esbuild/linux-arm 0.21.5
add @esbuild/freebsd-x64 0.21.5
add @esbuild/freebsd-arm64 0.21.5
add @esbuild/darwin-x64 0.21.5
add @esbuild/darwin-arm64 0.21.5
add @esbuild/android-x64 0.21.5
add @esbuild/android-arm64 0.21.5
add @esbuild/android-arm 0.21.5
add @esbuild/aix-ppc64 0.21.5

added 41 packages, and audited 740 packages in 6s

195 packages are looking for funding
  run `npm fund` for details

# npm audit report

@cypress/request  <=3.0.9
Severity: high
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
Depends on vulnerable versions of qs
fix available via `npm audit fix`
node_modules/@cypress/request
  cypress  4.3.0 - 12.17.4
  Depends on vulnerable versions of @cypress/request
  node_modules/cypress

@remix-run/router  <=1.23.1
Severity: high
React Router vulnerable to XSS via Open Redirects - https://github.com/advisories/GHSA-2w69-qvjg-hvjx
fix available via `npm audit fix --force`
Will install [email protected], which is outside the stated dependency range
node_modules/@remix-run/router
  react-router  6.0.0 - 6.30.2
  Depends on vulnerable versions of @remix-run/router
  node_modules/react-router
    react-router-dom  6.0.0-alpha.0 - 6.30.2
    Depends on vulnerable versions of @remix-run/router
    Depends on vulnerable versions of react-router
    node_modules/react-router-dom

esbuild  <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/esbuild
  vite  0.11.0 - 6.1.6
  Depends on vulnerable versions of esbuild
  node_modules/vite
    @vitejs/plugin-react  2.0.0-alpha.0 - 4.3.3
    Depends on vulnerable versions of vite
    node_modules/@vitejs/plugin-react

qs  <6.14.1
Severity: high
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
fix available via `npm audit fix`
node_modules/qs


9 vulnerabilities (4 moderate, 5 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/c8-10.1.3 branch from 61b43de to dc90fb1 Compare January 15, 2026 17:18
@github-actions
Copy link

🔒 NPM Security Audit Results

Found 6 vulnerabilities:

  • Critical: 0
  • High: 2
  • Moderate: 4
  • Low: 0

🔧 Suggested Fixes

Run npm audit fix to automatically fix vulnerabilities that don't require breaking changes.

For vulnerabilities requiring manual review, run npm audit fix --force.

Preview of automatic fixes
add fsevents 2.3.3
add @rollup/rollup-win32-x64-msvc 4.39.0
add @rollup/rollup-win32-ia32-msvc 4.39.0
add @rollup/rollup-win32-arm64-msvc 4.39.0
add @rollup/rollup-linux-s390x-gnu 4.39.0
add @rollup/rollup-linux-riscv64-musl 4.39.0
add @rollup/rollup-linux-riscv64-gnu 4.39.0
add @rollup/rollup-linux-powerpc64le-gnu 4.39.0
add @rollup/rollup-linux-loongarch64-gnu 4.39.0
add @rollup/rollup-linux-arm64-musl 4.39.0
add @rollup/rollup-linux-arm64-gnu 4.39.0
add @rollup/rollup-linux-arm-musleabihf 4.39.0
add @rollup/rollup-linux-arm-gnueabihf 4.39.0
add @rollup/rollup-freebsd-x64 4.39.0
add @rollup/rollup-freebsd-arm64 4.39.0
add @rollup/rollup-darwin-x64 4.39.0
add @rollup/rollup-darwin-arm64 4.39.0
add @rollup/rollup-android-arm64 4.39.0
add @rollup/rollup-android-arm-eabi 4.39.0
add @esbuild/win32-x64 0.21.5
add @esbuild/win32-ia32 0.21.5
add @esbuild/win32-arm64 0.21.5
add @esbuild/sunos-x64 0.21.5
add @esbuild/openbsd-x64 0.21.5
add @esbuild/netbsd-x64 0.21.5
add @esbuild/linux-s390x 0.21.5
add @esbuild/linux-riscv64 0.21.5
add @esbuild/linux-ppc64 0.21.5
add @esbuild/linux-mips64el 0.21.5
add @esbuild/linux-loong64 0.21.5
add @esbuild/linux-ia32 0.21.5
add @esbuild/linux-arm64 0.21.5
add @esbuild/linux-arm 0.21.5
add @esbuild/freebsd-x64 0.21.5
add @esbuild/freebsd-arm64 0.21.5
add @esbuild/darwin-x64 0.21.5
add @esbuild/darwin-arm64 0.21.5
add @esbuild/android-x64 0.21.5
add @esbuild/android-arm64 0.21.5
add @esbuild/android-arm 0.21.5
add @esbuild/aix-ppc64 0.21.5

added 41 packages, and audited 741 packages in 4s

196 packages are looking for funding
  run `npm fund` for details

# npm audit report

@cypress/request  <=3.0.9
Severity: high
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
Depends on vulnerable versions of qs
fix available via `npm audit fix`
node_modules/@cypress/request
  cypress  4.3.0 - 12.17.4
  Depends on vulnerable versions of @cypress/request
  node_modules/cypress

esbuild  <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/esbuild
  vite  0.11.0 - 6.1.6
  Depends on vulnerable versions of esbuild
  node_modules/vite
    @vitejs/plugin-react  2.0.0-alpha.0 - 4.3.3
    Depends on vulnerable versions of vite
    node_modules/@vitejs/plugin-react

qs  <6.14.1
Severity: high
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
fix available via `npm audit fix`
node_modules/qs

6 vulnerabilities (4 moderate, 2 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Bumps [c8](https://github.com/bcoe/c8) from 7.12.0 to 10.1.3.
- [Release notes](https://github.com/bcoe/c8/releases)
- [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md)
- [Commits](bcoe/c8@v7.12.0...v10.1.3)

---
updated-dependencies:
- dependency-name: c8
  dependency-version: 10.1.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/c8-10.1.3 branch from dc90fb1 to 1fb8d51 Compare January 15, 2026 17:23
@github-actions
Copy link

🔒 NPM Security Audit Results

Found 3 vulnerabilities:

  • Critical: 0
  • High: 0
  • Moderate: 3
  • Low: 0

🔧 Suggested Fixes

Run npm audit fix to automatically fix vulnerabilities that don't require breaking changes.

For vulnerabilities requiring manual review, run npm audit fix --force.

Preview of automatic fixes
add fsevents 2.3.3
add @rollup/rollup-win32-x64-msvc 4.39.0
add @rollup/rollup-win32-ia32-msvc 4.39.0
add @rollup/rollup-win32-arm64-msvc 4.39.0
add @rollup/rollup-linux-s390x-gnu 4.39.0
add @rollup/rollup-linux-riscv64-musl 4.39.0
add @rollup/rollup-linux-riscv64-gnu 4.39.0
add @rollup/rollup-linux-powerpc64le-gnu 4.39.0
add @rollup/rollup-linux-loongarch64-gnu 4.39.0
add @rollup/rollup-linux-arm64-musl 4.39.0
add @rollup/rollup-linux-arm64-gnu 4.39.0
add @rollup/rollup-linux-arm-musleabihf 4.39.0
add @rollup/rollup-linux-arm-gnueabihf 4.39.0
add @rollup/rollup-freebsd-x64 4.39.0
add @rollup/rollup-freebsd-arm64 4.39.0
add @rollup/rollup-darwin-x64 4.39.0
add @rollup/rollup-darwin-arm64 4.39.0
add @rollup/rollup-android-arm64 4.39.0
add @rollup/rollup-android-arm-eabi 4.39.0
add @esbuild/win32-x64 0.21.5
add @esbuild/win32-ia32 0.21.5
add @esbuild/win32-arm64 0.21.5
add @esbuild/sunos-x64 0.21.5
add @esbuild/openbsd-x64 0.21.5
add @esbuild/netbsd-x64 0.21.5
add @esbuild/linux-s390x 0.21.5
add @esbuild/linux-riscv64 0.21.5
add @esbuild/linux-ppc64 0.21.5
add @esbuild/linux-mips64el 0.21.5
add @esbuild/linux-loong64 0.21.5
add @esbuild/linux-ia32 0.21.5
add @esbuild/linux-arm64 0.21.5
add @esbuild/linux-arm 0.21.5
add @esbuild/freebsd-x64 0.21.5
add @esbuild/freebsd-arm64 0.21.5
add @esbuild/darwin-x64 0.21.5
add @esbuild/darwin-arm64 0.21.5
add @esbuild/android-x64 0.21.5
add @esbuild/android-arm64 0.21.5
add @esbuild/android-arm 0.21.5
add @esbuild/aix-ppc64 0.21.5

added 41 packages, and audited 742 packages in 3s

198 packages are looking for funding
  run `npm fund` for details

# npm audit report

esbuild  <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/esbuild
  vite  0.11.0 - 6.1.6
  Depends on vulnerable versions of esbuild
  node_modules/vite
    @vitejs/plugin-react  2.0.0-alpha.0 - 4.3.3
    Depends on vulnerable versions of vite
    node_modules/@vitejs/plugin-react

3 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

@StefRuseva88 StefRuseva88 merged commit 9ba4545 into main Jan 15, 2026
10 checks passed
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/c8-10.1.3 branch January 15, 2026 17:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants