chore(deps): bump the npm-production group with 8 updates by dependabot[bot] · Pull Request #224 · chrisreddington/flight-school

dependabot · 2026-08-01T22:07:32Z

Bumps the npm-production group with 8 updates:

Package	From	To
@github/copilot-sdk	`1.0.7`	`1.0.8`
@hono/node-server	`2.0.11`	`2.0.12`
@opentelemetry/instrumentation-document-load	`0.65.0`	`0.66.0`
@opentelemetry/instrumentation-undici	`0.30.0`	`0.31.0`
@primer/octicons-react	`19.29.2`	`19.32.0`
@primer/react	`38.33.0`	`38.34.0`
hono	`4.12.31`	`4.12.32`
next	`16.2.11`	`16.2.12`

Updates @github/copilot-sdk from 1.0.7 to 1.0.8

Release notes

Sourced from @github/copilot-sdk's releases.

GitHub Copilot SDK for Java 1.0.8

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central](https://github.com/github/copilot-sdk/blob/HEAD/(central.sonatype.com/redacted)

📖 [Documentation](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted) · [Javadoc](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted)

Maven
<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.8</version>
</dependency>
Gradle (Kotlin DSL)
implementation("com.github:copilot-sdk-java:1.0.8")
Gradle (Groovy DSL)
implementation 'com.github:copilot-sdk-java:1.0.8'
Feature: per-agent reasoning effort

CustomAgentConfig now accepts an optional reasoningEffort field that controls the reasoning intensity for a specific sub-agent. Omitting it inherits the session-level effort; omitting it at both levels leaves the choice to the backend. (#1981)
CustomAgentConfig agent = new CustomAgentConfig()
    .setName("coder")
    .setReasoningEffort("high");
Other changes

improvement: [Java] strongly type the internal expAssignments session-config field with CopilotExpAssignmentResponse to match the runtime wire contract (#2033)

[!WARNING]

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

... (truncated)

Changelog

Sourced from @github/copilot-sdk's changelog.

Changelog

All notable changes to the Copilot SDK are documented in this file.

This changelog is automatically generated by an AI agent when stable releases are published. See GitHub Releases for the full list.

Commits

a54b0b5 Update @github/copilot to 1.0.73 (#2055)
f36e6be Fix consistency review PR delta detection (#2018)
5ca48b1 Use dependency groups for Python dev deps (#2038)
5cd5710 Fix ask_user starving the Rust SDK per-session event loop (#2034)
97e8f80 Durably document required secrets (#2046)
0d563bd docs: expand Azure Managed Identity BYOK guidance (#1995)
85946f2 docs: document sub-agent event attribution (#1878)
cd2b10b [maven-release-plugin] prepare for next development iteration
24f1ac0 [maven-release-plugin] prepare release java/v1.0.8-preview.0
00ef6cc docs: update version references to 1.0.8-preview.0
Additional commits viewable in compare view

Updates @hono/node-server from 2.0.11 to 2.0.12

Release notes

Sourced from @hono/node-server's releases.

v2.0.12

What's Changed

test: replace supertest by @BlankParticle in honojs/node-server#379

fix(response): copy headers when init is a foreign Response by @yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

Commits

a813b6c 2.0.12
caf48ba fix(response): copy headers when init is a foreign Response (#382)
3b1dd68 test: replace supertest (#379)
See full diff in compare view

Updates @opentelemetry/instrumentation-document-load from 0.65.0 to 0.66.0

Changelog

Sourced from @opentelemetry/instrumentation-document-load's changelog.

0.66.0 (2026-07-23)

⚠ BREAKING CHANGES

only emit stable http, network and database attributes (#3585)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

only emit stable http, network and database attributes (#3585) (5b7dd0e)

Commits

4e52a90 chore: release main (#3524)
bd569b5 feat(deps): update deps matching '@opentelemetry/*' (#3567)
15ef750 chore: release main (#3508)
e26a90a feat(deps): update deps matching '@opentelemetry/*' (#3523)
b68fb6d chore: release main (#3498)
e1ef3d1 feat(deps): update deps matching '@opentelemetry/*' (#3507)
03ed3a3 chore: release main (#3481)
a91133a feat(deps): update deps matching '@opentelemetry/*' (#3497)
bd017c8 chore: release main (#3451)
8891261 feat(deps): update deps matching '@opentelemetry/*' (#3479)
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation-undici from 0.30.0 to 0.31.0

Release notes

Sourced from @opentelemetry/instrumentation-undici's releases.

instrumentation-undici: v0.31.0

0.31.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

Changelog

Sourced from @opentelemetry/instrumentation-undici's changelog.

0.31.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

Commits

See full diff in compare view

Updates @primer/octicons-react from 19.29.2 to 19.32.0

Release notes

Sourced from @primer/octicons-react's releases.

v19.32.0

Minor Changes

#1286 917ad7a8 Thanks @joshblack! - Add default exports to per-icon @primer/octicons-react subpath modules (e.g. @primer/octicons-react/AlertIcon), alongside the existing named exports. Root/barrel APIs remain named-only.

Patch Changes

#1286 917ad7a8 Thanks @joshblack! - Preserve an explicitly provided aria-hidden value on React icon components.

Minor Changes

#1260 456fea25 Thanks @copilot-swe-agent! - Add default exports to per-icon @primer/octicons-react subpath modules (e.g. @primer/octicons-react/AlertIcon), alongside the existing named exports. Root/barrel APIs remain named-only.

v19.31.0

Minor Changes

#1257 3088ce65 Thanks @dylanatsmith! - Add question-bubble icon (16px and 24px)

v19.30.0

Minor Changes

#1245 b6bfb8bd Thanks @copilot-swe-agent! - Optimize @primer/octicons-react for codesplitting and tree-shaking. Each icon is now emitted as its own module and exposed via a ./* subpath export, so icons can be dynamically imported and code-split (e.g. import('@primer/octicons-react/AlertIcon')). The generated icons are now finished React.forwardRef components built on a shared renderOcticon runtime instead of runtime createIconComponent factory calls. Existing import {AlertIcon} and import * as Octicons usage continues to work unchanged.

Changelog

Sourced from @primer/octicons-react's changelog.

Changelog

19.31.0

Minor Changes

#1257 3088ce65 Thanks @dylanatsmith! - Add question-bubble icon (16px and 24px)

19.30.0

Minor Changes

#1245 b6bfb8bd Thanks @copilot-swe-agent! - Optimize @primer/octicons-react for codesplitting and tree-shaking. Each icon is now emitted as its own module and exposed via a ./* subpath export, so icons can be dynamically imported and code-split (e.g. import('@primer/octicons-react/AlertIcon')). The generated icons are now finished React.forwardRef components built on a shared renderOcticon runtime instead of runtime createIconComponent factory calls. Existing import {AlertIcon} and import * as Octicons usage continues to work unchanged.

Commits

1bf09e7 Fix GitHub release creation (#1289)
a3d72de Fix release tag creation (#1288)
1c33a17 Version Packages (#1287)
917ad7a chore: restore changesets (#1286)
fec49bc Version Packages (#1285)
68ba401 Fix release gem versioning with Bundler (#1284)
c1281cb Document changeset authoring skill (#1276)
7eb3d93 Version Packages (#1265)
110c506 Pass explicit aria-hidden values to React icons (#1275)
7ad5760 Fix release workflow failures (#1281)
Additional commits viewable in compare view

Updates @primer/react from 38.33.0 to 38.34.0

Release notes

Sourced from @primer/react's releases.

@primer/react@38.34.0

Minor Changes

#8086 81d4174 Thanks @TylerJDev! - Add a hideDivider prop to NavList.Group so consumers can opt out of rendering the divider before a group.

Patch Changes

#8211 a3e669f Thanks @francinelucca! - Link: Remove unnecessary data-hover-color attribute from rendered DOM element

#8196 e24effd Thanks @liuliu-dev! - Use aria-pressed instead of aria-current on SegmentedControl.Button and SegmentedControl.IconButton so JAWS announces the selected state when a segment is activated.

#8169 1d6f559 Thanks @liuliu-dev! - Timeline: Timeline.Actions now wraps onto a new row below Timeline.Body, left-aligned with the body content, when Timeline.Item is narrower than 480px.

#8214 41705f4 Thanks @rickyzhangca! - UnderlinePanels: The experimental UnderlinePanels component is now built on the experimental Tabs component instead of @github/tab-container-element. Its public API and behavior are unchanged.

Commits

4173959 Release tracking (#8197)
e24effd Announce SegmentedControl selected state with aria-pressed (#8196)
98fef2e chore(deps): bump fast-uri from 3.1.3 to 3.1.4 (#8213)
3d384fa Add Timeline event taxonomy source module (#8180)
41705f4 Migrate UnderlinePanels to the new Tabs component (#8214)
5f3a014 Replace forwarded ref instances of useProvidedRefOrCreate with `useMergedRe...
a3e669f chore(Link): remove unnecessary data-hover-color attribute (#8211)
ff11625 chore(deps-dev): bump immutable from 4.3.8 to 4.3.9 (#8209)
cb1d245 chore(deps-dev): bump the eslint group across 1 directory with 4 updates (#8210)
39add8c chore(deps): bump @modelcontextprotocol/sdk from 1.24.0 to 1.26.0 (#8171)
Additional commits viewable in compare view

Updates hono from 4.12.31 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

Commits

26d8e42 4.12.32
402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
bf8608c ci: enable reports for type & bundle size check (#5148)
See full diff in compare view

Updates next from 16.2.11 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-production group with 8 updates: | Package | From | To | | --- | --- | --- | | [@github/copilot-sdk](https://github.com/github/copilot-sdk) | `1.0.7` | `1.0.8` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.11` | `2.0.12` | | [@opentelemetry/instrumentation-document-load](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load) | `0.65.0` | `0.66.0` | | [@opentelemetry/instrumentation-undici](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-undici) | `0.30.0` | `0.31.0` | | [@primer/octicons-react](https://github.com/primer/octicons) | `19.29.2` | `19.32.0` | | [@primer/react](https://github.com/primer/react) | `38.33.0` | `38.34.0` | | [hono](https://github.com/honojs/hono) | `4.12.31` | `4.12.32` | | [next](https://github.com/vercel/next.js) | `16.2.11` | `16.2.12` | Updates `@github/copilot-sdk` from 1.0.7 to 1.0.8 - [Release notes](https://github.com/github/copilot-sdk/releases) - [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md) - [Commits](github/copilot-sdk@v1.0.7...v1.0.8) Updates `@hono/node-server` from 2.0.11 to 2.0.12 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.11...v2.0.12) Updates `@opentelemetry/instrumentation-document-load` from 0.65.0 to 0.66.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-document-load/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/contrib-test-utils-v0.66.0/packages/instrumentation-document-load) Updates `@opentelemetry/instrumentation-undici` from 0.30.0 to 0.31.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-undici/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/host-metrics-v0.31.0/packages/instrumentation-undici) Updates `@primer/octicons-react` from 19.29.2 to 19.32.0 - [Release notes](https://github.com/primer/octicons/releases) - [Changelog](https://github.com/primer/octicons/blob/main/CHANGELOG.md) - [Commits](primer/octicons@v19.29.2...v19.32.0) Updates `@primer/react` from 38.33.0 to 38.34.0 - [Release notes](https://github.com/primer/react/releases) - [Commits](https://github.com/primer/react/compare/@primer/react@38.33.0...@primer/react@38.34.0) Updates `hono` from 4.12.31 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.31...v4.12.32) Updates `next` from 16.2.11 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.11...v16.2.12) --- updated-dependencies: - dependency-name: "@github/copilot-sdk" dependency-version: 1.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@hono/node-server" dependency-version: 2.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@opentelemetry/instrumentation-document-load" dependency-version: 0.66.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: "@opentelemetry/instrumentation-undici" dependency-version: 0.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: "@primer/octicons-react" dependency-version: 19.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: "@primer/react" dependency-version: 38.34.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: hono dependency-version: 4.12.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-01T22:07:53Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@github/copilot-sdk

1.0.8

Unknown

npm/@hono/node-server

2.0.12

Unknown

npm/@next/env

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-darwin-arm64

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-darwin-x64

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-arm64-gnu

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-arm64-musl

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-x64-gnu

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-x64-musl

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-win32-arm64-msvc

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-win32-x64-msvc

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@opentelemetry/instrumentation-document-load

0.66.0

🟢 7.8

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Dependency-Update-Tool	🟢 10	update tool detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
Vulnerabilities	⚠️ 0	123 existing vulnerabilities detected
Security-Policy	🟢 10	security policy file detected
Fuzzing	⚠️ 0	project is not fuzzed
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 40 contributing companies or organizations

npm/@opentelemetry/instrumentation-undici

0.31.0

🟢 7.8

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Dependency-Update-Tool	🟢 10	update tool detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
Vulnerabilities	⚠️ 0	123 existing vulnerabilities detected
Security-Policy	🟢 10	security policy file detected
Fuzzing	⚠️ 0	project is not fuzzed
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 40 contributing companies or organizations

npm/@primer/octicons-react

19.32.0

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Packaging	⚠️ -1	packaging workflow not detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	⚠️ 0	security policy file not detected
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
SAST	🟢 10	SAST tool is run on all commits

npm/@primer/react

38.34.0

Unknown

npm/hono

4.12.32

Unknown

npm/next

16.2.12

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

package-lock.json

dependabot Bot added dependencies javascript Pull requests that update javascript code labels Aug 1, 2026

github-actions Bot approved these changes Aug 1, 2026

View reviewed changes

github-actions Bot merged commit f3632e5 into main Aug 1, 2026
4 of 5 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/npm-production-7cc996f66d branch August 1, 2026 22:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm-production group with 8 updates - #224

chore(deps): bump the npm-production group with 8 updates#224
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-7cc996f66d

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Uh oh!

github-actions Bot commented Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

GitHub Copilot SDK for Java 1.0.8

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: per-agent reasoning effort

Other changes

Changelog

v2.0.12

What's Changed

0.66.0 (2026-07-23)

⚠ BREAKING CHANGES

Features

instrumentation-undici: v0.31.0

0.31.0 (2026-07-23)

Features

0.31.0 (2026-07-23)

Features

v19.32.0

Minor Changes

Patch Changes

Minor Changes

v19.31.0

Minor Changes

v19.30.0

Minor Changes

Changelog

19.31.0

Minor Changes

19.30.0

Minor Changes

@​primer/react@​38.34.0

Minor Changes

Patch Changes

v4.12.32

What's Changed

v16.2.12

What's Changed

Uh oh!

Uh oh!

github-actions Bot commented Aug 1, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@primer/react@38`.34.0