Skip to content

chore(lambda): bump nx from 22.3.3 to 22.7.2 in /lambdas - #5237

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/lambdas/nx-22.7.2
Open

chore(lambda): bump nx from 22.3.3 to 22.7.2 in /lambdas#5237
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/lambdas/nx-22.7.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps nx from 22.3.3 to 22.7.2.

Release notes

Sourced from nx's releases.

22.7.2 (2026-05-14)

🚀 Features

  • gradle: stream batch task results to nx as they finish (#35487)
  • nx-dev: track docs analytics for code copy, LLM prompt, YouTube (#35526)
  • testing: add migration for Jest 30 snapshot guide link (#35629)

🩹 Fixes

  • angular: disable vitest watch by default (#35493)
  • angular-rspack: keep root-scoped assets out of per-locale i18n emit (#35621)
  • bundling: include tsconfig solution input for rollup (#35476)
  • bundling: include tsconfig solution input for webpack (#35477, #35476)
  • core: bump axios to 1.16.0 for all packages (#35568)
  • core: add provenance check in nx console status path (#35485)
  • core: remove access control header from graph app (#35494)
  • core: ensure verbose logs go to stderr and daemon logs are properly decorated (#34358)
  • core: show flaky-task count in run summary (#35491)
  • core: unique telemetry user_id; expose workspace_id dimension (#35553)
  • core: update minimatch to 10.2.5 (#35569, #34660)
  • core: restore use-legacy-versioning shim for @​nx/js@​21 ensurePackage path (#35574)
  • core: isolate NX_PARALLEL env var in parallel-related specs (#35579)
  • core: skip handleimport miss path when nx key packages are absent (#35596)
  • core: use gethostuuid(3) instead of ioreg on macOS (#35599)
  • core: isolate cache env vars in splitArgs spec (#35584)
  • core: enable node's native v8 compile cache support (#35415, #20454)
  • core: support skipped batch tasks end-to-end and fix TUI double logs (#35617)
  • core: keep TUI task selection on the in-progress section (#35640)
  • core: allow nx mcp to run outside of an Nx workspace (#35655)
  • core: cast perf entries to PerformanceMeasure for detail access (43c0c821ba)
  • devkit: exclude dist from jest module path scan (#35615)
  • devkit: expand @​nx/devkit/internal re-exports for cherry-picked v23 deep-import migration (#35541)
  • dotnet: correct output paths for Web SDK and centralized dist setups (#35398)
  • gradle: exclude batch-runner from jest haste-map crawl (#35501)
  • gradle: exclude project-graph from jest module path scan (#35609)
  • gradle: support Windows file paths (#35184, #34987)
  • js: strip glob from inferred outputs before resolving as path (#35463, #35452)
  • js: reference vitest.config in eslint dep-checks for vitest libs (#35460, #33670, #35450)
  • js: include transitive workspace deps in pruned pnpm lockfile (#35532, #35347, #34655)
  • linter: prevent ENOENT crash in getRelativeImportPath for unresolvable paths (#35007, #13872, #34066, #30491, #16716, #35006, #21889, #32190)
  • maven: skip attached artifacts that fail to materialize in batch record (#35473)
  • maven: serialize Maven 4 build state recording (#35555)
  • maven: widen runCLI timeout for --no-batch maven.test.ts cases (#35589)
  • nx-dev: document nested CLI subcommands beyond two levels (#35519)
  • nx-dev: short-circuit bot probes in framer rewrite edge function (#35527)
  • react: withSvgr migration preserves other properties (#35484)
  • repo: clear NX_INVOCATION_ROOT_PID in run-native-target to avoid recursion false-positive (443dee0b22)
  • repo: revert deep-import rewrites that targeted v23-only @​nx/devkit/internal entry (ac8187963d)
  • repo: unblock 22.7.x cargo tests and nx-build e2e (#34285)

... (truncated)

Commits
  • 4e9ea1b chore(core): refresh stale TUI snapshots on 22.7.x
  • d02dc54 fix(repo): unblock 22.7.x cargo tests and nx-build e2e
  • 7e4bce9 feat(testing): add migration for Jest 30 snapshot guide link (#35629)
  • 43c0c82 fix(core): cast perf entries to PerformanceMeasure for detail access
  • 0cfc6bc fix(core): allow nx mcp to run outside of an Nx workspace (#35655)
  • df0e414 chore(core): remove dead TUI selection lifecycle helpers (#35649)
  • a0f7a52 fix(core): keep TUI task selection on the in-progress section (#35640)
  • 93813e9 fix(core): support skipped batch tasks end-to-end and fix TUI double logs (#3...
  • c514039 fix(core): enable node's native v8 compile cache support (#35415)
  • 75e3498 fix(core): isolate cache env vars in splitArgs spec (#35584)
  • Additional commits viewable in compare view
Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [nx](https://github.com/nrwl/nx/tree/HEAD/packages/nx) from 22.3.3 to 22.7.2.
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/22.7.2/packages/nx)

---
updated-dependencies:
- dependency-name: nx
  dependency-version: 22.7.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 1, 2026 02:11
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 1, 2026
@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ❌ 3 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 2 packages with OpenSSF Scorecard issues.
See the Details below.

Vulnerabilities

lambdas/yarn.lock

NameVersionVulnerabilitySeverity
axios1.16.0Axios Node HTTP adapter can use an inherited proxy after interceptor config cloninghigh
Axios: Deep formToJSON Key Recursion Can Cause Denial of Servicemoderate
Axios: Prototype pollution auth subfields can inject Basic authmoderate
Axios: Excessive recursion in formDataToJSON can cause denial of servicemoderate
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosmoderate
Axios: Prototype pollution gadgets can alter axios request constructionmoderate
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`moderate
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`moderate
Axios: Nested axios option objects can consume polluted prototype valuesmoderate
Axios form serializer maxDepth bypass via {} metatokenmoderate
tmp0.2.4tmp has Path Traversal via unsanitized prefix/postfix that enables directory escapehigh
yaml2.8.0yaml is vulnerable to Stack Overflow via deeply nested YAML collectionsmoderate

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/axios 1.16.0 🟢 8.2
Details
CheckScoreReason
Code-Review🟢 8Found 17/21 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
npm/tmp 0.2.4 🟢 3.9
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 1Found 2/18 approved changesets -- score normalized to 1
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/yaml 2.8.0 🟢 7.3
Details
CheckScoreReason
Code-Review⚠️ 1Found 2/13 approved changesets -- score normalized to 1
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 107 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
npm/@emnapi/core 1.4.5 🟢 3.6
Details
CheckScoreReason
Maintained🟢 1021 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 2Found 6/30 approved changesets -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/runtime 1.4.5 🟢 3.6
Details
CheckScoreReason
Maintained🟢 1021 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 2Found 6/30 approved changesets -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/wasi-threads 1.0.4 🟢 3.6
Details
CheckScoreReason
Maintained🟢 1021 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 2Found 6/30 approved changesets -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@nx/nx-darwin-arm64 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-darwin-x64 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-freebsd-x64 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-linux-arm-gnueabihf 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-linux-arm64-gnu 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-linux-arm64-musl 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-linux-x64-gnu 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-linux-x64-musl 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-win32-arm64-msvc 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@nx/nx-win32-x64-msvc 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/balanced-match 4.0.3 🟢 5.8
Details
CheckScoreReason
Code-Review🟢 3Found 4/13 approved changesets -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/buffer 5.7.1 🟢 3.7
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 6Found 18/29 approved changesets -- score normalized to 6
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/dotenv 16.4.7 🟢 4.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/9 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/dotenv 16.6.1 🟢 4.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/9 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/dotenv-expand 12.0.3 UnknownUnknown
npm/ejs 5.0.1 🟢 3.7
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Maintained🟢 1010 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 4security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/end-of-stream 1.4.5 ⚠️ 2.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 3Found 11/30 approved changesets -- score normalized to 3
Pinned-Dependencies⚠️ -1no dependencies found
Dangerous-Workflow⚠️ -1no workflows found
Token-Permissions⚠️ -1No tokens found
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/escalade 3.2.0 ⚠️ 2.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 1Found 3/30 approved changesets -- score normalized to 1
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/minimatch 10.2.5 🟢 5.6
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 52 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 5
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/nx 22.7.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/semver 7.7.4 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 14/15 approved changesets -- score normalized to 9
Maintained🟢 1017 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 9SAST tool detected but not run on all commits
npm/smol-toml 1.6.1 UnknownUnknown

Scanned Files

  • lambdas/yarn.lock

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants