Skip to content

Chore(deps): Bump the npm_and_yarn group across 6 directories with 3 updates - #2093

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/src/examples/desktop/npm_and_yarn-42f22345a4
Open

Chore(deps): Bump the npm_and_yarn group across 6 directories with 3 updates#2093
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/src/examples/desktop/npm_and_yarn-42f22345a4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 1 update in the /docs/src/examples/desktop directory: electron.
Bumps the npm_and_yarn group with 1 update in the /packages/desktop directory: electron.
Bumps the npm_and_yarn group with 1 update in the /packages/desktop/samples/basic directory: electron.
Bumps the npm_and_yarn group with 1 update in the /packages/desktop/samples/file-persistence-idbfs directory: electron.
Bumps the npm_and_yarn group with 1 update in the /packages/desktop/samples/file-persistence-nodefs directory: electron.
Bumps the npm_and_yarn group with 2 updates in the /packages/react/e2e-tests directory: ip-address and postcss.

Updates electron from 34.3.0 to 39.8.10

Release notes

Sourced from electron's releases.

electron v39.8.10

Release Notes for v39.8.10

[!WARNING] Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

  • Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 (Also in 40, 41, 42)
  • Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 (Also in 42)

Other Changes

  • Backported a fix for route_id validation in the GPU command buffer. #51327
  • Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51257
  • Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266

electron v39.8.9

Release Notes for v39.8.9

Other Changes

electron v39.8.8

Release Notes for v39.8.8

Fixes

  • Fixed an issue where DevTools would re-attach to the window when opened after previously being detached. #50818 (Also in 40, 41, 42)

Other Changes

  • Backported fix for chromium:74266014. #50175
  • Backported upstream v8 fixes for several maglev, inspector, and arm64 code-generation edge cases. #50993

electron v39.8.7

Release Notes for v39.8.7

Other Changes

  • Backported fix for 489711638. #50624
  • Backported fix for 493952652. #50620

electron v39.8.6

Release Notes for v39.8.6

Fixes

  • Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50595 (Also in 40, 41, 42)
Commits
  • d7c42eb chore: backport removal of private macOS APIs (#51502)
  • c76d48c build: replace spec dep fork with transitive resolution (#51490)
  • 3ff23c5 fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)
  • 01faabf fix: resolve target bundle path once at start of install (#50766)
  • 8287d59 build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)
  • a8a79ea ci: backport secondary siso patch (#51390)
  • 593607e chore: cherry-pick 1 change from chromium (#51327)
  • aa7791f build: restrict npm tarball contents to an explicit allowlist (#51307)
  • 5392e9a fix: ensure corsEnabled: false protocol handlers do not work across protocols...
  • 2c24640 fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...
  • Additional commits viewable in compare view

Updates electron from 34.3.0 to 39.8.10

Release notes

Sourced from electron's releases.

electron v39.8.10

Release Notes for v39.8.10

[!WARNING] Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

  • Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 (Also in 40, 41, 42)
  • Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 (Also in 42)

Other Changes

  • Backported a fix for route_id validation in the GPU command buffer. #51327
  • Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51257
  • Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266

electron v39.8.9

Release Notes for v39.8.9

Other Changes

electron v39.8.8

Release Notes for v39.8.8

Fixes

  • Fixed an issue where DevTools would re-attach to the window when opened after previously being detached. #50818 (Also in 40, 41, 42)

Other Changes

  • Backported fix for chromium:74266014. #50175
  • Backported upstream v8 fixes for several maglev, inspector, and arm64 code-generation edge cases. #50993

electron v39.8.7

Release Notes for v39.8.7

Other Changes

  • Backported fix for 489711638. #50624
  • Backported fix for 493952652. #50620

electron v39.8.6

Release Notes for v39.8.6

Fixes

  • Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50595 (Also in 40, 41, 42)
Commits
  • d7c42eb chore: backport removal of private macOS APIs (#51502)
  • c76d48c build: replace spec dep fork with transitive resolution (#51490)
  • 3ff23c5 fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)
  • 01faabf fix: resolve target bundle path once at start of install (#50766)
  • 8287d59 build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)
  • a8a79ea ci: backport secondary siso patch (#51390)
  • 593607e chore: cherry-pick 1 change from chromium (#51327)
  • aa7791f build: restrict npm tarball contents to an explicit allowlist (#51307)
  • 5392e9a fix: ensure corsEnabled: false protocol handlers do not work across protocols...
  • 2c24640 fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...
  • Additional commits viewable in compare view

Updates electron from 34.3.0 to 39.8.10

Release notes

Sourced from electron's releases.

electron v39.8.10

Release Notes for v39.8.10

[!WARNING] Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

  • Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 (Also in 40, 41, 42)
  • Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 (Also in 42)

Other Changes

  • Backported a fix for route_id validation in the GPU command buffer. #51327
  • Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51257
  • Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266

electron v39.8.9

Release Notes for v39.8.9

Other Changes

electron v39.8.8

Release Notes for v39.8.8

Fixes

  • Fixed an issue where DevTools would re-attach to the window when opened after previously being detached. #50818 (Also in 40, 41, 42)

Other Changes

  • Backported fix for chromium:74266014. #50175
  • Backported upstream v8 fixes for several maglev, inspector, and arm64 code-generation edge cases. #50993

electron v39.8.7

Release Notes for v39.8.7

Other Changes

  • Backported fix for 489711638. #50624
  • Backported fix for 493952652. #50620

electron v39.8.6

Release Notes for v39.8.6

Fixes

  • Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50595 (Also in 40, 41, 42)
Commits
  • d7c42eb chore: backport removal of private macOS APIs (#51502)
  • c76d48c build: replace spec dep fork with transitive resolution (#51490)
  • 3ff23c5 fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)
  • 01faabf fix: resolve target bundle path once at start of install (#50766)
  • 8287d59 build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)
  • a8a79ea ci: backport secondary siso patch (#51390)
  • 593607e chore: cherry-pick 1 change from chromium (#51327)
  • aa7791f build: restrict npm tarball contents to an explicit allowlist (#51307)
  • 5392e9a fix: ensure corsEnabled: false protocol handlers do not work across protocols...
  • 2c24640 fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...
  • Additional commits viewable in compare view

Updates electron from 34.3.0 to 39.8.10

Release notes

Sourced from electron's releases.

electron v39.8.10

Release Notes for v39.8.10

[!WARNING] Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

  • Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 (Also in 40, 41, 42)
  • Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 (Also in 42)

Other Changes

  • Backported a fix for route_id validation in the GPU command buffer. #51327
  • Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51257
  • Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266

electron v39.8.9

Release Notes for v39.8.9

Other Changes

electron v39.8.8

Release Notes for v39.8.8

Fixes

  • Fixed an issue where DevTools would re-attach to the window when opened after previously being detached. #50818 (Also in 40, 41, 42)

Other Changes

  • Backported fix for chromium:74266014. #50175
  • Backported upstream v8 fixes for several maglev, inspector, and arm64 code-generation edge cases. #50993

electron v39.8.7

Release Notes for v39.8.7

Other Changes

  • Backported fix for 489711638. #50624
  • Backported fix for 493952652. #50620

electron v39.8.6

Release Notes for v39.8.6

Fixes

  • Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50595 (Also in 40, 41, 42)
Commits
  • d7c42eb chore: backport removal of private macOS APIs (#51502)
  • c76d48c build: replace spec dep fork with transitive resolution (#51490)
  • 3ff23c5 fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)
  • 01faabf fix: resolve target bundle path once at start of install (#50766)
  • 8287d59 build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)
  • a8a79ea ci: backport secondary siso patch (#51390)
  • 593607e chore: cherry-pick 1 change from chromium (#51327)
  • aa7791f build: restrict npm tarball contents to an explicit allowlist (#51307)
  • 5392e9a fix: ensure corsEnabled: false protocol handlers do not work across protocols...
  • 2c24640 fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...
  • Additional commits viewable in compare view

Updates electron from 34.3.0 to 39.8.10

Release notes

Sourced from electron's releases.

electron v39.8.10

Release Notes for v39.8.10

[!WARNING] Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

  • Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 (Also in 40, 41, 42)
  • Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 (Also in 42)

Other Changes

  • Backported a fix for route_id validation in the GPU command buffer. #51327
  • Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51257
  • Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266

electron v39.8.9

Release Notes for v39.8.9

Other Changes

electron v39.8.8

Release Notes for v39.8.8

Fixes

  • Fixed an issue where DevTools would re-attach to the window when opened after previously being detached. #50818 (Also in 40, 41, 42)

Other Changes

  • Backported fix for chromium:74266014. #50175
  • Backported upstream v8 fixes for several maglev, inspector, and arm64 code-generation edge cases. #50993

electron v39.8.7

Release Notes for v39.8.7

Other Changes

  • Backported fix for 489711638. #50624
  • Backported fix for 493952652. #50620

electron v39.8.6

Release Notes for v39.8.6

Fixes

  • Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50595 (Also in 40, 41, 42)
Commits
  • d7c42eb chore: backport removal of private macOS APIs (#51502)
  • c76d48c build: replace spec dep fork with transitive resolution (#51490)
  • 3ff23c5 fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)
  • 01faabf fix: resolve target bundle path once at start of install (#50766)
  • 8287d59 build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)
  • a8a79ea ci: backport secondary siso patch (#51390)
  • 593607e chore: cherry-pick 1 change from chromium (#51327)
  • aa7791f build: restrict npm tarball contents to an explicit allowlist (#51307)
  • 5392e9a fix: ensure corsEnabled: false protocol handlers do not work across protocols...
  • 2c24640 fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...
  • Additional commits viewable in compare view

Updates ip-address from 10.1.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits
  • fbb8db2 10.4.0
  • 45a2b11 Validate the byte arrays Address6 is given (#217)
  • bac8810 Keep the package loadable on node 12, and enforce it (#216)
  • 9b3d848 Add a security policy and a README section on security posture
  • e84a7b3 Order the README API reference Address4, Address6, AddressError
  • 015160b Collapse each class in the README API reference
  • 34061a8 Pin checkout and setup-node to commits in the release job
  • c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
  • e0ef048 Replace CircleCI with GitHub Actions
  • 5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates postcss from 8.5.6 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Chore(deps): Bump the npm_and_yarn group across 6 directories with 3 …
b476627 
…updates

Bumps the npm_and_yarn group with 1 update in the /docs/src/examples/desktop directory: [electron](https://github.com/electron/electron).
Bumps the npm_and_yarn group with 1 update in the /packages/desktop directory: [electron](https://github.com/electron/electron).
Bumps the npm_and_yarn group with 1 update in the /packages/desktop/samples/basic directory: [electron](https://github.com/electron/electron).
Bumps the npm_and_yarn group with 1 update in the /packages/desktop/samples/file-persistence-idbfs directory: [electron](https://github.com/electron/electron).
Bumps the npm_and_yarn group with 1 update in the /packages/desktop/samples/file-persistence-nodefs directory: [electron](https://github.com/electron/electron).
Bumps the npm_and_yarn group with 2 updates in the /packages/react/e2e-tests directory: [ip-address](https://github.com/beaugunderson/ip-address) and [postcss](https://github.com/postcss/postcss).


Updates `electron` from 34.3.0 to 39.8.10
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v34.3.0...v39.8.10)

Updates `electron` from 34.3.0 to 39.8.10
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v34.3.0...v39.8.10)

Updates `electron` from 34.3.0 to 39.8.10
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v34.3.0...v39.8.10)

Updates `electron` from 34.3.0 to 39.8.10
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v34.3.0...v39.8.10)

Updates `electron` from 34.3.0 to 39.8.10
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v34.3.0...v39.8.10)

Updates `ip-address` from 10.1.0 to 10.4.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.1.0...v10.4.0)

Updates `postcss` from 8.5.6 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.25)

---
updated-dependencies:
- dependency-name: electron
  dependency-version: 39.8.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: electron
  dependency-version: 39.8.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: electron
  dependency-version: 39.8.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: electron
  dependency-version: 39.8.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: electron
  dependency-version: 39.8.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 6, 2026
@changeset-bot

changeset-bot Bot commented Aug 6, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: b476627

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/electron 39.8.10 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices🟢 5badge detected: Passing
Pinned-Dependencies🟢 10all dependencies are pinned
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities⚠️ 046 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 90 contributing companies or organizations
npm/electron 39.8.10 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices🟢 5badge detected: Passing
Pinned-Dependencies🟢 10all dependencies are pinned
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities⚠️ 046 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 90 contributing companies or organizations
npm/electron 39.8.10 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices🟢 5badge detected: Passing
Pinned-Dependencies🟢 10all dependencies are pinned
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities⚠️ 046 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 90 contributing companies or organizations
npm/electron 39.8.10 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices🟢 5badge detected: Passing
Pinned-Dependencies🟢 10all dependencies are pinned
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities⚠️ 046 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 90 contributing companies or organizations
npm/electron 39.8.10 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices🟢 5badge detected: Passing
Pinned-Dependencies🟢 10all dependencies are pinned
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities⚠️ 046 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 90 contributing companies or organizations
npm/ip-address 10.4.0 🟢 6.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1023 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging🟢 10packaging workflow detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/nanoid 3.3.17 🟢 6.5
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
npm/postcss 8.5.25 🟢 7.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Code-Review🟢 3Found 9/30 approved changesets -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • docs/src/examples/desktop/package.json
  • packages/desktop/package.json
  • packages/desktop/samples/basic/package.json
  • packages/desktop/samples/file-persistence-idbfs/package.json
  • packages/desktop/samples/file-persistence-nodefs/package.json
  • packages/react/e2e-tests/yarn.lock

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants