Skip to content

chore(deps): bump @opentelemetry/core, @sentry/nextjs and @sentry/node#326

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-729aa53ae0
Open

chore(deps): bump @opentelemetry/core, @sentry/nextjs and @sentry/node#326
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-729aa53ae0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps @opentelemetry/core to 2.9.0 and updates ancestor dependencies @opentelemetry/core, @sentry/nextjs and @sentry/node. These dependencies need to be updated together.

Updates @opentelemetry/core from 2.6.1 to 2.9.0

Release notes

Sourced from @​opentelemetry/core's releases.

v2.9.0

2.9.0

💥 Breaking Changes

  • docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
    • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

  • feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
    • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
  • feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
  • feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
    • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
    • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
    • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
  • feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

  • fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

  • perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
  • chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
  • perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

v2.8.0

2.8.0

🚀 Features

  • feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
  • feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
  • feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

  • fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

v2.7.1

2.7.1

🐛 Bug Fixes

  • fix(core, api): defer trace state validation. Deprecate trace state implementation in api #6459 @​david-luna

... (truncated)

Changelog

Sourced from @​opentelemetry/core's changelog.

2.9.0

💥 Breaking Changes

  • docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
    • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

  • feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
    • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
  • feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
  • feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
    • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
    • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
    • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
  • feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

  • fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

  • perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
  • chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
  • perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

2.8.0

🚀 Features

  • feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
  • feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
  • feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

  • fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

2.7.1

🐛 Bug Fixes

  • fix(core, api): defer trace state validation. Deprecate trace state implementation in api #6459 @​david-luna
    • important: this bug fix may be breaking for certain uses of TraceState
      • set now returns the same TraceState instance if key/value are invalid or makes the while trace state invalid.
      • unset now returns the same TraceState instance if key is not present.
      • best-effort parsing of invalid TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.

... (truncated)

Commits
  • 40d67b7 chore: prepare next release (#6869)
  • b1c196d Merge commit from fork
  • d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
  • d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
  • 9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
  • c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
  • dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
  • 991434c chore(deps): update dependency @​bufbuild/buf to v1.71.0 (#6863)
  • 69303d0 chore(deps): update all patch versions (#6862)
  • 6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
  • Additional commits viewable in compare view

Updates @sentry/nextjs from 10.53.1 to 10.64.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.64.0

Important Changes

  • feat(cloudflare): Add nodejs_compat entrypoint (#21881)

    The Cloudflare SDK now ships a dedicated @sentry/cloudflare/nodejs_compat entrypoint for Workers running with the nodejs_compat flag. This entrypoint unlocks Node SDK features on Cloudflare, including the prismaIntegration (#21882) and AI v7 support for the vercelAiIntegration (#21917).

    This entrypoint is a drop-in replacement, so you can switch your imports from @sentry/cloudflare directly to @sentry/cloudflare/nodejs_compat. To use it, your Worker must set the nodejs_compat compatibility flag in wrangler.toml/wrangler.jsonc. This will become the default entrypoint in v11.

  • feat: Use Sentry's minimal OpenTelemetry tracer provider by default (#21666, #21680, #21842)

    The Node SDK now registers Sentry's own minimal SentryTracerProvider by default, which creates native Sentry spans directly instead of routing them through the full OpenTelemetry SDK span pipeline. This reduces overhead for the common case where you don't need the full OpenTelemetry tracing stack.

    If you rely on OpenTelemetry SDK features that the minimal provider doesn't support, you can opt out and fall back to the full OpenTelemetry BasicTracerProvider by setting openTelemetryBasicTracerProvider: true in your Sentry.init() options. Providing custom openTelemetrySpanProcessors also forces the full provider automatically.

Other Changes

  • feat(bun,deno,node): pg orchestrion instrumentation (#21826)
  • feat(bun): enable new mysql, pg integrations in 'bun build' (#21828)
  • feat(cloudflare): Enable AI v7 support for Cloudflare in the /nodejs_compat entrypoint (#21917)
  • feat(cloudflare): Expose prismaIntegration in nodejs_compat export (#21882)
  • feat(core): Add sentry.trace_lifecycle attribute (#21850)
  • feat(core): Add deferred segment-span transaction capture (#21839)
  • feat(deps): Bump OpenTelemetry dependencies to latest (#21988)
  • feat(mongoose): Instrument mongoose >= 9.7 via native tracing channels (#21803)
  • feat(replays): Record segment names that occur during replay (#21851)
  • fix(browser): Accept precisely-typed GrowthBook class in growthbookIntegration (#21825)
  • fix(browser): Flush telemetry when page is hidden (#21862)
  • fix(cloudflare): Catch potential errors during flush and dispose (#21976)
  • fix(core): Capture Anthropic stream stop_reason from message_delta (#21907)
  • fix(core): Print getTraceMetaTags in 1 line to prevent hydration errors (#22004)
  • fix(nextjs): Add immutable browser chunks to upload assets (#21978)
  • fix(nextjs): Handle Middleware.execute root spans on Node.js runtime (#22013)
  • fix(react/solid/vue): Instrument TanStack Router navigations via onBeforeLoad/onResolved (#21975)
  • chore: Add experimentalUseDiagnosticsChannelInjection in node size-limit (#21992)
  • chore: Add external contributor to CHANGELOG.md (#21945)
  • chore: Clarify usage of hoistTransitiveImports option (#21888)
  • chore: Make @​sentry/conventions sideEffect free during bundling (#22015)
  • chore: Remove runtime ESM/CJS switching (#21761)
  • chore(ci): Replace app-id with client-id in GH workflows (#21914)
  • chore(cloudflare): Disallow Node SDK usage outside of nodejs_compat (#21884)
  • chore(cloudflare): Disallow server-utils usage outside of nodejs_compat (#21918)
  • chore(node-core): Move isCjs to its own file to prevent sideEffects (#21856)
  • ci: Increase Node integration test timeout to 20 minutes (#21903)
  • deps(server-utils): Bump @​apm-js-collab/tracing-hooks to 0.10.1 (#21892)
  • feat(server-utils): Implement orchestrion-based instrumentation for vercel-ai v6 (#21658)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.64.0

Important Changes

  • feat(cloudflare): Add nodejs_compat entrypoint (#21881)

    The Cloudflare SDK now ships a dedicated @sentry/cloudflare/nodejs_compat entrypoint for Workers running with the nodejs_compat flag. This entrypoint unlocks Node SDK features on Cloudflare, including the prismaIntegration (#21882) and AI v7 support for the vercelAiIntegration (#21917).

    This entrypoint is a drop-in replacement, so you can switch your imports from @sentry/cloudflare directly to @sentry/cloudflare/nodejs_compat. To use it, your Worker must set the nodejs_compat compatibility flag in wrangler.toml/wrangler.jsonc. This will become the default entrypoint in v11.

  • feat: Use Sentry's minimal OpenTelemetry tracer provider by default (#21666, #21680, #21842)

    The Node SDK now registers Sentry's own minimal SentryTracerProvider by default, which creates native Sentry spans directly instead of routing them through the full OpenTelemetry SDK span pipeline. This reduces overhead for the common case where you don't need the full OpenTelemetry tracing stack.

    If you rely on OpenTelemetry SDK features that the minimal provider doesn't support, you can opt out and fall back to the full OpenTelemetry BasicTracerProvider by setting openTelemetryBasicTracerProvider: true in your Sentry.init() options. Providing custom openTelemetrySpanProcessors also forces the full provider automatically.

Other Changes

  • feat(bun,deno,node): pg orchestrion instrumentation (#21826)
  • feat(bun): enable new mysql, pg integrations in 'bun build' (#21828)
  • feat(cloudflare): Enable AI v7 support for Cloudflare in the /nodejs_compat entrypoint (#21917)
  • feat(cloudflare): Expose prismaIntegration in nodejs_compat export (#21882)
  • feat(core): Add sentry.trace_lifecycle attribute (#21850)
  • feat(core): Add deferred segment-span transaction capture (#21839)
  • feat(deps): Bump OpenTelemetry dependencies to latest (#21988)
  • feat(mongoose): Instrument mongoose >= 9.7 via native tracing channels (#21803)
  • feat(replays): Record segment names that occur during replay (#21851)
  • fix(browser): Accept precisely-typed GrowthBook class in growthbookIntegration (#21825)
  • fix(browser): Flush telemetry when page is hidden (#21862)
  • fix(cloudflare): Catch potential errors during flush and dispose (#21976)
  • fix(core): Capture Anthropic stream stop_reason from message_delta (#21907)
  • fix(core): Print getTraceMetaTags in 1 line to prevent hydration errors (#22004)
  • fix(nextjs): Add immutable browser chunks to upload assets (#21978)
  • fix(nextjs): Handle Middleware.execute root spans on Node.js runtime (#22013)
  • fix(react/solid/vue): Instrument TanStack Router navigations via onBeforeLoad/onResolved (#21975)
  • chore: Add experimentalUseDiagnosticsChannelInjection in node size-limit (#21992)
  • chore: Add external contributor to CHANGELOG.md (#21945)
  • chore: Clarify usage of hoistTransitiveImports option (#21888)
  • chore: Make @​sentry/conventions sideEffect free during bundling (#22015)
  • chore: Remove runtime ESM/CJS switching (#21761)
  • chore(ci): Replace app-id with client-id in GH workflows (#21914)
  • chore(cloudflare): Disallow Node SDK usage outside of nodejs_compat (#21884)
  • chore(cloudflare): Disallow server-utils usage outside of nodejs_compat (#21918)
  • chore(node-core): Move isCjs to its own file to prevent sideEffects (#21856)
  • ci: Increase Node integration test timeout to 20 minutes (#21903)
  • deps(server-utils): Bump @​apm-js-collab/tracing-hooks to 0.10.1 (#21892)

... (truncated)

Commits
  • 5736a38 release: 10.64.0
  • 9074df6 Merge pull request #22016 from getsentry/prepare-release/10.64.0
  • 3610701 meta(changelog): Update changelog for 10.64.0
  • 7df7f30 fix(core): Print getTraceMetaTags in 1 line to prevent hydration errors (#22004)
  • 39d05cd fix(nextjs): Handle Middleware.execute root spans on Node.js runtime (#22013)
  • f7c75e7 chore: Make @​sentry/conventions sideEffect free during bundling (#22015)
  • 851edb3 test(node): Attempt to unflake docker-based node integration tests (#21905)
  • 5e48cb0 feat(server-utils): Rewrite @opentelemetry/instrumentation-hapi to orchestr...
  • 067f1b2 chore(cloudflare): Disallow server-utils usage outside of nodejs_compat (#21918)
  • 00cc317 feat(cloudflare): Enable AI v7 support for Cloudflare in the /nodejs_compat e...
  • Additional commits viewable in compare view

Updates @sentry/node from 10.53.1 to 10.64.0

Release notes

Sourced from @​sentry/node's releases.

10.64.0

Important Changes

  • feat(cloudflare): Add nodejs_compat entrypoint (#21881)

    The Cloudflare SDK now ships a dedicated @sentry/cloudflare/nodejs_compat entrypoint for Workers running with the nodejs_compat flag. This entrypoint unlocks Node SDK features on Cloudflare, including the prismaIntegration (#21882) and AI v7 support for the vercelAiIntegration (#21917).

    This entrypoint is a drop-in replacement, so you can switch your imports from @sentry/cloudflare directly to @sentry/cloudflare/nodejs_compat. To use it, your Worker must set the nodejs_compat compatibility flag in wrangler.toml/wrangler.jsonc. This will become the default entrypoint in v11.

  • feat: Use Sentry's minimal OpenTelemetry tracer provider by default (#21666, #21680, #21842)

    The Node SDK now registers Sentry's own minimal SentryTracerProvider by default, which creates native Sentry spans directly instead of routing them through the full OpenTelemetry SDK span pipeline. This reduces overhead for the common case where you don't need the full OpenTelemetry tracing stack.

    If you rely on OpenTelemetry SDK features that the minimal provider doesn't support, you can opt out and fall back to the full OpenTelemetry BasicTracerProvider by setting openTelemetryBasicTracerProvider: true in your Sentry.init() options. Providing custom openTelemetrySpanProcessors also forces the full provider automatically.

Other Changes

  • feat(bun,deno,node): pg orchestrion instrumentation (#21826)
  • feat(bun): enable new mysql, pg integrations in 'bun build' (#21828)
  • feat(cloudflare): Enable AI v7 support for Cloudflare in the /nodejs_compat entrypoint (#21917)
  • feat(cloudflare): Expose prismaIntegration in nodejs_compat export (#21882)
  • feat(core): Add sentry.trace_lifecycle attribute (#21850)
  • feat(core): Add deferred segment-span transaction capture (#21839)
  • feat(deps): Bump OpenTelemetry dependencies to latest (#21988)
  • feat(mongoose): Instrument mongoose >= 9.7 via native tracing channels (#21803)
  • feat(replays): Record segment names that occur during replay (#21851)
  • fix(browser): Accept precisely-typed GrowthBook class in growthbookIntegration (#21825)
  • fix(browser): Flush telemetry when page is hidden (#21862)
  • fix(cloudflare): Catch potential errors during flush and dispose (#21976)
  • fix(core): Capture Anthropic stream stop_reason from message_delta (#21907)
  • fix(core): Print getTraceMetaTags in 1 line to prevent hydration errors (#22004)
  • fix(nextjs): Add immutable browser chunks to upload assets (#21978)
  • fix(nextjs): Handle Middleware.execute root spans on Node.js runtime (#22013)
  • fix(react/solid/vue): Instrument TanStack Router navigations via onBeforeLoad/onResolved (#21975)
  • chore: Add experimentalUseDiagnosticsChannelInjection in node size-limit (#21992)
  • chore: Add external contributor to CHANGELOG.md (#21945)
  • chore: Clarify usage of hoistTransitiveImports option (#21888)
  • chore: Make @​sentry/conventions sideEffect free during bundling (#22015)
  • chore: Remove runtime ESM/CJS switching (#21761)
  • chore(ci): Replace app-id with client-id in GH workflows (#21914)
  • chore(cloudflare): Disallow Node SDK usage outside of nodejs_compat (#21884)
  • chore(cloudflare): Disallow server-utils usage outside of nodejs_compat (#21918)
  • chore(node-core): Move isCjs to its own file to prevent sideEffects (#21856)
  • ci: Increase Node integration test timeout to 20 minutes (#21903)
  • deps(server-utils): Bump @​apm-js-collab/tracing-hooks to 0.10.1 (#21892)
  • feat(server-utils): Implement orchestrion-based instrumentation for vercel-ai v6 (#21658)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.64.0

Important Changes

  • feat(cloudflare): Add nodejs_compat entrypoint (#21881)

    The Cloudflare SDK now ships a dedicated @sentry/cloudflare/nodejs_compat entrypoint for Workers running with the nodejs_compat flag. This entrypoint unlocks Node SDK features on Cloudflare, including the prismaIntegration (#21882) and AI v7 support for the vercelAiIntegration (#21917).

    This entrypoint is a drop-in replacement, so you can switch your imports from @sentry/cloudflare directly to @sentry/cloudflare/nodejs_compat. To use it, your Worker must set the nodejs_compat compatibility flag in wrangler.toml/wrangler.jsonc. This will become the default entrypoint in v11.

  • feat: Use Sentry's minimal OpenTelemetry tracer provider by default (#21666, #21680, #21842)

    The Node SDK now registers Sentry's own minimal SentryTracerProvider by default, which creates native Sentry spans directly instead of routing them through the full OpenTelemetry SDK span pipeline. This reduces overhead for the common case where you don't need the full OpenTelemetry tracing stack.

    If you rely on OpenTelemetry SDK features that the minimal provider doesn't support, you can opt out and fall back to the full OpenTelemetry BasicTracerProvider by setting openTelemetryBasicTracerProvider: true in your Sentry.init() options. Providing custom openTelemetrySpanProcessors also forces the full provider automatically.

Other Changes

  • feat(bun,deno,node): pg orchestrion instrumentation (#21826)
  • feat(bun): enable new mysql, pg integrations in 'bun build' (#21828)
  • feat(cloudflare): Enable AI v7 support for Cloudflare in the /nodejs_compat entrypoint (#21917)
  • feat(cloudflare): Expose prismaIntegration in nodejs_compat export (#21882)
  • feat(core): Add sentry.trace_lifecycle attribute (#21850)
  • feat(core): Add deferred segment-span transaction capture (#21839)
  • feat(deps): Bump OpenTelemetry dependencies to latest (#21988)
  • feat(mongoose): Instrument mongoose >= 9.7 via native tracing channels (#21803)
  • feat(replays): Record segment names that occur during replay (#21851)
  • fix(browser): Accept precisely-typed GrowthBook class in growthbookIntegration (#21825)
  • fix(browser): Flush telemetry when page is hidden (#21862)
  • fix(cloudflare): Catch potential errors during flush and dispose (#21976)
  • fix(core): Capture Anthropic stream stop_reason from message_delta (#21907)
  • fix(core): Print getTraceMetaTags in 1 line to prevent hydration errors (#22004)
  • fix(nextjs): Add immutable browser chunks to upload assets (#21978)
  • fix(nextjs): Handle Middleware.execute root spans on Node.js runtime (#22013)
  • fix(react/solid/vue): Instrument TanStack Router navigations via onBeforeLoad/onResolved (#21975)
  • chore: Add experimentalUseDiagnosticsChannelInjection in node size-limit (#21992)
  • chore: Add external contributor to CHANGELOG.md (#21945)
  • chore: Clarify usage of hoistTransitiveImports option (#21888)
  • chore: Make @​sentry/conventions sideEffect free during bundling (#22015)
  • chore: Remove runtime ESM/CJS switching (#21761)
  • chore(ci): Replace app-id with client-id in GH workflows (#21914)
  • chore(cloudflare): Disallow Node SDK usage outside of nodejs_compat (#21884)
  • chore(cloudflare): Disallow server-utils usage outside of nodejs_compat (#21918)
  • chore(node-core): Move isCjs to its own file to prevent sideEffects (#21856)
  • ci: Increase Node integration test timeout to 20 minutes (#21903)
  • deps(server-utils): Bump @​apm-js-collab/tracing-hooks to 0.10.1 (#21892)

... (truncated)

Commits
  • 5736a38 release: 10.64.0
  • 9074df6 Merge pull request #22016 from getsentry/prepare-release/10.64.0
  • 3610701 meta(changelog): Update changelog for 10.64.0
  • 7df7f30 fix(core): Print getTraceMetaTags in 1 line to prevent hydration errors (#22004)
  • 39d05cd fix(nextjs): Handle Middleware.execute root spans on Node.js runtime (#22013)
  • f7c75e7 chore: Make @​sentry/conventions sideEffect free during bundling (#22015)
  • 851edb3 test(node): Attempt to unflake docker-based node integration tests (#21905)
  • 5e48cb0 feat(server-utils): Rewrite @opentelemetry/instrumentation-hapi to orchestr...
  • 067f1b2 chore(cloudflare): Disallow server-utils usage outside of nodejs_compat (#21918)
  • 00cc317 feat(cloudflare): Enable AI v7 support for Cloudflare in the /nodejs_compat e...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 17, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying memolib with  Cloudflare Pages  Cloudflare Pages

Latest commit: c08e2a6
Status:🚫  Build failed.

View logs

@github-actions

github-actions Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@apm-js-collab/code-transformer 0.15.0 UnknownUnknown
npm/@apm-js-collab/code-transformer-bundler-plugins 0.5.0 UnknownUnknown
npm/@apm-js-collab/tracing-hooks 0.10.1 UnknownUnknown
npm/@opentelemetry/api-logs 0.220.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 9Found 21/22 approved changesets -- score normalized to 9
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Vulnerabilities⚠️ 021 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/core 2.9.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 9Found 21/22 approved changesets -- score normalized to 9
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Vulnerabilities⚠️ 021 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/instrumentation 0.220.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 9Found 21/22 approved changesets -- score normalized to 9
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Vulnerabilities⚠️ 021 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/resources 2.9.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 9Found 21/22 approved changesets -- score normalized to 9
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Vulnerabilities⚠️ 021 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/sdk-trace 2.9.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 9Found 21/22 approved changesets -- score normalized to 9
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Vulnerabilities⚠️ 021 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/sdk-trace-base 2.9.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 9Found 21/22 approved changesets -- score normalized to 9
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Vulnerabilities⚠️ 021 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/semantic-conventions 1.43.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 9Found 21/22 approved changesets -- score normalized to 9
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Vulnerabilities⚠️ 021 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@sentry/browser 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/browser-utils 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/conventions 0.15.1 UnknownUnknown
npm/@sentry/core 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/feedback 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/nextjs 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/node 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/node-core 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/opentelemetry 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/react 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/replay 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/replay-canvas 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/server-utils 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/@sentry/vercel-edge 10.64.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
npm/astring 1.9.0 🟢 3.4
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 0Found 2/28 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/es-module-lexer 2.3.0 🟢 4.6
Details
CheckScoreReason
Maintained🟢 1015 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 3Found 11/30 approved changesets -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/esquery 1.7.0 🟢 3.6
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 5Found 8/14 approved changesets -- score normalized to 5
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/fsevents 2.3.2 🟢 3.1
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 3Found 7/22 approved changesets -- score normalized to 3
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/import-in-the-middle 3.3.1 UnknownUnknown
npm/meriyah 6.1.4 🟢 4.5
Details
CheckScoreReason
Maintained🟢 57 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Code-Review🟢 7Found 13/18 approved changesets -- score normalized to 7
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/semifies 1.0.0 UnknownUnknown

Scanned Files

  • package-lock.json

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-729aa53ae0 branch 2 times, most recently from 0b5778a to 8640f0b Compare July 10, 2026 00:37
@dependabot
chore(deps): bump @opentelemetry/core, @sentry/nextjs and @sentry/node
c08e2a6 
Bumps [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) to 2.9.0 and updates ancestor dependencies [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js), [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) and [@sentry/node](https://github.com/getsentry/sentry-javascript). These dependencies need to be updated together.


Updates `@opentelemetry/core` from 2.6.1 to 2.9.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.6.1...v2.9.0)

Updates `@sentry/nextjs` from 10.53.1 to 10.64.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.53.1...10.64.0)

Updates `@sentry/node` from 10.53.1 to 10.64.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.53.1...10.64.0)

---
updated-dependencies:
- dependency-name: "@opentelemetry/core"
  dependency-version: 2.8.0
  dependency-type: indirect
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.58.0
  dependency-type: direct:production
- dependency-name: "@sentry/node"
  dependency-version: 10.58.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-729aa53ae0 branch from 8640f0b to c08e2a6 Compare July 10, 2026 00:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants