Skip to content

chore(deps-dev): bump the npm-dev-minor-patch group with 8 updates - #134

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-dev-minor-patch-b8dded417c
Open

chore(deps-dev): bump the npm-dev-minor-patch group with 8 updates#134
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-dev-minor-patch-b8dded417c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dev-minor-patch group with 8 updates:

Package From To
@playwright/test 1.52.0 1.63.0
@tailwindcss/forms 0.5.10 0.5.11
@wordpress/e2e-test-utils 11.23.0 11.34.0
@wordpress/e2e-test-utils-playwright 1.23.0 1.54.0
@wordpress/env 10.23.0 10.39.0
grunt 1.6.1 1.6.3
sass 1.88.0 1.104.1
webpack 5.99.8 5.111.0

Updates @playwright/test from 1.52.0 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​playwright/test since your current version.


Updates @tailwindcss/forms from 0.5.10 to 0.5.11

Release notes

Sourced from @​tailwindcss/forms's releases.

v0.5.11

Fixed

  • Limit attribute rules to input and select elements (#159)
Changelog

Sourced from @​tailwindcss/forms's changelog.

[0.5.11] - 2025-12-17

Fixed

  • Limit attribute rules to input and select elements (#159)
Commits
  • e1b609d 0.5.11
  • 67ff8ea Limit attribute rules to input and select elements (#159)
  • fc3f7e6 docs: update installation guide to add tailwind css v4 instructions while kee...
  • See full diff in compare view

Updates @wordpress/e2e-test-utils from 11.23.0 to 11.34.0

Changelog

Sourced from @​wordpress/e2e-test-utils's changelog.

11.34.0 (2025-10-29)

11.33.0 (2025-10-17)

11.32.0 (2025-10-01)

11.31.0 (2025-09-17)

11.30.0 (2025-09-03)

11.29.0 (2025-08-20)

11.28.0 (2025-08-07)

11.27.0 (2025-07-23)

11.26.0 (2025-06-25)

11.25.0 (2025-06-04)

11.24.0 (2025-05-22)

Commits

Updates @wordpress/e2e-test-utils-playwright from 1.23.0 to 1.54.0

Changelog

Sourced from @​wordpress/e2e-test-utils-playwright's changelog.

1.54.0 (2026-08-26)

1.53.0 (2026-08-12)

Bug Fixes

  • Metrics.startTracing(): Run a trivial script in every frame once tracing is on, to absorb the isolate interrupt that enabling the V8 sampling profiler queues. Its cost otherwise lands in the first thing the test does, usually the interaction being measured, and grows through a spec's iterations: a stable 220ms interaction reported anywhere from 200ms to 650ms (#81264).
  • Metrics.getSelectionEventDurations(): Dispatches that nest inside another dispatch now contribute only the time not already covered by it, so summing the returned durations no longer counts the nested work twice.

1.52.0 (2026-07-29)

Bug Fixes

  • Metrics.getSelectionEventDurations(): Also collect pointerup and selectionchange durations, and omit event types that did not fire. Selecting a block within an editing host no longer fires focus/focusin, which made the metric report zero.

1.51.0 (2026-07-14)

1.50.0 (2026-07-01)

1.49.0 (2026-06-24)

Enhancements

  • Added RequestUtils.resetThemeGlobalStyles() to reset the current theme's user global styles to an empty config for test isolation.

Bug Fixes

  • Resolve root-relative page.goto() URLs against the full baseURL, including any subdirectory path, so tests work against WordPress installs served from a subdirectory.

1.48.1 (2026-06-16)

1.48.0 (2026-06-10)

1.47.0 (2026-05-27)

1.46.0 (2026-05-14)

1.45.0 (2026-04-29)

1.44.0 (2026-04-15)

1.43.0 (2026-04-01)

1.42.0 (2026-03-18)

1.41.0 (2026-03-04)

1.40.0 (2026-02-18)

1.39.0 (2026-01-29)

... (truncated)

Commits
  • d06b010 chore(release): publish (#82084)
  • 0790fa5 Update changelog files
  • 989764d chore(release): publish
  • e18aa00 Update changelog files
  • dbb73c9 Merge changes published in the Gutenberg plugin "release/23.8" branch
  • 7e8b17a chore(release): publish
  • 42ad080 Update changelog files
  • edffa74 Merge changes published in the Gutenberg plugin "release/23.7" branch
  • e9a74f9 chore(release): publish
  • 2a0c375 Update changelog files
  • Additional commits viewable in compare view

Updates @wordpress/env from 10.23.0 to 10.39.0

Changelog

Sourced from @​wordpress/env's changelog.

10.39.0 (2026-01-29)

New Features

  • Add experimental WordPress Playground runtime support. Use --runtime=playground flag to start wp-env with Playground instead of Docker.
  • Add cleanup command to remove environment-specific resources (containers, volumes, networks, and local files) while preserving Docker images for faster re-starts.
  • Add --force flag to both destroy and cleanup commands to skip the confirmation prompt.
  • Rename clean command to reset for clarity. The clean command is now deprecated but still works as an alias.

Deprecation

  • The clean command is deprecated. Use reset instead. The afterClean lifecycle script is also deprecated in favor of afterReset.

10.38.0 (2026-01-16)

10.36.0 (2025-11-26)

10.35.0 (2025-11-12)

10.34.0 (2025-10-29)

10.33.0 (2025-10-17)

10.32.0 (2025-10-01)

10.31.0 (2025-09-17)

10.30.0 (2025-09-03)

10.29.0 (2025-08-20)

10.28.0 (2025-08-07)

10.27.0 (2025-07-23)

Enhancements

  • Add config file for WP-CLI when creating an environment. (#70661).

10.26.0 (2025-06-25)

10.25.0 (2025-06-04)

10.24.0 (2025-05-22)

Commits
  • eee1cfb chore(release): publish
  • 783f4ec Update changelog files
  • 5e40acf Merge changes published in the Gutenberg plugin "release/22.5" branch
  • 50c4c0f chore(release): publish
  • 28afca3 Update changelog files
  • 0022c1f Merge changes published in the Gutenberg plugin "release/22.4" branch
  • 2cf13ec chore(release): publish
  • d096bed Update changelog files
  • b35cf1a chore(release): publish
  • 01eaf58 Update changelog files
  • Additional commits viewable in compare view

Updates grunt from 1.6.1 to 1.6.3

Changelog

Sourced from grunt's changelog.

v1.6.3

v1.6.2

Commits
Maintainer changes

This version was pushed to npm by krinkle, a new releaser for grunt since your current version.


Updates sass from 1.88.0 to 1.104.1

Release notes

Sourced from sass's releases.

Dart Sass 1.104.1

To install Sass 1.104.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Fix a bug where loud comments before @use rules could be emitted multiple times under certain circumstances.

  • Fix a bug in which an invalid selector at the end of an indented syntax stylesheet would cause the parser to crash instead of emitting a useful error message.

Command Line Interface

  • Many-to-many compilations no longer compile any files that appear in the output directory if the output directory is also within the source directory. This fixes a bug where --watch mode could enter an infinite loop recompiling the same CSS file over and over.

  • Sass now sets the modification time of output files to the time compilation started rather than the time it ended. This ensures that, if a source file is modified during compilation, --watch and --update mode will recompile the outputs to include the new source file contents.

See the full changelog for changes in earlier releases.

Dart Sass 1.104.0

To install Sass 1.104.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero, as well as infinity and negative infinity for polar-hue channels, to 0 as per the CSS spec.

  • The special value negative zero is now serialized as -0 instead of 0 for greater compatibility when using it in CSS calculations.

See the full changelog for changes in earlier releases.

Dart Sass 1.103.1

To install Sass 1.103.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.103.0

To install Sass 1.103.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

... (truncated)

Changelog

Sourced from sass's changelog.

1.104.1

  • Fix a bug where loud comments before @use rules could be emitted multiple times under certain circumstances.

  • Fix a bug in which an invalid selector at the end of an indented syntax stylesheet would cause the parser to crash instead of emitting a useful error message.

Command Line Interface

  • Many-to-many compilations no longer compile any files that appear in the output directory if the output directory is also within the source directory. This fixes a bug where --watch mode could enter an infinite loop recompiling the same CSS file over and over.

  • Sass now sets the modification time of output files to the time compilation started rather than the time it ended. This ensures that, if a source file is modified during compilation, --watch and --update mode will recompile the outputs to include the new source file contents.

1.104.0

  • Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero, as well as infinity and negative infinity for polar-hue channels, to 0 as per the CSS spec.

  • The special value negative zero is now serialized as -0 instead of 0 for greater compatibility when using it in CSS calculations.

1.103.1

  • No user-visible changes.

1.103.0

  • Potentially breaking compatibility fix: Colors now preserve "analogous sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none) instead of lab(50% 0 0).

1.102.0

  • Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

1.101.7

  • No user-visible changes.

... (truncated)

Commits
  • da84fb5 Fix --watch not recompiling sources modified during a compilation (#2850)
  • 8a287a7 Merge pull request #2859 from sass/fix-auto-merge
  • 6033b46 Add explicit versions to .github/util actions
  • cc71d43 Only auto-merge dependabot PRs once the tests pass
  • 49ddc4f Revert "Bump dart-lang/setup-dart in /.github/util/initialize"
  • 71a127d Avoid duplicating loud comments that appear before @use (#2854)
  • f19baab Merge pull request #2857 from sass/dependabot/github_actions/dot-github/util/...
  • f5263e2 Bump dart-lang/setup-dart in /.github/util/initialize
  • 3018c0d Merge pull request #2856 from sass/dependabot/github_actions/dart-lang/setup-...
  • 5d74adb Bump dart-lang/setup-dart from 1.8.0 to 1.8.1
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sass since your current version.


Updates webpack from 5.99.8 to 5.111.0

Release notes

Sourced from webpack's releases.

v5.111.0

Minor Changes

Patch Changes

... (truncated)

Changelog

Sourced from webpack's changelog.

5.111.0

Minor Changes

Patch Changes

... (truncated)

Commits
  • 9256118 chore(release): new release (#21914)
  • 3ef9663 refactor: consolidate getter and value format of export fragment (#22100)
  • aff7c4c perf: emit less chunk-loading runtime (#22094)
  • e954b81 build(html): sweep the HTML printer for spelling-dependent output (#22097)
  • da4ad13 fix(css): replace a @​value named in an at-rule prelude only once (#22036)
  • df72840 perf(runtime): test the spec namespace cache slot for truthiness (#22098)
  • 4c80c99 fix(html): minify an attribute by what it says, not how it was spelled (#22095)
  • f6fd097 fix: release stale compilation data from nested children and idle watches (#2...
  • 55c9808 refactor(js): own the ECMAScript parser and drop the acorn dependency (#22042)
  • e1ab6f2 fix(html): escape a text run the tag after it would fuse with (#22086)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the npm-dev-minor-patch group with 8 updates
c43d602 
Bumps the npm-dev-minor-patch group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.52.0` | `1.63.0` |
| [@tailwindcss/forms](https://github.com/tailwindlabs/tailwindcss-forms) | `0.5.10` | `0.5.11` |
| [@wordpress/e2e-test-utils](https://github.com/WordPress/gutenberg/tree/HEAD/packages/e2e-test-utils) | `11.23.0` | `11.34.0` |
| [@wordpress/e2e-test-utils-playwright](https://github.com/WordPress/gutenberg/tree/HEAD/packages/e2e-test-utils-playwright) | `1.23.0` | `1.54.0` |
| [@wordpress/env](https://github.com/WordPress/gutenberg/tree/HEAD/packages/env) | `10.23.0` | `10.39.0` |
| [grunt](https://github.com/gruntjs/grunt) | `1.6.1` | `1.6.3` |
| [sass](https://github.com/sass/dart-sass) | `1.88.0` | `1.104.1` |
| [webpack](https://github.com/webpack/webpack) | `5.99.8` | `5.111.0` |


Updates `@playwright/test` from 1.52.0 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.52.0...v1.63.0)

Updates `@tailwindcss/forms` from 0.5.10 to 0.5.11
- [Release notes](https://github.com/tailwindlabs/tailwindcss-forms/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss-forms/blob/main/CHANGELOG.md)
- [Commits](tailwindlabs/tailwindcss-forms@v0.5.10...v0.5.11)

Updates `@wordpress/e2e-test-utils` from 11.23.0 to 11.34.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/@wordpress/e2e-test-utils@11.34.0/packages/e2e-test-utils/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/e2e-test-utils@11.34.0/packages/e2e-test-utils)

Updates `@wordpress/e2e-test-utils-playwright` from 1.23.0 to 1.54.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/e2e-test-utils-playwright/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/e2e-test-utils-playwright@1.54.0/packages/e2e-test-utils-playwright)

Updates `@wordpress/env` from 10.23.0 to 10.39.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/env/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/env@10.39.0/packages/env)

Updates `grunt` from 1.6.1 to 1.6.3
- [Release notes](https://github.com/gruntjs/grunt/releases)
- [Changelog](https://github.com/gruntjs/grunt/blob/main/CHANGELOG.md)
- [Commits](gruntjs/grunt@v1.6.1...v1.6.3)

Updates `sass` from 1.88.0 to 1.104.1
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.88.0...1.104.1)

Updates `webpack` from 5.99.8 to 5.111.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.99.8...v5.111.0)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dev-minor-patch
- dependency-name: "@tailwindcss/forms"
  dependency-version: 0.5.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
- dependency-name: "@wordpress/e2e-test-utils"
  dependency-version: 11.34.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dev-minor-patch
- dependency-name: "@wordpress/e2e-test-utils-playwright"
  dependency-version: 1.54.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dev-minor-patch
- dependency-name: "@wordpress/env"
  dependency-version: 10.39.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dev-minor-patch
- dependency-name: grunt
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
- dependency-name: sass
  dependency-version: 1.104.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dev-minor-patch
- dependency-name: webpack
  dependency-version: 5.111.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dev-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
@socket-security

socket-security Bot commented Sep 21, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​wordpress/​e2e-test-utils@​11.23.0 ⏵ 11.34.092 +7100100 +15070
Updatednpm/​@​wordpress/​e2e-test-utils-playwright@​1.23.0 ⏵ 1.54.0100 +110098100 +270
Updatednpm/​@​wordpress/​env@​10.23.0 ⏵ 10.39.0951001009970
Addednpm/​grunt@​1.6.3991008491100
Updatednpm/​@​tailwindcss/​forms@​0.5.10 ⏵ 0.5.1110010010085100
Updatednpm/​webpack@​5.99.8 ⏵ 5.111.093 -2100 +293 +199 +1100
Updatednpm/​sass@​1.88.0 ⏵ 1.104.1100 +1210010097 +4100
Updatednpm/​@​playwright/​test@​1.52.0 ⏵ 1.63.010010010099 +1100

View full report

@socket-security

socket-security Bot commented Sep 21, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @zip.js/zip.js is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/env@10.39.0 → npm/@zip.js/zip.js@2.7.57

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zip.js/zip.js@2.7.57. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @zip.js/zip.js is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/env@10.39.0 → npm/@zip.js/zip.js@2.7.57

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zip.js/zip.js@2.7.57. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm zstddec is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/env@10.39.0 → npm/zstddec@0.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/zstddec@0.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot attempted to update this pull request, but because the branch dependabot/npm_and_yarn/npm-dev-minor-patch-b8dded417c is protected it was unable to do so.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants