Skip to content

import changes from upstream#9

Merged
gadeynebram merged 20 commits into
mainfrom
sync/upstream-20260615
Jun 15, 2026
Merged

import changes from upstream#9
gadeynebram merged 20 commits into
mainfrom
sync/upstream-20260615

Conversation

@gadeynebram

Copy link
Copy Markdown
Owner

No description provided.

dependabot Bot and others added 20 commits May 23, 2026 21:22
Bumps [qs](https://github.com/ljharb/qs) from 6.14.2 to 6.15.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.15.2</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: skip null/undefined entries in
<code>arrayFormat: 'comma'</code> + <code>encodeValuesOnly</code>
instead of crashing in <code>encoder</code></li>
<li>[Fix] <code>stringify</code>: use configured <code>delimiter</code>
after <code>charsetSentinel</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/555">#555</a>)</li>
<li>[Fix] <code>stringify</code>: apply <code>formatter</code> to
encoded key under <code>strictNullHandling</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/554">#554</a>)</li>
<li>[Fix] <code>stringify</code>: skip null/undefined filter-array
entries instead of crashing in <code>encoder</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/551">#551</a>)</li>
<li>[Fix] <code>parse</code>: handle nested bracket groups and add
regression tests (<a
href="https://redirect.github.com/ljharb/qs/issues/530">#530</a>)</li>
<li>[readme] fix grammar (<a
href="https://redirect.github.com/ljharb/qs/issues/550">#550</a>)</li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li>[Tests] add regression tests for keys containing percent-encoded
bracket text</li>
</ul>
<h2><strong>6.15.1</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: <code>parameterLimit: Infinity</code> with
<code>throwOnLimitExceeded: true</code> silently drops all
parameters</li>
<li>[Deps] update <code>@ljharb/eslint-config</code></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>iconv-lite</code></li>
<li>[Tests] increase coverage</li>
</ul>
<h2><strong>6.15.0</strong></h2>
<ul>
<li>[New] <code>parse</code>: add <code>strictMerge</code> option to
wrap object/primitive conflicts in an array (<a
href="https://redirect.github.com/ljharb/qs/issues/425">#425</a>, <a
href="https://redirect.github.com/ljharb/qs/issues/122">#122</a>)</li>
<li>[Fix] <code>duplicates</code> option should not apply to bracket
notation keys (<a
href="https://redirect.github.com/ljharb/qs/issues/514">#514</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ljharb/qs/commit/9aca4076fe788338c67cf7e115f0be6bc58d85a8"><code>9aca407</code></a>
v6.15.2</li>
<li><a
href="https://github.com/ljharb/qs/commit/5e33d33447ed0bf1ddab9abc41d27dea4687d992"><code>5e33d33</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"><code>21f80b3</code></a>
[Fix] <code>stringify</code>: skip null/undefined entries in
<code>arrayFormat: 'comma'</code> + `e...</li>
<li><a
href="https://github.com/ljharb/qs/commit/a0a81ea2071acce3eff41a040f719ac8f5c4f64c"><code>a0a81ea</code></a>
[Fix] <code>stringify</code>: use configured <code>delimiter</code>
after <code>charsetSentinel</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/e3062f78f5233b338ceeb8e8dfa5a07dea4b32a8"><code>e3062f7</code></a>
[Fix] <code>stringify</code>: apply <code>formatter</code> to encoded
key under <code>strictNullHandling</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/0c180a40adb8c6703fffc85b2ff06ca209f5c1e0"><code>0c180a4</code></a>
[Fix] <code>stringify</code>: skip null/undefined filter-array entries
instead of crashi...</li>
<li><a
href="https://github.com/ljharb/qs/commit/3a8b94aec19bd664720f6f6b1e66c4a0dfe4b656"><code>3a8b94a</code></a>
[Tests] add regression tests for keys containing percent-encoded bracket
text</li>
<li><a
href="https://github.com/ljharb/qs/commit/96755abd357c0e534dd3442a84a04d08864bfe0d"><code>96755ab</code></a>
[readme] fix grammar</li>
<li><a
href="https://github.com/ljharb/qs/commit/a419ce5bbfcdb98a299f1a0bb47ea055baef20e6"><code>a419ce5</code></a>
[Fix] <code>parse</code>: handle nested bracket groups and add
regression tests</li>
<li><a
href="https://github.com/ljharb/qs/commit/3f5e1c528c967d915096787efbffa73cf6044170"><code>3f5e1c5</code></a>
v6.15.1</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.14.2...v6.15.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=qs&package-manager=npm_and_yarn&previous-version=6.14.2&new-version=6.15.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/azure-devops-mcp/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1255)

Bumps
[@azure/msal-node](https://github.com/AzureAD/microsoft-authentication-library-for-js)
from 5.1.5 to 5.2.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/releases">@​azure/msal-node's
releases</a>.</em></p>
<blockquote>
<h2><code>@​azure/msal-react</code> v5.2.1</h2>
<h2>5.2.1</h2>
<p>Wed, 01 Apr 2026 20:09:00 GMT</p>
<h3>Patches</h3>
<ul>
<li>Improve compatibility with <code>React.StrictMode</code> <a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/pull/8383">#8383</a>
(<a
href="mailto:herman.jensen@intility.no">herman.jensen@intility.no</a>)</li>
<li>Bump <code>@​azure/msal-browser</code> to v5.6.3 (beachball)</li>
</ul>
<h2><code>@​azure/msal-angular</code> v5.2.1</h2>
<h2>5.2.1</h2>
<p>Tue, 21 Apr 2026 22:41:19 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-browser</code> to v5.8.0 (beachball)</li>
</ul>
<h2><code>@​azure/msal-node-extensions</code> v5.2.1</h2>
<h2>5.2.1</h2>
<p>Mon, 11 May 2026 21:48:15 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-common</code> to v16.6.1 (beachball)</li>
</ul>
<h2><code>@​azure/msal-node</code> v5.2.1</h2>
<h2>5.2.1</h2>
<p>Mon, 11 May 2026 21:48:15 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-common</code> to v16.6.1 (beachball)</li>
</ul>
<h2><code>@​azure/msal-browser</code> v5.2.0</h2>
<h2>5.2.0</h2>
<p>Tue, 10 Feb 2026 23:04:27 GMT</p>
<h3>Minor changes</h3>
<ul>
<li>Add correlationId to events <a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/pull/8288">#8288</a>
(<a
href="mailto:thomas.norling@microsoft.com">thomas.norling@microsoft.com</a>)</li>
<li>Bump <code>@​azure/msal-common</code> to v16.0.4 (beachball)</li>
<li>Bump eslint-config-msal to v0.0.0 (beachball)</li>
<li>Bump msal-test-utils to v0.0.1 (beachball)</li>
<li>Bump rollup-msal to v0.0.0 (beachball)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/c66140125e3e4bdc7acb9199fc0004bb5429b41d"><code>c661401</code></a>
Complete test tenant migration (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8584">#8584</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/bbcc105174de98d336f758674ecd84cf66d8e1f6"><code>bbcc105</code></a>
Add browser compatibility guidelines and review instructions for
msal-browser...</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/d7a7eb50c40b24e7cc17b341f1109cdbfac83e3f"><code>d7a7eb5</code></a>
Add issuer validation check whenever MSAL JS performs OIDC endpoint
discovery...</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/9884a71cca16bd3d16794aa2a2696011d333f161"><code>9884a71</code></a>
Post-release PR (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8583">#8583</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/b4e498cf6e52136ad1123691138a66f8e9a1a87c"><code>b4e498c</code></a>
Stop looking in localStorage for temporary cache (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8579">#8579</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/1b261b42eb983329ea7c062feae3d8e6513b8c7e"><code>1b261b4</code></a>
Bump uuid and <code>@​actions/core</code> in
/.github/actions/issue_template_bot (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8571">#8571</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/1d8d2aeb8247ee480f93c3b93b3119bc9865d38f"><code>1d8d2ae</code></a>
Update docs with popup closure detection and interaction status details
(<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8580">#8580</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/bd7b6c4de077b14f7eb48880fec6354c0028953c"><code>bd7b6c4</code></a>
Use local e2eTestUtils path for samples (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8578">#8578</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/64b327815d57e643957d9e308ddedba908fefd0e"><code>64b3278</code></a>
Add MSAL client metadata headers to IMDS managed identity requests (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8529">#8529</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/45bb72c53f3802919315238fe1d433b6c2ea33f8"><code>45bb72c</code></a>
Restore NativeAuthSample app, e2e tests, and 3p-e2e pipeline (re-apply
<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8176">#8176</a>,...</li>
<li>Additional commits viewable in <a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/compare/msal-node-v5.1.5...msal-node-v5.2.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@azure/msal-node&package-manager=npm_and_yarn&previous-version=5.1.5&new-version=5.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Hellem <dahellem@microsoft.com>
…1290)

Bumps
[@azure/msal-node](https://github.com/AzureAD/microsoft-authentication-library-for-js)
from 5.2.1 to 5.2.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/releases">@​azure/msal-node's
releases</a>.</em></p>
<blockquote>
<h2><code>@​azure/msal-angular</code> v5.2.2</h2>
<h2>5.2.2</h2>
<p>Tue, 28 Apr 2026 21:30:33 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-browser</code> to v5.9.0 (beachball)</li>
</ul>
<h2><code>@​azure/msal-node-extensions</code> v5.2.2</h2>
<h2>5.2.2</h2>
<p>Tue, 19 May 2026 19:29:14 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-common</code> to v16.6.2 (beachball)</li>
</ul>
<h2><code>@​azure/msal-node</code> v5.2.2</h2>
<h2>5.2.2</h2>
<p>Tue, 19 May 2026 19:29:14 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-common</code> to v16.6.2 (beachball)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/738ade62dfbadf845fdf8afbc6d21564f00ac0bb"><code>738ade6</code></a>
check account loginHint before idTokenClaims setting logoutHint (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8591">#8591</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/1fff290c58cff5d3c768711e3aa8388476cb8e52"><code>1fff290</code></a>
Add allowPlatformBrokerWithDOM experimental config flag (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8589">#8589</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/99e0895b66400ba15d1bfd41e9ef0869b3e45753"><code>99e0895</code></a>
Custom Auth: add requestInterceptor for custom x-* request headers (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8587">#8587</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/ce50f41b05c79afe0b88ba8441a789907149039f"><code>ce50f41</code></a>
Post-release PR (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8585">#8585</a>)</li>
<li>See full diff in <a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/compare/msal-node-v5.2.1...msal-node-v5.2.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@azure/msal-node&package-manager=npm_and_yarn&previous-version=5.2.1&new-version=5.2.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1288)

This pull request adds a human-readable `statusName` field to the
trimmed pull request objects returned by the `trimPullRequest` function
in `src/tools/repositories.ts`. The new field maps the numeric pull
request status codes to descriptive string values (e.g., "Active",
"Abandoned"). Comprehensive updates were made to the test suite to
reflect this new field, ensuring consistency and correctness across all
relevant test cases.

Key changes:

**Feature Addition:**
* Added a `statusName` property to the object returned by
`trimPullRequest`, mapping numeric status codes to human-readable
strings using a new `statusMap`.

**Testing Updates:**
* Updated all relevant test cases in `repositories.test.ts` to include
and assert the new `statusName` field for both numeric and enum-based
status values.

## GitHub issue number

microsoft#1263

## **Associated Risks**

None

## ✅ **PR Checklist**

- [x] **I have read the [contribution
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CONTRIBUTING.md)**
- [x] **I have read the [code of conduct
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CODE_OF_CONDUCT.md)**
- [x] Title of the pull request is clear and informative.
- [x] 👌 Code hygiene
- [x] 🔭 Telemetry added, updated, or N/A
- [x] 📄 Documentation added, updated, or N/A
- [x] 🛡️ Automated tests added, or N/A

## 🧪 **How did you test it?**

Updated auto tests and did a manual check across several PRs
Adds Codex setup documentation for the local Azure DevOps MCP Server.

## GitHub issue number

Fixes microsoft#1274

## **Associated Risks**

Low. This is documentation-only and does not change runtime behavior.

## ✅ **PR Checklist**

- [x] **I have read the [contribution
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CONTRIBUTING.md)**
- [x] **I have read the [code of conduct
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CODE_OF_CONDUCT.md)**
- [x] Title of the pull request is clear and informative.
- [x] 👌 Code hygiene
- [x] 🔭 Telemetry added, updated, or N/A
- [x] 📄 Documentation added, updated, or N/A
- [x] 🛡️ Automated tests added, or N/A

## 🧪 **How did you test it?**

- `codex mcp add --help`
- `npx prettier --check README.md docs/GETTINGSTARTED.md`
- `git diff --check`
- `npm test`

The docs lead with Codex interactive authentication, which does not
require a PAT, then document Azure CLI and PAT options for environments
where browser sign-in is not practical.

---------

Co-authored-by: Connor Bescos <76459544+connorbescos@users.noreply.github.com>
Co-authored-by: Dan Hellem <dahellem@microsoft.com>
Adding new logo file

## GitHub issue number

## **Associated Risks**

_Replace_ by possible risks this pull request can bring you might have
thought of

## ✅ **PR Checklist**

- [ ] **I have read the [contribution
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CONTRIBUTING.md)**
- [ ] **I have read the [code of conduct
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CODE_OF_CONDUCT.md)**
- [ ] Title of the pull request is clear and informative.
- [ ] 👌 Code hygiene
- [ ] 🔭 Telemetry added, updated, or N/A
- [ ] 📄 Documentation added, updated, or N/A
- [ ] 🛡️ Automated tests added, or N/A

## 🧪 **How did you test it?**

_Replace_ with use cases tested and models used
…icrosoft#1289)

This pull request enhances the handling of pull request reviewer votes
in the repository tools, ensuring that the `isRequired` status of
reviewers is preserved when casting votes and improving error handling.
It also extends test coverage for these scenarios.

**Vote casting and reviewer handling improvements:**

*
[`src/tools/repositories.ts`](diffhunk://#diff-e3b482da7e394e782902c348cf01ce12c7c881ed9745c10aff16e8f873714103L1986-R2000):
Before casting a vote with `createPullRequestReviewer`, the code now
checks if the reviewer already exists using `getPullRequestReviewer`. If
so, it preserves the reviewer's `isRequired` status in the payload. If
the reviewer does not exist, it gracefully handles the error and
proceeds to add the reviewer.

**Test coverage enhancements:**

* `repositories.test.ts`: Mocks and tests for `getPullRequestReviewer`
were added to ensure the correct behavior when the reviewer exists, does
not exist, or when API errors occur. This includes:
- Verifying that `isRequired` is preserved in the payload.
[[1]](diffhunk://#diff-ab08119c40bb674907f4cd70e8c549daaf3bcd559398b0f2eddb463bf8eb160aR5962)
[[2]](diffhunk://#diff-ab08119c40bb674907f4cd70e8c549daaf3bcd559398b0f2eddb463bf8eb160aL5972-R5976)
[[3]](diffhunk://#diff-ab08119c40bb674907f4cd70e8c549daaf3bcd559398b0f2eddb463bf8eb160aR5987)
[[4]](diffhunk://#diff-ab08119c40bb674907f4cd70e8c549daaf3bcd559398b0f2eddb463bf8eb160aL5994-R6021)
  - Testing the scenario where the reviewer does not exist yet.
- Ensuring API errors from `getPullRequestReviewer` are properly
propagated and do not trigger reviewer creation.
- Adding the necessary mocks for `getPullRequestReviewer` in the test
setup.
[[1]](diffhunk://#diff-ab08119c40bb674907f4cd70e8c549daaf3bcd559398b0f2eddb463bf8eb160aR37)
[[2]](diffhunk://#diff-ab08119c40bb674907f4cd70e8c549daaf3bcd559398b0f2eddb463bf8eb160aR71)

These changes make vote handling more robust and ensure that reviewer
status is not inadvertently lost during updates.

## GitHub issue number
microsoft#1287

## **Associated Risks**

N/A

## ✅ **PR Checklist**

- [x] **I have read the [contribution
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CONTRIBUTING.md)**
- [x] **I have read the [code of conduct
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CODE_OF_CONDUCT.md)**
- [x] Title of the pull request is clear and informative.
- [x] 👌 Code hygiene
- [x] 🔭 Telemetry added, updated, or N/A
- [x] 📄 Documentation added, updated, or N/A
- [x] 🛡️ Automated tests added, or N/A

## 🧪 **How did you test it?**

updated tests and did a manual verification
Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from
17.0.0 to 17.0.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/releases">lint-staged's
releases</a>.</em></p>
<blockquote>
<h2>v17.0.5</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1792">#1792</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/1f672718b6fa67e0f00aafe107cb9f084f4d9102"><code>1f67271</code></a>
- Correctly set the <code>--max-arg-length</code> default value based on
the running platform. This controls how very long lists of staged files
are split into multiple chunks.</li>
</ul>
<h2>v17.0.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1788">#1788</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/f95c1f8df3368758c44c2052e568aac1b3d4c767"><code>f95c1f8</code></a>
- Another fix for making sure <em>lint-staged</em> adds task
modifications correctly to the commit in the following cases:</p>
<ul>
<li>after editing <code>&lt;file&gt;</code> it is staged with <code>git
add &lt;file&gt;</code>, and then committed with <code>git
commit</code></li>
<li>after editing <code>&lt;file&gt;</code> it is committed with
<code>git commit --all</code> without explicit <code>git add</code></li>
<li>after editing <code>&lt;file&gt;</code> it is committed with
<code>git commit &lt;pathspec&gt;</code> without explicit <code>git
add</code></li>
</ul>
<p>There's new test cases which actually setup the Git
<code>pre_commit</code> hook to run <em>lint-staged</em> and verify
them. These issues started in <strong>v17.0.0</strong> when trying to
improve support for committig without having explicitly staged
files.</p>
</li>
</ul>
<h2>v17.0.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1782">#1782</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/06813f9ab661db987e7720086ef9ec3f552ee097"><code>06813f9</code></a>
Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! -
Fix <em>lint-staged</em> behavior when implicitly committing files
without using <code>git add</code> by either:
<ul>
<li><code>git commit -am &quot;my commit message&quot;</code> where
<code>-a</code> (<code>--all</code>) means to automatically stage all
tracked modified and deleted files</li>
<li><code>git commit -m &quot;my commit message&quot; .</code> where
<code>.</code> is an example of a <a
href="https://git-scm.com/docs/git-commit#Documentation/git-commit.txt-pathspec"><em>pathspec</em></a>
where matching files will be staged</li>
</ul>
</li>
</ul>
<h2>v17.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1779">#1779</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/88670ca2278200f6348ed663358895ddc4bfff3c"><code>88670ca</code></a>
Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! -
Enable immutable GitHub releases</li>
</ul>
<h2>v17.0.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1776">#1776</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/4a5664be63af19590ec37940f705dad870ac5cfb"><code>4a5664b</code></a>
Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! -
Adjust GitHub Actions workflow so that automatic publishing works with
signed commits.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's
changelog</a>.</em></p>
<blockquote>
<h2>17.0.5</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1792">#1792</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/1f672718b6fa67e0f00aafe107cb9f084f4d9102"><code>1f67271</code></a>
- Correctly set the <code>--max-arg-length</code> default value based on
the running platform. This controls how very long lists of staged files
are split into multiple chunks.</li>
</ul>
<h2>17.0.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1788">#1788</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/f95c1f8df3368758c44c2052e568aac1b3d4c767"><code>f95c1f8</code></a>
- Another fix for making sure <em>lint-staged</em> adds task
modifications correctly to the commit in the following cases:</p>
<ul>
<li>after editing <code>&lt;file&gt;</code> it is staged with <code>git
add &lt;file&gt;</code>, and then committed with <code>git
commit</code></li>
<li>after editing <code>&lt;file&gt;</code> it is committed with
<code>git commit --all</code> without explicit <code>git add</code></li>
<li>after editing <code>&lt;file&gt;</code> it is committed with
<code>git commit &lt;pathspec&gt;</code> without explicit <code>git
add</code></li>
</ul>
<p>There's new test cases which actually setup the Git
<code>pre_commit</code> hook to run <em>lint-staged</em> and verify
them. These issues started in <strong>v17.0.0</strong> when trying to
improve support for committig without having explicitly staged
files.</p>
</li>
</ul>
<h2>17.0.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1782">#1782</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/06813f9ab661db987e7720086ef9ec3f552ee097"><code>06813f9</code></a>
Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! -
Fix <em>lint-staged</em> behavior when implicitly committing files
without using <code>git add</code> by either:
<ul>
<li><code>git commit -am &quot;my commit message&quot;</code> where
<code>-a</code> (<code>--all</code>) means to automatically stage all
tracked modified and deleted files</li>
<li><code>git commit -m &quot;my commit message&quot; .</code> where
<code>.</code> is an example of a <a
href="https://git-scm.com/docs/git-commit#Documentation/git-commit.txt-pathspec"><em>pathspec</em></a>
where matching files will be staged</li>
</ul>
</li>
</ul>
<h2>17.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1779">#1779</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/88670ca2278200f6348ed663358895ddc4bfff3c"><code>88670ca</code></a>
Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! -
Enable immutable GitHub releases</li>
</ul>
<h2>17.0.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1776">#1776</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/4a5664be63af19590ec37940f705dad870ac5cfb"><code>4a5664b</code></a>
Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! -
Adjust GitHub Actions workflow so that automatic publishing works with
signed commits.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/cbd822ea4952f8026474306b424850a0e57984d3"><code>cbd822e</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1793">#1793</a>
from lint-staged/changeset-release/main</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/191124485bccd2af8bb225535b1561f7fd00db07"><code>1911244</code></a>
chore(changeset): release</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/7339d7d6ba6f82affcf4ca9c3c07127ffe2202c8"><code>7339d7d</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1792">#1792</a>
from lint-staged/fix-max-arg-length-default</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/1f672718b6fa67e0f00aafe107cb9f084f4d9102"><code>1f67271</code></a>
fix: default <code>maxArgLength</code> to <code>undefined</code> instead
of <code>NaN</code> when parsing cli ...</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2862964b2429df8df2aae05ff7b73cf69f440c90"><code>2862964</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1789">#1789</a>
from lint-staged/changeset-release/main</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/c9ecd54417e1fb698fba0377c912a5ac819a51b8"><code>c9ecd54</code></a>
chore(changeset): release</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/cc6b51ab2d1564ebe27f47a9eba02b74353805bc"><code>cc6b51a</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1788">#1788</a>
from lint-staged/fix-update-index-again</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/f95c1f8df3368758c44c2052e568aac1b3d4c767"><code>f95c1f8</code></a>
fix: update both default index.lock and non-standard lock when latter
exists</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/f44ee688dd1c7070f32cde8ca1f910d7f8a96e3e"><code>f44ee68</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1786">#1786</a>
from lint-staged/update-repo-url</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/a61cf18ea5af3bfa06623bed1f80217fe3865871"><code>a61cf18</code></a>
build(deps): update dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/lint-staged/lint-staged/compare/v17.0.0...v17.0.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lint-staged&package-manager=npm_and_yarn&previous-version=17.0.0&new-version=17.0.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ts-jest](https://github.com/kulshekhar/ts-jest) from 29.4.9 to
29.4.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kulshekhar/ts-jest/releases">ts-jest's
releases</a>.</em></p>
<blockquote>
<h2>v29.4.11</h2>
<p>Please refer to <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v29.4.10</h2>
<p>Please refer to <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md">ts-jest's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.10...v29.4.11">29.4.11</a>
(2026-05-21)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>preserve Bundler on the CJS path under TypeScript &gt;= 6 (<a
href="https://github.com/kulshekhar/ts-jest/commit/39418187515f11b6584d35a4e3ddf50231f74936">3941818</a>),
closes <a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/4198">#4198</a></li>
</ul>
<h2><a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.9...v29.4.10">29.4.10</a>
(2026-05-18)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>pass <code>resolutionMode</code> to
<code>ts.resolveModuleName</code> for hybrid module support (<a
href="https://github.com/kulshekhar/ts-jest/commit/b557a85f85c3fd34523ec3a15293afbdc9dea83c">b557a85</a>)</li>
<li>rebuild <code>Program</code> when consecutive compiles need
different module kinds (<a
href="https://github.com/kulshekhar/ts-jest/commit/a82a2b32c4987a5249fd5284283117dd2fa3be47">a82a2b3</a>),
closes <a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/4774">#4774</a></li>
<li>respect tsconfig <code>moduleResolution</code> instead of forcing
<code>Node10</code> (<a
href="https://github.com/kulshekhar/ts-jest/commit/1bffffc667557c173ae0c1f93dd436920775dac4">1bffffc</a>)</li>
<li><strong>transformer:</strong> transpile <code>mjs</code> files from
<code>node_modules</code> for CJS mode (<a
href="https://github.com/kulshekhar/ts-jest/commit/96d025dd912ea2bceb18b67d2d509ada7a756d9d">96d025d</a>)</li>
<li><strong>transformer:</strong> use a consistent comparator in
hoist-jest sortStatements (<a
href="https://github.com/kulshekhar/ts-jest/commit/8a8fd2fb8446655bba18367db9306a1089490e62">8a8fd2f</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/bff2d64917caa8150701829b152c4d193614d997"><code>bff2d64</code></a>
chore(release): 29.4.11</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/39418187515f11b6584d35a4e3ddf50231f74936"><code>3941818</code></a>
fix: preserve Bundler on the CJS path under TypeScript &gt;= 6</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/efb3c2f84d3583db0787982a18425d99edadfe25"><code>efb3c2f</code></a>
build(deps): bump webpack-dev-server from 5.2.2 to 5.2.4 in
/website</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/4e46fad6c1c4d5be5d6666c64bf65a3af2f1519e"><code>4e46fad</code></a>
ci: refactor release workflow</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/96b3ac0cc0586d5379c87308f797a9acf0e4a675"><code>96b3ac0</code></a>
chore(release): 29.4.10</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/e98ec6452548a61285d55c00c7f6b1fd9858d699"><code>e98ec64</code></a>
build(deps): update github/codeql-action digest to 458d36d</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/21ac58f60f93164640433250fb4ca8b671aa8587"><code>21ac58f</code></a>
build(deps): update jest packages</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/0fdc96d293c6ce047bf61831b721218623882e78"><code>0fdc96d</code></a>
build(deps): update dependency semver to ^7.8.0</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/4b95551190235a65eac176625c72e220af066efe"><code>4b95551</code></a>
build(deps): update dependency jest-environment-jsdom to ^30.4.1 (<a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/5311">#5311</a>)</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/7b884476f7891e2b9a8637e2f6bb2e09b7efcfbd"><code>7b88447</code></a>
build(deps): update eslint packages to ^8.59.3 (<a
href="https://redirect.github.com/kulshekhar/ts-jest/issues/5310">#5310</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.9...v29.4.11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ts-jest&package-manager=npm_and_yarn&previous-version=29.4.9&new-version=29.4.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest)
from 30.3.0 to 30.4.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/releases">jest's
releases</a>.</em></p>
<blockquote>
<h2>v30.4.2</h2>
<h1>Fixes</h1>
<ul>
<li><code>[jest-runtime]</code> Fix named imports from CJS modules whose
<code>module.exports</code> is a function with own-property exports (<a
href="https://redirect.github.com/jestjs/jest/pull/16150">#16150</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.4.1...v30.4.2">https://github.com/jestjs/jest/compare/v30.4.1...v30.4.2</a></p>
<h2>v30.4.1</h2>
<h2>Features</h2>
<ul>
<li><code>[jest-config, jest-core, jest-runner, jest-schemas,
jest-types]</code> Allow custom runner configuration options via tuple
format <code>['runner-path', {options}]</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16141">#16141</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li><code>[jest-runtime]</code> Align CJS-from-ESM default export with
Node: <code>module.exports</code> is always the ESM default,
<code>__esModule</code> unwrapping is no longer applied (<a
href="https://redirect.github.com/jestjs/jest/pull/16143">#16143</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.4.0...v30.4.1">https://github.com/jestjs/jest/compare/v30.4.0...v30.4.1</a></p>
<h2>v30.4.0</h2>
<p>Big release! 😀</p>
<p>Main feature is a rewrite of our custom runtime in preparation for
stabilisation of native support of ESM. As part of that work
<code>require(esm)</code> module is now supported on Node 24.9+ (still
requires <code>--experimental-vm-modules</code> like before).</p>
<p>In addition we now support fake timers for the recently released
<code>Temporal</code> API in Node v26.</p>
<p>React 19 is also supported properly in <code>pretty-format</code>,
meaning snapshots of React components now work like they should.</p>
<p>Due to all the changes, there might be regressions that snuck in.
Please report them!</p>
<p>Full list of changes below</p>
<h2>Features</h2>
<ul>
<li><code>[babel-jest]</code> Support collecting coverage from
<code>.mts</code>, <code>.cts</code> (and other) files (<a
href="https://redirect.github.com/jestjs/jest/pull/15994">#15994</a>)</li>
<li><code>[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2,
jest-types]</code> Add <code>--collect-tests</code> flag to discover and
list tests without executing them (<a
href="https://redirect.github.com/jestjs/jest/pull/16006">#16006</a>)</li>
<li><code>[jest-config, jest-runner, jest-worker]</code> Add
<code>workerGracefulExitTimeout</code> config option to control how long
workers are given to exit before being force-killed (<a
href="https://redirect.github.com/jestjs/jest/pull/15984">#15984</a>)</li>
<li><code>[jest-config]</code> Add support for
<code>jest.config.mts</code> as a valid configuration file (<a
href="https://redirect.github.com/jestjs/jest/pull/16005">#16005</a>)</li>
<li><code>[jest-config, jest-core, jest-reporters, jest-runner]</code>
<code>verbose</code> and <code>silent</code> can now be set per-project;
the project-level value overrides the global value for that project's
tests (<a
href="https://redirect.github.com/jestjs/jest/pull/16133">#16133</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Duration</code> in
<code>jest.advanceTimersByTime()</code> and
<code>jest.advanceTimersByTimeAsync()</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Instant</code> and <code>Temporal.ZonedDateTime</code> in
<code>jest.setSystemTime()</code> and <code>useFakeTimers({now})</code>
(<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Support faking
<code>Temporal.Now.*</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16131">#16131</a>)</li>
<li><code>[jest-mock]</code> Add <code>clearMocksOnScope(scope)</code>
on <code>ModuleMocker</code> for clearing every mock function exposed on
a scope object (<a
href="https://redirect.github.com/jestjs/jest/pull/16088">#16088</a>)</li>
<li><code>[jest-resolve]</code> Add <code>canResolveSync()</code> on
<code>Resolver</code> so callers can detect when a user-configured
resolver only exports an <code>async</code> hook (<a
href="https://redirect.github.com/jestjs/jest/pull/16064">#16064</a>)</li>
<li><code>[jest-runtime]</code> Use synchronous <code>evaluate()</code>
for ES modules without top-level <code>await</code> on Node versions
that support it (v24.9+), and prefer the synchronous transform path when
a sync transformer is configured (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-runtime]</code> Support <code>require()</code> of ES
modules on Node v24.9+ (<a
href="https://redirect.github.com/jestjs/jest/pull/16074">#16074</a>)</li>
<li><code>[jest-runtime]</code> Validate TC39 import attributes
(<code>with { type: 'json' }</code>) on ESM imports (<a
href="https://redirect.github.com/jestjs/jest/pull/16127">#16127</a>)</li>
<li><code>[@jest/transform]</code> Add
<code>canTransformSync(filename)</code> on
<code>ScriptTransformer</code> so callers can pick the sync vs async
transform path (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-util]</code> Add <code>isError</code> helper (<a
href="https://redirect.github.com/jestjs/jest/pull/16076">#16076</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/blob/main/CHANGELOG.md">jest's
changelog</a>.</em></p>
<blockquote>
<h2>30.4.2</h2>
<h3>Fixes</h3>
<ul>
<li><code>[jest-runtime]</code> Fix named imports from CJS modules whose
<code>module.exports</code> is a function with own-property exports (<a
href="https://redirect.github.com/jestjs/jest/pull/16150">#16150</a>)</li>
</ul>
<h2>30.4.1</h2>
<h3>Features</h3>
<ul>
<li><code>[jest-config, jest-core, jest-runner, jest-schemas,
jest-types]</code> Allow custom runner configuration options via tuple
format <code>['runner-path', {options}]</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16141">#16141</a>)</li>
</ul>
<h3>Fixes</h3>
<ul>
<li><code>[jest-runtime]</code> Align CJS-from-ESM default export with
Node: <code>module.exports</code> is always the ESM default,
<code>__esModule</code> unwrapping is no longer applied (<a
href="https://redirect.github.com/jestjs/jest/pull/16143">#16143</a>)</li>
</ul>
<h2>30.4.0</h2>
<h3>Features</h3>
<ul>
<li><code>[babel-jest]</code> Support collecting coverage from
<code>.mts</code>, <code>.cts</code> (and other) files (<a
href="https://redirect.github.com/jestjs/jest/pull/15994">#15994</a>)</li>
<li><code>[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2,
jest-types]</code> Add <code>--collect-tests</code> flag to discover and
list tests without executing them (<a
href="https://redirect.github.com/jestjs/jest/pull/16006">#16006</a>)</li>
<li><code>[jest-config, jest-runner, jest-worker]</code> Add
<code>workerGracefulExitTimeout</code> config option to control how long
workers are given to exit before being force-killed (<a
href="https://redirect.github.com/jestjs/jest/pull/15984">#15984</a>)</li>
<li><code>[jest-config]</code> Add support for
<code>jest.config.mts</code> as a valid configuration file (<a
href="https://redirect.github.com/jestjs/jest/pull/16005">#16005</a>)</li>
<li><code>[jest-config, jest-core, jest-reporters, jest-runner]</code>
<code>verbose</code> and <code>silent</code> can now be set per-project;
the project-level value overrides the global value for that project's
tests (<a
href="https://redirect.github.com/jestjs/jest/pull/16133">#16133</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Duration</code> in
<code>jest.advanceTimersByTime()</code> and
<code>jest.advanceTimersByTimeAsync()</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Accept
<code>Temporal.Instant</code> and <code>Temporal.ZonedDateTime</code> in
<code>jest.setSystemTime()</code> and <code>useFakeTimers({now})</code>
(<a
href="https://redirect.github.com/jestjs/jest/pull/16128">#16128</a>)</li>
<li><code>[@jest/fake-timers]</code> Support faking
<code>Temporal.Now.*</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16131">#16131</a>)</li>
<li><code>[jest-mock]</code> Add <code>clearMocksOnScope(scope)</code>
on <code>ModuleMocker</code> for clearing every mock function exposed on
a scope object (<a
href="https://redirect.github.com/jestjs/jest/pull/16088">#16088</a>)</li>
<li><code>[jest-resolve]</code> Add <code>canResolveSync()</code> on
<code>Resolver</code> so callers can detect when a user-configured
resolver only exports an <code>async</code> hook (<a
href="https://redirect.github.com/jestjs/jest/pull/16064">#16064</a>)</li>
<li><code>[jest-runtime]</code> Use synchronous <code>evaluate()</code>
for ES modules without top-level <code>await</code> on Node versions
that support it (v24.9+), and prefer the synchronous transform path when
a sync transformer is configured (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-runtime]</code> Support <code>require()</code> of ES
modules on Node v24.9+ (<a
href="https://redirect.github.com/jestjs/jest/pull/16074">#16074</a>)</li>
<li><code>[jest-runtime]</code> Validate TC39 import attributes
(<code>with { type: 'json' }</code>) on ESM imports (<a
href="https://redirect.github.com/jestjs/jest/pull/16127">#16127</a>)</li>
<li><code>[@jest/transform]</code> Add
<code>canTransformSync(filename)</code> on
<code>ScriptTransformer</code> so callers can pick the sync vs async
transform path (<a
href="https://redirect.github.com/jestjs/jest/pull/16062">#16062</a>)</li>
<li><code>[jest-util]</code> Add <code>isError</code> helper (<a
href="https://redirect.github.com/jestjs/jest/pull/16076">#16076</a>)</li>
<li><code>[pretty-format]</code> Support React 19 (<a
href="https://redirect.github.com/jestjs/jest/pull/16123">#16123</a>)</li>
</ul>
<h3>Fixes</h3>
<ul>
<li><code>[expect-utils]</code> Fix <code>toStrictEqual</code> failing
on <code>structuredClone</code> results due to cross-realm constructor
mismatch (<a
href="https://redirect.github.com/jestjs/jest/pull/15959">#15959</a>)</li>
<li><code>[@jest/expect-utils]</code> Prevent
<code>toMatchObject</code>/subset matching from throwing when
encountering exotic iterables (<a
href="https://redirect.github.com/jestjs/jest/pull/15952">#15952</a>)</li>
<li><code>[fake-timers]</code> Convert <code>Date</code> to milliseconds
before passing to <code>@sinonjs/fake-timers</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16029">#16029</a>)</li>
<li><code>[jest]</code> Export <code>GlobalConfig</code> and
<code>ProjectConfig</code> TypeScript types (<a
href="https://redirect.github.com/jestjs/jest/pull/16132">#16132</a>)</li>
<li><code>[jest-circus]</code> Prevent crash when
<code>asyncError</code> is undefined for non-Error throws (<a
href="https://redirect.github.com/jestjs/jest/pull/16003">#16003</a>)</li>
<li><code>[jest-circus, jest-jasmine2]</code> Include
<code>Error.cause</code> in JSON <code>failureMessages</code> output (<a
href="https://redirect.github.com/jestjs/jest/pull/15967">#15967</a>)</li>
<li><code>[jest-config]</code> Fix preset path resolution on Windows
when the preset uses subpath <code>exports</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/15961">#15961</a>)</li>
<li><code>[jest-config]</code> Allow <code>collectCoverage</code> and
<code>coverageProvider</code> in project config without a validation
warning (<a
href="https://redirect.github.com/jestjs/jest/pull/16132">#16132</a>)</li>
<li><code>[jest-config]</code> Project config validator now emits
&quot;is not supported in an individual project configuration&quot;
instead of &quot;probably a typing mistake&quot; for known global-only
options (<a
href="https://redirect.github.com/jestjs/jest/pull/16132">#16132</a>)</li>
<li><code>[jest-environment-node]</code> Fix
<code>--localstorage-file</code> warning on Node 25+ (<a
href="https://redirect.github.com/jestjs/jest/pull/16086">#16086</a>)</li>
<li><code>[jest-reporters]</code> Apply global coverage threshold to
unmatched pattern files in addition to glob/path thresholds (<a
href="https://redirect.github.com/jestjs/jest/pull/16137">#16137</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jestjs/jest/commit/746f2a0f57c56e3bba555280f0587d40f3db95c0"><code>746f2a0</code></a>
v30.4.2</li>
<li><a
href="https://github.com/jestjs/jest/commit/b3b4a09ed3005369dacc7466d1d2122797283785"><code>b3b4a09</code></a>
v30.4.1</li>
<li><a
href="https://github.com/jestjs/jest/commit/5cbb21e0b3037edb42e503ec1a1ce80efad40c20"><code>5cbb21e</code></a>
v30.4.0</li>
<li><a
href="https://github.com/jestjs/jest/commit/db7141a93cc85fab81cf9c25368e1f2b2c312286"><code>db7141a</code></a>
fix: allow <code>collectCoverage</code> and
<code>coverageProvider</code> in project config (<a
href="https://github.com/jestjs/jest/tree/HEAD/packages/jest/issues/16132">#16132</a>)</li>
<li>See full diff in <a
href="https://github.com/jestjs/jest/commits/v30.4.2/packages/jest">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=jest&package-manager=npm_and_yarn&previous-version=30.3.0&new-version=30.4.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.18 to 4.12.23.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.23</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(serve-static): normalize all backslashes in file paths, not just
the first in <a
href="https://redirect.github.com/honojs/hono/pull/4962">honojs/hono#4962</a></li>
<li>feat(context): export the Context class publicly by <a
href="https://github.com/BlankParticle"><code>@​BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4543">honojs/hono#4543</a></li>
<li>docs(contribution): add AI Usage Policy by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4970">honojs/hono#4970</a></li>
<li>feat(compress): add contentTypeFilter option and
<code>COMPRESSIBLE_CONTENT_TYPE_REGEX</code> re-export by <a
href="https://github.com/na-trium-144"><code>@​na-trium-144</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4961">honojs/hono#4961</a></li>
<li>fix(utils/ipaddr): do not compress a single 0 group to
<code>::</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4971">honojs/hono#4971</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.22...v4.12.23">https://github.com/honojs/hono/compare/v4.12.22...v4.12.23</a></p>
<h2>v4.12.22</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: update vitest to v4 and cleanups by <a
href="https://github.com/BlankParticle"><code>@​BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4952">honojs/hono#4952</a></li>
<li>fix(mime): specify charset parameter per MIME type instead of
mechanical detection by <a
href="https://github.com/renatograsso10"><code>@​renatograsso10</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4912">honojs/hono#4912</a></li>
<li>fix(compress): respect Accept-Encoding when encoding option is set
by <a href="https://github.com/LeSingh1"><code>@​LeSingh1</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4951">honojs/hono#4951</a></li>
<li>fix(deno): echo negotiated WebSocket subprotocol in upgrade response
by <a href="https://github.com/ATOM00blue"><code>@​ATOM00blue</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4955">honojs/hono#4955</a></li>
<li>feat: add msgpack as a compressible content type by <a
href="https://github.com/na-trium-144"><code>@​na-trium-144</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4957">honojs/hono#4957</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/renatograsso10"><code>@​renatograsso10</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4912">honojs/hono#4912</a></li>
<li><a href="https://github.com/LeSingh1"><code>@​LeSingh1</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4951">honojs/hono#4951</a></li>
<li><a
href="https://github.com/ATOM00blue"><code>@​ATOM00blue</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4955">honojs/hono#4955</a></li>
<li><a
href="https://github.com/na-trium-144"><code>@​na-trium-144</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4957">honojs/hono#4957</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.21...v4.12.22">https://github.com/honojs/hono/compare/v4.12.21...v4.12.22</a></p>
<h2>v4.12.21</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>app.mount() strips mount prefix using undecoded path, causing
incorrect routing for percent-encoded paths</h3>
<p>Affects: <code>app.mount()</code>. Fixes prefix stripping using the
raw URL pathname instead of the decoded path, where percent-encoded
characters in the mount prefix or path could cause the prefix to be
removed at the wrong position, resulting in the sub-application
receiving an incorrect path. GHSA-2gcr-mfcq-wcc3</p>
<h3>IP Restriction bypasses static deny rules for non-canonical
IPv6</h3>
<p>Affects: <code>hono/ip-restriction</code>. Fixes IP address
comparison using string equality, where non-canonical IPv6
representations of a denied address — such as compressed forms or
hex-notation IPv4-mapped addresses — could bypass static deny rules.
GHSA-xrhx-7g5j-rcj5</p>
<h3>Cookie helper does not sanitize sameSite and priority, allowing
Set-Cookie injection</h3>
<p>Affects: <code>hono/cookie</code>. Fixes missing validation of
<code>sameSite</code> and <code>priority</code> options against
injection characters (<code>;</code>, <code>\r</code>, <code>\n</code>),
where user-controlled input passed to either option could inject
additional attributes into the Set-Cookie response header.
GHSA-3hrh-pfw6-9m5x</p>
<h3>JWT middleware accepts any Authorization scheme, not only
Bearer</h3>
<p>Affects: <code>hono/jwt</code>, <code>hono/jwk</code>. Fixes missing
scheme validation in the Authorization header, where any two-part header
value was accepted regardless of the scheme name, allowing non-Bearer
schemes to pass JWT authentication. GHSA-f577-qrjj-4474</p>
<hr />
<p>Users who use <code>app.mount()</code>,
<code>hono/ip-restriction</code>, <code>hono/cookie</code>, or
<code>hono/jwt</code>/<code>hono/jwk</code> are encouraged to upgrade to
this version.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/83bfb3bb4a12c1d92c163a39e907df5d662ff78d"><code>83bfb3b</code></a>
4.12.23</li>
<li><a
href="https://github.com/honojs/hono/commit/bcd290a64c0b392fd06d2bd1f256c5dc9835e4a4"><code>bcd290a</code></a>
fix(utils/ipaddr): do not compress a single 0 group to <code>::</code>
(<a
href="https://redirect.github.com/honojs/hono/issues/4971">#4971</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/c968177d9c11ddc7c7cca57c384497f11a6d60ae"><code>c968177</code></a>
feat(compress): add contentTypeFilter option and
`COMPRESSIBLE_CONTENT_TYPE_R...</li>
<li><a
href="https://github.com/honojs/hono/commit/0265a5453a7c272417eaa22b93d3fb319d2188ed"><code>0265a54</code></a>
docs(contribution): add AI Usage Policy (<a
href="https://redirect.github.com/honojs/hono/issues/4970">#4970</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/c84c5d2d46ca6a78c316529491d42ab7bb956368"><code>c84c5d2</code></a>
feat(context): export the Context class publicly (<a
href="https://redirect.github.com/honojs/hono/issues/4543">#4543</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/82dad6297c90c33c41bf48b4530509a21588ad06"><code>82dad62</code></a>
fix(serve-static): normalize all backslashes in file paths, not just the
firs...</li>
<li><a
href="https://github.com/honojs/hono/commit/2f01b774b168911d24e4864fb66054f5de9d9a4e"><code>2f01b77</code></a>
4.12.22</li>
<li><a
href="https://github.com/honojs/hono/commit/6bc0dff277684ee50ace6dc87a7ad73a9c131c99"><code>6bc0dff</code></a>
feat: add msgpack as a compressible content type (<a
href="https://redirect.github.com/honojs/hono/issues/4957">#4957</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/7e0555d14c72d4204347ac9afaae32ba5c013ab9"><code>7e0555d</code></a>
fix(deno): echo negotiated WebSocket subprotocol in upgrade response (<a
href="https://redirect.github.com/honojs/hono/issues/4955">#4955</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/f0ed2465913f2a89ebdf65cc54d6254915fc3ff6"><code>f0ed246</code></a>
fix(compress): respect Accept-Encoding when encoding option is set (<a
href="https://redirect.github.com/honojs/hono/issues/4951">#4951</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.18...v4.12.23">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.18&new-version=4.12.23)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/azure-devops-mcp/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Correct spelling in documentation and codebase comments.

## GitHub issue number

N/A

## **Associated Risks**

N/A

## ✅ **PR Checklist**

- [X] **I have read the [contribution
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CONTRIBUTING.md)**
- [X] **I have read the [code of conduct
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CODE_OF_CONDUCT.md)**
- [X] Title of the pull request is clear and informative.
- [X] 👌 Code hygiene
- [X] 🔭 Telemetry added, updated, or N/A
- [X] 📄 Documentation added, updated, or N/A
- [X] 🛡️ Automated tests added, or N/A

## 🧪 **How did you test it?**

N/A

Signed-off-by: vladdoster <vladislav.doster@icloud.com>
Co-authored-by: Dan Hellem <dahellem@microsoft.com>
….3 (microsoft#1256)

Bumps
[azure-devops-extension-api](https://github.com/Microsoft/azure-devops-extension-api)
from 4.270.0 to 5.272.3.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/f59100aba6e070ffb36256002409dc8267187d4b"><code>f59100a</code></a>
Merge pull request <a
href="https://redirect.github.com/Microsoft/azure-devops-extension-api/issues/202">#202</a>
from microsoft/users/clipskey/remove-top-level-types</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/c79a377aa4ad2ce0b977336b02e568f8d45dae9c"><code>c79a377</code></a>
Removes top-level types from package.json; removes reference usage in
index.d.ts</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/2aee9218c392535349e9ddc4a13a4ff984a07107"><code>2aee921</code></a>
Merge pull request <a
href="https://redirect.github.com/Microsoft/azure-devops-extension-api/issues/201">#201</a>
from microsoft/releases/5.272.2</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/ce46bd684cbee8d9a48c3bf71f7fdf714b2b00e5"><code>ce46bd6</code></a>
Merge pull request <a
href="https://redirect.github.com/Microsoft/azure-devops-extension-api/issues/200">#200</a>
from microsoft/users/clipskey/use-references-for-docs</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/f0be856d58b7db4fb9eef5f80152f9294a97ac62"><code>f0be856</code></a>
Merge pull request <a
href="https://redirect.github.com/Microsoft/azure-devops-extension-api/issues/200">#200</a>
from microsoft/users/clipskey/use-references-for-docs</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/bdff8e3f2c311ed128efb0544f50262e24a74f3c"><code>bdff8e3</code></a>
Makes comments a little more concise</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/b55c5b9b64da5acad04d1142838ce1a6b04ef94e"><code>b55c5b9</code></a>
Fixes issue with buildpackage.js</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/6ad4f6470cbb36933308419389049cc0cf4b7ba9"><code>6ad4f64</code></a>
Adds TS ///references to .d.ts for docs pipeline</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/dd4a9496c2eb4629ad08046f45f352b9a54ba80a"><code>dd4a949</code></a>
Merge pull request <a
href="https://redirect.github.com/Microsoft/azure-devops-extension-api/issues/199">#199</a>
from microsoft/releases/5.272.1</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/757b445da0ee1388c41cf21bca7569b2f694d725"><code>757b445</code></a>
Merge pull request <a
href="https://redirect.github.com/Microsoft/azure-devops-extension-api/issues/198">#198</a>
from microsoft/users/clipskey/fix-buildpackage-for-do...</li>
<li>Additional commits viewable in <a
href="https://github.com/Microsoft/azure-devops-extension-api/compare/4.270.0...5.272.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=azure-devops-extension-api&package-manager=npm_and_yarn&previous-version=4.270.0&new-version=5.272.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Hellem <dahellem@microsoft.com>
Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from
17.0.5 to 17.0.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/releases">lint-staged's
releases</a>.</em></p>
<blockquote>
<h2>v17.0.7</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1806">#1806</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/e692e58ced9eae65b2077435b7e799c632f3db07"><code>e692e58</code></a>
- Update dependency <code>tinyexec@^1.2.4</code>.</li>
</ul>
<h2>v17.0.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1803">#1803</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/bdf27700a6e25b40333672eef4d438984a2d0383"><code>bdf2770</code></a>
- Run all tests with <a href="https://deno.com">Deno</a>, in addition to
Node.js and Bun.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1796">#1796</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/75082727cdd070adb59d62c9040515da3bbbb2f9"><code>7508272</code></a>
- Fix performance regression of <em>lint-staged</em> v17 by going back
to using <code>git add</code> to stage task modifications. This was
changed to <code>git update-index --again</code> in v17 for less manual
work, but unfortunately the <code>update-index</code> command gets
slower in very large Git repos.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1797">#1797</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/7b2505a1f8fb8735e6306c7dabdd5295632f8c1a"><code>7b2505a</code></a>
- This version of <em>lint-staged</em> uses the new <a
href="https://docs.npmjs.com/staged-publishing">staged publishing for
npm packages</a> feature. Releases are already published from GitHub
Actions with <a href="https://docs.npmjs.com/trusted-publishers">trusted
publishing</a>, but now an additional approval with two-factor
authentication is also required.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1802">#1802</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/321b0a972a434006f5b5fac18867974ef040d037"><code>321b0a9</code></a>
- Downgrade dependency <code>tinyexec@1.2.2</code> to avoid issues in
version 1.2.3.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's
changelog</a>.</em></p>
<blockquote>
<h2>17.0.7</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1806">#1806</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/e692e58ced9eae65b2077435b7e799c632f3db07"><code>e692e58</code></a>
- Update dependency <code>tinyexec@^1.2.4</code>.</li>
</ul>
<h2>17.0.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1803">#1803</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/bdf27700a6e25b40333672eef4d438984a2d0383"><code>bdf2770</code></a>
- Run all tests with <a href="https://deno.com">Deno</a>, in addition to
Node.js and Bun.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1796">#1796</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/75082727cdd070adb59d62c9040515da3bbbb2f9"><code>7508272</code></a>
- Fix performance regression of <em>lint-staged</em> v17 by going back
to using <code>git add</code> to stage task modifications. This was
changed to <code>git update-index --again</code> in v17 for less manual
work, but unfortunately the <code>update-index</code> command gets
slower in very large Git repos.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1797">#1797</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/7b2505a1f8fb8735e6306c7dabdd5295632f8c1a"><code>7b2505a</code></a>
- This version of <em>lint-staged</em> uses the new <a
href="https://docs.npmjs.com/staged-publishing">staged publishing for
npm packages</a> feature. Releases are already published from GitHub
Actions with <a href="https://docs.npmjs.com/trusted-publishers">trusted
publishing</a>, but now an additional approval with two-factor
authentication is also required.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1802">#1802</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/321b0a972a434006f5b5fac18867974ef040d037"><code>321b0a9</code></a>
- Downgrade dependency <code>tinyexec@1.2.2</code> to avoid issues in
version 1.2.3.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/cd11fec419c59b4900aab194f288adf6bb4afdd1"><code>cd11fec</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1807">#1807</a>
from lint-staged/changeset-release/main</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/15a8ee0df4ffb4c6fc65ea6828133cc32740c9c4"><code>15a8ee0</code></a>
chore(changeset): release</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/797bbd943a7adab888640915449c09b8a67cc11d"><code>797bbd9</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1808">#1808</a>
from lint-staged/add-stashing-faq</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/504e307c819a8b2decdf6c791d5350c4db0b15ed"><code>504e307</code></a>
docs: add FAQ entry on how stashing works</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/eff5cd19633ce51ca62ac17a9e66d972a2aaf104"><code>eff5cd1</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1806">#1806</a>
from lint-staged/update-tinyexec</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/e692e58ced9eae65b2077435b7e799c632f3db07"><code>e692e58</code></a>
build(deps): update <code>tinyexec@^1.2.4</code></li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/a2dd4ea97b1ff36486d88d9bad285834acef7ea6"><code>a2dd4ea</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1805">#1805</a>
from lint-staged/update-github-templates</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/c92851945ff4fa604841e53fe044b47177b159b8"><code>c928519</code></a>
docs: update GitHub templates</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/094ba56a3caeeda2cf83ad0a0c83df38ab2f6d06"><code>094ba56</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1798">#1798</a>
from lint-staged/changeset-release/main</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/88e19fe3d81b8e1516564e7afaf6681f09f83b16"><code>88e19fe</code></a>
chore(changeset): release</li>
<li>Additional commits viewable in <a
href="https://github.com/lint-staged/lint-staged/compare/v17.0.5...v17.0.7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lint-staged&package-manager=npm_and_yarn&previous-version=17.0.5&new-version=17.0.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- When adding a suggestion through `create_pull_request_thread` in PR's,
sometimes the tool collects the length of the `suggested_content` and
marks the comment to that portion of the line which ends up being
different from the user's intent.


_Example:_

```
Actual Line:      - //padding: functions.toRem(8) functions.toRem(16);
SuggestedContent: + padding: functions.toRem(8) functions.toRem(16);6);
```

- Also the API used for creating this considers the rightFileEndOffset
as an exclusive value and ignores the character in last position

<img width="900" height="297" alt="image"
src="https://github.com/user-attachments/assets/8e008c0f-d3e4-47c6-8333-2c9d800e8f24"
/>
<img width="621" height="125" alt="image"
src="https://github.com/user-attachments/assets/36790083-c446-4dc2-890f-d93d4377b6cf"
/>


The offset used here is 13 even though the line's character length is
12.

## Fix

Updated the description of parameter to consider both of this while
finding the value of `RightEndFileOffset`

## GitHub issue number

1265

## **Associated Risks**

- The MCP Client missing the instructions in the description

## ✅ **PR Checklist**

- [X] **I have read the [contribution
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CONTRIBUTING.md)**
- [X] **I have read the [code of conduct
guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CODE_OF_CONDUCT.md)**
- [X] Title of the pull request is clear and informative.
- [X] 👌 Code hygiene
- [ ] 🔭 Telemetry added, updated, or N/A
- [ ] 📄 Documentation added, updated, or N/A
- [ ] 🛡️ Automated tests added, or N/A

## 🧪 **How did you test it?**

Manually tested by trying to tell it to add a suggestion comment.

Co-authored-by: Krishna Prasath D <krid@microsoft.com>
Co-authored-by: Dan Hellem <dahellem@microsoft.com>
…ft#1339)

Bumps
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)
from 8.59.2 to 8.61.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's
releases</a>.</em></p>
<blockquote>
<h2>v8.61.0</h2>
<h2>8.61.0 (2026-06-08)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>ast-spec:</strong> change type of
<code>UnaryExpression.prefix</code> to always <code>true</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12372">#12372</a>)</li>
<li><strong>ast-spec:</strong> tighten types of
<code>ArrowFunction</code>, <code>YieldExpression</code>,
<code>TSTypePredicate</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12373">#12373</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>rule-schema-to-typescript-types:</strong> respect ECMAScript
line terminators (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12374">#12374</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a></li>
<li>lumir</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>v8.60.1</h2>
<h2>8.60.1 (2026-06-01)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> respect ECMAScript line terminators
in ts-comment rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12352">#12352</a>)</li>
<li><strong>eslint-plugin:</strong> [no-shadow] correct rule to match
ESLint v10 handling (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12182">#12182</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>lumir</li>
<li>Nevette Bailey <a
href="https://github.com/nevette-bailey"><code>@​nevette-bailey</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.1">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>v8.60.0</h2>
<h2>8.60.0 (2026-05-25)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>rule-tester:</strong> added updates of RuleTester from
upstream (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12291">#12291</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li>playground TS version selector is not working (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12326">#12326</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12325">#12325</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's
changelog</a>.</em></p>
<blockquote>
<h2>8.61.0 (2026-06-08)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.60.1 (2026-06-01)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.1">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.60.0 (2026-05-25)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.59.4 (2026-05-18)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>typescript-eslint:</strong> export Compatible* types from
typescript-eslint to resolve pnpm TS error (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12340">#12340</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.4">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
<h2>8.59.3 (2026-05-11)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.3">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/16a5b247affc32af21b695cf96dfd75d7ded50a3"><code>16a5b24</code></a>
chore(release): publish 8.61.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4f84a697aedc436559c3ae09b5b357d98b448d68"><code>4f84a69</code></a>
chore(release): publish 8.60.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1849b530c254fb4f89d7270160f3a998e4acd964"><code>1849b53</code></a>
chore: typecheck using tsgo (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint/issues/12139">#12139</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f891c29de5f3e23f3d8c59cc599d3196e54e9b58"><code>f891c29</code></a>
chore(release): publish 8.60.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/ca6ca1431b6d18235297a7e29feb5d98f012dff2"><code>ca6ca14</code></a>
chore(release): publish 8.59.4</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4b927c607755b2648d5854b9e928c1dbb2b8e088"><code>4b927c6</code></a>
fix(typescript-eslint): export Compatible* types from typescript-eslint
to re...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/48e13c0261e3cb1bf4f4dfaa462cdb3a56ef7383"><code>48e13c0</code></a>
chore(release): publish 8.59.3</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/44f9625336841a8ee3eb01a9e02e49b1d7b12648"><code>44f9625</code></a>
chore(deps): update vitest monorepo to v4.1.5 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint/issues/12307">#12307</a>)</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.0/packages/typescript-eslint">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typescript-eslint&package-manager=npm_and_yarn&previous-version=8.59.2&new-version=8.61.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Hellem <dahellem@microsoft.com>
…1331)

Bumps
[@azure/msal-node](https://github.com/AzureAD/microsoft-authentication-library-for-js)
from 5.2.2 to 5.2.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/releases">@​azure/msal-node's
releases</a>.</em></p>
<blockquote>
<h2><code>@​azure/msal-angular</code> v5.2.3</h2>
<h2>5.2.3</h2>
<p>Thu, 07 May 2026 19:01:04 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-browser</code> to v5.10.0 (beachball)</li>
</ul>
<h2><code>@​azure/msal-node-extensions</code> v5.2.3</h2>
<h2>5.2.3</h2>
<p>Fri, 05 Jun 2026 22:24:22 GMT</p>
<h3>Patches</h3>
<ul>
<li>fix: set restrictive file permissions in FilePersistence <a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/pull/8623">#8623</a>
(<a
href="mailto:thomas.norling@microsoft.com">thomas.norling@microsoft.com</a>)</li>
<li>bump msal-common to version 16.6.3 <a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/pull/8622">#8622</a>
(<a
href="mailto:lalimasharda@microsoft.com">lalimasharda@microsoft.com</a>)</li>
<li>Bump <code>@​azure/msal-common</code> to v16.7.0 (beachball)</li>
</ul>
<h2><code>@​azure/msal-node</code> v5.2.3</h2>
<h2>5.2.3</h2>
<p>Fri, 05 Jun 2026 22:24:22 GMT</p>
<h3>Patches</h3>
<ul>
<li>bump msal-common to version 16.6.3 <a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/pull/8622">#8622</a>
(<a
href="mailto:lalimasharda@microsoft.com">lalimasharda@microsoft.com</a>)</li>
<li>Bump <code>@​azure/msal-common</code> to v16.7.0 (beachball)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/7588af34d25beca61640567b526de3e8aa682d3d"><code>7588af3</code></a>
fix ui_not_allowed naming while preserving ux_not_allowed compatibility
(<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8608">#8608</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/37c7d2ae5dbc192d4957b12a4a938235b0796126"><code>37c7d2a</code></a>
fix: set restrictive file permissions in FilePersistence (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8623">#8623</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/485552fe2c6f2e72dff24399451e5d887c5b132f"><code>485552f</code></a>
Post release PR for msal-common (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8622">#8622</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/d2378a2784e1178c09a2c9e34a78f5eaa0963a9c"><code>d2378a2</code></a>
fix: set document.title during authentication redirects (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8624">#8624</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/3469d151fc0bdac2c51a56da6dbfbf01d334e90e"><code>3469d15</code></a>
Fix/clear stale encrypted cache entries (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8619">#8619</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/bc0b34037bc45179da7c9ab1270a76ef8494af7d"><code>bc0b340</code></a>
fix: inverted username filter in CacheManager (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8621">#8621</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/f96b364dcc4ebab05897c030730914ada8e017d9"><code>f96b364</code></a>
Add PCA functions for custom authentication response handling (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8590">#8590</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/4e18c5c47314b5d2a829fa1ae8b851d45617f134"><code>4e18c5c</code></a>
fix: respect redirectStartPage in
PlatformAuthInteractionClient.acquireTokenR...</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/08a223661d59eff3020e88e9d6b025fd404a2ca6"><code>08a2236</code></a>
Post-release PR (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8596">#8596</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/cf5eb296289e2445aee4031c768905b89ab5da16"><code>cf5eb29</code></a>
fix: add knownAuthorities check to issuer validation for CIAM GUID-based
issu...</li>
<li>See full diff in <a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/compare/msal-node-v5.2.2...msal-node-v5.2.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@azure/msal-node&package-manager=npm_and_yarn&previous-version=5.2.2&new-version=5.2.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Hellem <dahellem@microsoft.com>
….0 (microsoft#1346)

Bumps
[azure-devops-extension-api](https://github.com/Microsoft/azure-devops-extension-api)
from 5.272.3 to 5.273.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/dd900e7a8a0b50a895cad3bdf404d889cea58064"><code>dd900e7</code></a>
All files have been added to the repo</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/b526e4e7026edc777b9e030fbb3dddf692f095c5"><code>b526e4e</code></a>
Merge pull request <a
href="https://redirect.github.com/Microsoft/azure-devops-extension-api/issues/203">#203</a>
from microsoft/releases/5.272.3</li>
<li><a
href="https://github.com/microsoft/azure-devops-extension-api/commit/70a53aed1a2b0fdd157e792b37f802e525efee94"><code>70a53ae</code></a>
Merge pull request <a
href="https://redirect.github.com/Microsoft/azure-devops-extension-api/issues/202">#202</a>
from microsoft/users/clipskey/remove-top-level-types</li>
<li>See full diff in <a
href="https://github.com/Microsoft/azure-devops-extension-api/compare/5.272.3...5.273.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=azure-devops-extension-api&package-manager=npm_and_yarn&previous-version=5.272.3&new-version=5.273.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1349)

Bumps
[@azure/msal-node](https://github.com/AzureAD/microsoft-authentication-library-for-js)
from 5.2.3 to 5.2.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/releases">@​azure/msal-node's
releases</a>.</em></p>
<blockquote>
<h2><code>@​azure/msal-angular</code> v5.2.4</h2>
<h2>5.2.4</h2>
<p>Mon, 11 May 2026 21:48:15 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-browser</code> to v5.10.1 (beachball)</li>
</ul>
<h2><code>@​azure/msal-node-extensions</code> v5.2.4</h2>
<h2>5.2.4</h2>
<p>Wed, 10 Jun 2026 22:41:34 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-common</code> to v16.8.0 (beachball)</li>
</ul>
<h2><code>@​azure/msal-node</code> v5.2.4</h2>
<h2>5.2.4</h2>
<p>Wed, 10 Jun 2026 22:41:34 GMT</p>
<h3>Patches</h3>
<ul>
<li>Bump <code>@​azure/msal-common</code> to v16.8.0 (beachball)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/faa42ab972f7388b7c4e583b90049006d82dfb79"><code>faa42ab</code></a>
Fix migration readme (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8602">#8602</a>)
(<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8638">#8638</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/b8b8da9b0a77a9672b81d4c7b15453455f29c4fd"><code>b8b8da9</code></a>
Fix duplicate redirect flows clearing in-flight interaction state (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8637">#8637</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/772c6b649cc9d9d29e487ee665e6155b6ffe59d7"><code>772c6b6</code></a>
Fix silent iframe redirect-bridge listener race condition (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8636">#8636</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/5c7f98621cbe22854419206fac316b8ace45cae9"><code>5c7f986</code></a>
Use in-built URL API to perform URL comparisons adhering to correct MDN
and R...</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/eebac5092e602aed3f671d437d226a15afcfdc16"><code>eebac50</code></a>
feat: add per-type migration telemetry counters (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8628">#8628</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/2e5a3bd6db2a480665dd4e549b2e66186e9a8e29"><code>2e5a3bd</code></a>
Add browser-specific guidance across msal-browser docs (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8631">#8631</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/343d36e0fc3e15890fcdcc67d11aac7d18793af1"><code>343d36e</code></a>
Disable ServerTelemetryManager by default (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8600">#8600</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/891ee17bce826ea3d380d7de24819f2a309e5458"><code>891ee17</code></a>
Fix correlation cache empty key eviction (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8627">#8627</a>)</li>
<li><a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/188a2fc299e405b0913bfe107b7e92696df74881"><code>188a2fc</code></a>
Post-release PR (<a
href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8632">#8632</a>)</li>
<li>See full diff in <a
href="https://github.com/AzureAD/microsoft-authentication-library-for-js/compare/msal-node-v5.2.3...msal-node-v5.2.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@azure/msal-node&package-manager=npm_and_yarn&previous-version=5.2.3&new-version=5.2.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@azure/msal-common 16.8.0 🟢 6.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 9branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@azure/msal-node 5.2.4 🟢 6.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 9branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@babel/helper-plugin-utils 7.29.7 🟢 7.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 28/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 2badge detected: InProgress
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@babel/plugin-syntax-jsx 7.29.7 🟢 7.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 28/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 2badge detected: InProgress
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@babel/plugin-syntax-typescript 7.29.7 🟢 7.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 28/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 2badge detected: InProgress
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@emnapi/core 1.10.0 🟢 3.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1026 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/runtime 1.10.0 🟢 3.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1026 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/wasi-threads 1.2.1 🟢 3.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1026 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@jest/console 30.4.1 UnknownUnknown
npm/@jest/core 30.4.2 UnknownUnknown
npm/@jest/diff-sequences 30.4.0 UnknownUnknown
npm/@jest/environment 30.4.1 UnknownUnknown
npm/@jest/expect 30.4.1 UnknownUnknown
npm/@jest/expect-utils 30.4.1 UnknownUnknown
npm/@jest/fake-timers 30.4.1 UnknownUnknown
npm/@jest/globals 30.4.1 UnknownUnknown
npm/@jest/pattern 30.4.0 UnknownUnknown
npm/@jest/reporters 30.4.1 UnknownUnknown
npm/@jest/schemas 30.4.1 UnknownUnknown
npm/@jest/snapshot-utils 30.4.1 UnknownUnknown
npm/@jest/test-result 30.4.1 UnknownUnknown
npm/@jest/test-sequencer 30.4.1 UnknownUnknown
npm/@jest/transform 30.4.1 UnknownUnknown
npm/@jest/types 30.4.1 UnknownUnknown
npm/@napi-rs/wasm-runtime 1.1.4 🟢 5.1
Details
CheckScoreReason
Code-Review⚠️ 1Found 3/23 approved changesets -- score normalized to 1
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@pkgr/core 0.3.6 UnknownUnknown
npm/@sinonjs/fake-timers 15.4.0 🟢 5.7
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 1Found 5/27 approved changesets -- score normalized to 1
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@tybys/wasm-util 0.10.2 UnknownUnknown
npm/@typescript-eslint/eslint-plugin 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/parser 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/project-service 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/scope-manager 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/tsconfig-utils 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/type-utils 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/types 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/typescript-estree 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/utils 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/visitor-keys 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@unrs/resolver-binding-android-arm-eabi 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-android-arm64 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-darwin-arm64 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-darwin-x64 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-freebsd-x64 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-arm-gnueabihf 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-arm-musleabihf 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-arm64-gnu 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-arm64-musl 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-loong64-gnu 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-loong64-musl 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-ppc64-gnu 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-riscv64-gnu 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-riscv64-musl 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-s390x-gnu 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-x64-gnu 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-linux-x64-musl 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-openharmony-arm64 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-wasm32-wasi 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-win32-arm64-msvc 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-win32-ia32-msvc 1.12.2 UnknownUnknown
npm/@unrs/resolver-binding-win32-x64-msvc 1.12.2 UnknownUnknown
npm/azure-devops-extension-api 5.273.0 UnknownUnknown
npm/babel-jest 30.4.1 UnknownUnknown
npm/babel-plugin-jest-hoist 30.4.0 UnknownUnknown
npm/babel-preset-jest 30.4.0 UnknownUnknown
npm/brace-expansion 2.1.1 🟢 7.3
Details
CheckScoreReason
Maintained🟢 1010 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 4Found 9/22 approved changesets -- score normalized to 4
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/brace-expansion 5.0.6 🟢 7.3
Details
CheckScoreReason
Maintained🟢 1010 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 4Found 9/22 approved changesets -- score normalized to 4
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/expect 30.4.1 UnknownUnknown
npm/hono 4.12.23 UnknownUnknown
npm/jest 30.4.2 UnknownUnknown
npm/jest-changed-files 30.4.1 UnknownUnknown
npm/jest-circus 30.4.2 UnknownUnknown
npm/jest-cli 30.4.2 UnknownUnknown
npm/jest-config 30.4.2 UnknownUnknown
npm/jest-diff 30.4.1 UnknownUnknown
npm/jest-docblock 30.4.0 UnknownUnknown
npm/jest-each 30.4.1 UnknownUnknown
npm/jest-environment-node 30.4.1 UnknownUnknown
npm/jest-haste-map 30.4.1 UnknownUnknown
npm/jest-leak-detector 30.4.1 UnknownUnknown
npm/jest-matcher-utils 30.4.1 UnknownUnknown
npm/jest-message-util 30.4.1 UnknownUnknown
npm/jest-mock 30.4.1 UnknownUnknown
npm/jest-regex-util 30.4.0 UnknownUnknown
npm/jest-resolve 30.4.1 UnknownUnknown
npm/jest-resolve-dependencies 30.4.2 UnknownUnknown
npm/jest-runner 30.4.2 UnknownUnknown
npm/jest-runtime 30.4.2 UnknownUnknown
npm/jest-snapshot 30.4.1 UnknownUnknown
npm/jest-util 30.4.1 UnknownUnknown
npm/jest-validate 30.4.1 UnknownUnknown
npm/jest-watcher 30.4.1 UnknownUnknown
npm/jest-worker 30.4.1 UnknownUnknown
npm/lint-staged 17.0.7 UnknownUnknown
npm/pretty-format 30.4.1 UnknownUnknown
npm/qs 6.15.2 🟢 5.4
Details
CheckScoreReason
Code-Review⚠️ 2Found 6/30 approved changesets -- score normalized to 2
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1015 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices🟢 5badge detected: Passing
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/react-is-18 18.3.1 UnknownUnknown
npm/react-is-19 19.2.7 UnknownUnknown
npm/semver 7.8.3 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 14/18 approved changesets -- score normalized to 7
Maintained🟢 1017 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST🟢 9SAST tool detected but not run on all commits
npm/semver 7.8.1 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 7Found 14/18 approved changesets -- score normalized to 7
Maintained🟢 1017 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST🟢 9SAST tool detected but not run on all commits
npm/synckit 0.11.13 UnknownUnknown
npm/tinyexec 1.2.4 UnknownUnknown
npm/tinyglobby 0.2.17 UnknownUnknown
npm/ts-jest 29.4.11 🟢 5.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
npm/typescript-eslint 8.61.0 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/unrs-resolver 1.12.2 UnknownUnknown
npm/yaml 2.9.0 🟢 7.2
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/11 approved changesets -- score normalized to 0
Maintained🟢 1021 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 10SAST tool is run on all commits

Scanned Files

  • package-lock.json

@gadeynebram gadeynebram merged commit c7ceda7 into main Jun 15, 2026
2 checks passed
@gadeynebram gadeynebram deleted the sync/upstream-20260615 branch June 15, 2026 14:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants