chore(deps): Bump the npm-minor-and-patch group across 1 directory with 5 updates

[dependabot]

Bumps the npm-minor-and-patch group with 5 updates in the /service directory:

Package	From	To
@anthropic-ai/sdk	0.131.0	0.133.0
@supabase/supabase-js	2.117.2	2.117.3
express	5.2.1	5.3.0
@types/node	26.6.4	26.6.5
prettier	3.9.9	3.9.10

Updates @anthropic-ai/sdk from 0.131.0 to 0.133.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.133.0

Features

• api: add types for the Chat and Cowork unified analytics metrics
• api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

• internal: remove the next branch rule from CLAUDE.md

sdk-v0.132.1

Bug Fixes

• client: throw before sending a request with an empty path parameter

Chores

• ci: check that pull requests update the changelog
• ci: publish every package from the publish workflow
• docs: note that listing Claude Console spend limits is in early access

Documentation

• split CLAUDE.md into shared, TypeScript, and repository rules

sdk: v0.132.0

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)
• api: add disabled to thinking types in model capabilities (2b75b49)
• api: add display_name to RBAC roles and deprecate name (7735ac3)
• api: add include_default parameter to list workspaces (c4019df)
• api: add lifecycle stage fields and filter to /v1/models (fe8a762)
• api: add line to model objects (018aed4)
• api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)
• api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

• api: send the beta header by default when listing spend limits (8f58ca4)
• client: throw when a JSONL stream is iterated twice (a34266c)
• tools: keep a local edit made after a memory upload whose response was lost (#893) (2b75b49)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.133.0 (2026-10-09)

Features

• api: add types for the Chat and Cowork unified analytics metrics
• api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

• internal: remove the next branch rule from CLAUDE.md

0.132.1 (2026-10-08)

Bug Fixes

• client: throw before sending a request with an empty path parameter

Chores

• ci: check that pull requests update the changelog
• ci: publish every package from the publish workflow
• docs: note that listing Claude Console spend limits is in early access

Documentation

• split CLAUDE.md into shared, TypeScript, and repository rules

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)
• api: add disabled to thinking types in model capabilities (2b75b49)
• api: add display_name to RBAC roles and deprecate name (7735ac3)
• api: add include_default parameter to list workspaces (c4019df)
• api: add lifecycle stage fields and filter to /v1/models (fe8a762)
• api: add line to model objects (018aed4)
• api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)
• api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

• api: send the beta header by default when listing spend limits (8f58ca4)
• client: throw when a JSONL stream is iterated twice (a34266c)

... (truncated)

Commits

• 2979ed5 release: . 0.133.0
• 8486d9b Merge pull request #908 from anthropics/synced/published
• e0995e4 feat(api): add workflows, multiagent configuration and thread status filterin...
• 31eb3be codegen metadata
• 5127b32 codegen metadata
• f702a46 codegen metadata
• d64e976 codegen metadata
• 9f75465 codegen metadata
• 6ec2ea1 chore(internal): remove the next branch rule from CLAUDE.md
• 373c33d codegen metadata
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.117.2 to 2.117.3

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

• deps: bump next to patch RCE in realtime-js example (#2733)
• functions: send a Blob or File with its own content type (#2714)
• postgrest: treat TimeoutError as an abort in retry guard (#2732)
• storage: send multipart fields before files (#2736)

❤️ Thank You

• Bruno Gale @​fresh55
• Ferhat Elmas
• Katerina Skroumpelou @​mandarini

v2.117.3-canary.1

2.117.3-canary.1 (2026-10-07)

🩹 Fixes

• storage: send multipart fields before files (#2736)

❤️ Thank You

• Ferhat Elmas
• Katerina Skroumpelou @​mandarini

v2.117.3-canary.0

2.117.3-canary.0 (2026-10-02)

🩹 Fixes

• deps: bump next to patch RCE in realtime-js example (#2733)
• functions: send a Blob or File with its own content type (#2714)
• postgrest: treat TimeoutError as an abort in retry guard (#2732)

❤️ Thank You

• Bruno Gale @​fresh55
• Katerina Skroumpelou @​mandarini

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.117.3 (2026-10-07)

🩹 Fixes

• storage: send multipart fields before files (#2736)

❤️ Thank You

• Ferhat Elmas
• Katerina Skroumpelou @​mandarini

Commits

• 4d23055 fix(storage): send multipart fields before files (#2736)
• a684cf9 chore(release): version 2.117.2 changelogs (#2707)
• See full diff in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates @types/node from 26.6.4 to 26.6.5

Commits

• See full diff in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/@anthropic-ai/sdk	0.133.0	Unknown	Unknown
npm/@supabase/auth-js	2.117.3	🟢 7.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/@supabase/functions-js	2.117.3	🟢 7.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/@supabase/postgrest-js	2.117.3	🟢 7.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/@supabase/realtime-js	2.117.3	🟢 7.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/@supabase/storage-js	2.117.3	🟢 7.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/@supabase/supabase-js	2.117.3	🟢 7.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/@types/node	26.6.5	🟢 6.6	Details Check Score Reason Code-Review 🟢 9 Found 29/30 approved changesets -- score normalized to 9 Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/content-disposition	2.0.1	🟢 6.8	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 6 Found 20/30 approved changesets -- score normalized to 6 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Maintained 🟢 4 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 3 7 existing vulnerabilities detected Dependency-Update-Tool 🟢 10 update tool detected Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 9 SAST tool detected but not run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches License 🟢 10 license file detected Security-Policy 🟢 9 security policy file detected CI-Tests 🟢 9 25 out of 26 merged PRs checked by a CI test -- score normalized to 9 Contributors 🟢 10 project has 21 contributing companies or organizations
npm/express	5.3.0	🟢 8.9	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 24 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Vulnerabilities 🟢 10 0 existing vulnerabilities detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Signed-Releases ⚠️ -1 no releases found SAST 🟢 10 SAST tool is run on all commits Packaging 🟢 10 packaging workflow detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 108 contributing companies or organizations
npm/prettier	3.9.10	🟢 6.2	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Code-Review 🟢 5 Found 12/23 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• service/package-lock.json

[github-actions]

PR guide

Auto-generated from changed paths. Fill in Summary and How to verify in the PR description above.

Touches: tooling config

Diff: 2 files changed, 62 insertions(+), 97 deletions(-)

Suggested verify

• npm run lint
• npm run format:check
• npm run test:run or targeted Vitest files for the changed area
• npm run build

Checklist (applies to this PR)

• No unintended secrets or local-only config committed

Reviewer focus

• Dependency, Vite, TypeScript, ESLint, and Prettier changes that can affect local and CI runs

Commits

• 372b1a2 chore(deps): Bump the npm-minor-and-patch group across 1 directory with 5 updates

Files by area

Area	Files
tooling config	2

CI

Required checks: verify runs format/lint/audit/typecheck/test/build as separate per-concern checks for every PR. Coverage tables are posted separately.

---

Template: pull_request_template.md

[github-actions]

Lighthouse CI report

• http://localhost:45165/index.html

Thresholds are informational (warn-level) for now; see ./.lighthouserc.json.