chore(deps-dev): Bump node-red from 5.0.4 to 5.0.7 by dependabot[bot] · Pull Request #516 · windkh/node-red-contrib-telegrambot

dependabot · 2026-09-06T00:42:40Z

Bumps node-red from 5.0.4 to 5.0.7.

Release notes

5.0.7: Maintenance Release

What's Changed

docs: clarify settings.js nodesDir accepts an array of paths by @Bryandero98 in node-red/node-red#5925

Migrate to patched JSONata by @knolleary in node-red/node-red#5933

fix(editor): make disabled wires visible in dark theme by @Bryandero98 in node-red/node-red#5926

Fix file in completion after filename evaluation error by @R0CKing666 in node-red/node-red#5931

Fix incorrect rendering of typedInput with a single type by @GogoVega in node-red/node-red#5934

Update body-parser by @knolleary in node-red/node-red#5935

Bump for 5.0.7 by @knolleary in node-red/node-red#5936

New Contributors

@Bryandero98 made their first contribution in node-red/node-red#5925

@R0CKing666 made their first contribution in node-red/node-red#5931

Full Changelog: node-red/node-red@5.0.6...5.0.7

5.0.6: Maintenance Release

What's Changed

Bump for 5.0.6 by @knolleary in node-red/node-red#5921

Reverts @node-rs/bcrypt update due to compatibility issues on certain RaspberryPi Architectures/OSs - #5919

Full Changelog: node-red/node-red@5.0.5...5.0.6

5.0.5: Maintenance Release

What's Changed

Fix group default fill and fill opacity values by @bonanitech in node-red/node-red#5878

Ensure multiplayer event properties are valid by @knolleary in node-red/node-red#5898

Fix uncaught exception in json node for malformed JSON string with schema + action=str by @karthikchundi-commits in node-red/node-red#5905

Fix tlsConfigDisableLocalFiles by @hardillb in node-red/node-red#5904

Remove broken stars chart by @hardillb in node-red/node-red#5900

Update jsonata 2.2.2 by @knolleary in node-red/node-red#5915

Update dependencies by @knolleary in node-red/node-red#5916

Bump for 5.0.5 release by @knolleary in node-red/node-red#5917

New Contributors

@karthikchundi-commits made their first contribution in node-red/node-red#5905

Full Changelog: node-red/node-red@5.0.4...5.0.5

Changelog

Sourced from node-red's changelog.

5.0.7: Maintenance Release

Fix incorrect rendering of typedInput with a single type (#5934) @GogoVega

Update body-parser (#5935) @knolleary

docs: clarify settings.js nodesDir accepts an array of paths (#5925) @Bryandero98

Fix file in completion after filename evaluation error (#5931) @R0CKing666

fix(editor): make disabled wires visible in dark theme (#5926) @Bryandero98

Migrate to patched JSONata (#5933) @knolleary

5.0.6: Maintenance Release

Revert @node-rs/bcrypt update due to OS/arch compatibility issues

5.0.5: Maintenance Release

Update dependencies (#5916) @knolleary

Fix uncaught exception in json node for malformed JSON string with schema + action=str (#5905) @karthikchundi-commits

Update jsonata 2.2.2 (#5915) @knolleary

Remove broken stars chart (#5900) @hardillb

Fix tlsConfigDisableLocalFiles (#5904) @hardillb

Ensure multiplayer event properties are valid (#5898) @knolleary

Fix group default fill and fill opacity values (#5878) @bonanitech

Commits

d9644c4 Merge pull request #5936 from node-red/rel507
4b48745 Update changelog
1394534 Merge pull request #5934 from GogoVega/fix-5698-typedInput-render
a55e6fc Bump for 5.0.7
7d229f2 Update body-parser
f435a0b Fix incorrect rendering of typedInput with a single type
95dcd47 Merge pull request #5931 from R0CKing666/fix/file-in-jsonata-done-5928
737ab97 Merge pull request #5926 from Bryandero98/fix/dark-mode-disabled-wire-visibility
53a5c30 Merge pull request #5933 from node-red/patch-jsonata
dfb760f Remove only test modifier
Additional commits viewable in compare view

github-actions · 2026-09-06T00:42:52Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@node-red/editor-api

5.0.7

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@node-red/editor-client

5.0.7

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@node-red/nodes

5.0.7

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@node-red/registry

5.0.7

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@node-red/runtime

5.0.7

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@node-red/util

5.0.7

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/node

22.20.2

🟢 6.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/body-parser

1.20.8

🟢 7.9

Details

Check	Score	Reason
Dependency-Update-Tool	🟢 10	update tool detected
Code-Review	🟢 7	Found 15/21 approved changesets -- score normalized to 7
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	20 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
SAST	🟢 9	SAST tool detected but not run on all commits
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 10	license file detected
Branch-Protection	⚠️ 1	branch protection is not maximal on development and all release branches
CI-Tests	🟢 9	28 out of 29 merged PRs checked by a CI test -- score normalized to 9
Contributors	🟢 10	project has 32 contributing companies or organizations

npm/brace-expansion

5.0.9

🟢 7.2

Details

Check	Score	Reason
Code-Review	🟢 3	Found 6/16 approved changesets -- score normalized to 3
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	22 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/ip-address

10.5.0

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/js-yaml

4.3.2

🟢 6

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Security-Policy	🟢 4	security policy file detected

npm/libnpmpack

9.1.13

🟢 6.8

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 9	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 9	SAST tool detected but not run on all commits

npm/multer

2.3.0

🟢 8

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/30 approved changesets -- score normalized to 8
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
Maintained	🟢 10	30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
SAST	🟢 9	SAST tool detected but not run on all commits
Packaging	🟢 10	packaging workflow detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
CI-Tests	🟢 9	25 out of 27 merged PRs checked by a CI test -- score normalized to 9
Contributors	🟢 10	project has 68 contributing companies or organizations

npm/node-red

5.0.7

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/npm

11.19.1

🟢 6.8

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 9	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 9	SAST tool detected but not run on all commits

npm/undici

6.28.0

🟢 7.8

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 5	Found 14/25 approved changesets -- score normalized to 5
Binary-Artifacts	🟢 8	binaries present in source code
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Signed-Releases	⚠️ -1	no releases found
Fuzzing	🟢 10	project is fuzzed
Vulnerabilities	🟢 6	4 existing vulnerabilities detected
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests	🟢 10	19 out of 19 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 63 contributing companies or organizations

npm/undici-types

6.21.0

🟢 7.8

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 5	Found 14/25 approved changesets -- score normalized to 5
Binary-Artifacts	🟢 8	binaries present in source code
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Signed-Releases	⚠️ -1	no releases found
Fuzzing	🟢 10	project is fuzzed
Vulnerabilities	🟢 6	4 existing vulnerabilities detected
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests	🟢 10	19 out of 19 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 63 contributing companies or organizations

Scanned Files

package-lock.json

Bumps [node-red](https://github.com/node-red/node-red) from 5.0.4 to 5.0.7. - [Release notes](https://github.com/node-red/node-red/releases) - [Changelog](https://github.com/node-red/node-red/blob/main/CHANGELOG.md) - [Commits](node-red/node-red@5.0.4...5.0.7) --- updated-dependencies: - dependency-name: node-red dependency-version: 5.0.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 6, 2026

dependabot Bot changed the title ~~chore(deps-dev): Bump node-red from 5.0.4 to 5.0.6~~ chore(deps-dev): Bump node-red from 5.0.4 to 5.0.7 Sep 12, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/node-red-5.0.6 branch from 0093c34 to b5739c9 Compare September 12, 2026 20:11

Navigation Menu

Uh oh!

chore(deps-dev): Bump node-red from 5.0.4 to 5.0.7 - #516

chore(deps-dev): Bump node-red from 5.0.4 to 5.0.7#516
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/node-red-5.0.6

dependabot Bot commented on behalf of github Sep 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

5.0.7: Maintenance Release

What's Changed

New Contributors

5.0.6: Maintenance Release

What's Changed

5.0.5: Maintenance Release

What's Changed

New Contributors

5.0.7: Maintenance Release

5.0.6: Maintenance Release

5.0.5: Maintenance Release

Uh oh!

github-actions Bot commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 6, 2026 •

edited

Loading

github-actions Bot commented Sep 6, 2026 •

edited

Loading