Skip to content

chore(deps-dev): bump @vercel/ncc from 0.38.3 to 0.44.1 - #621

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vercel/ncc-0.44.1
Open

chore(deps-dev): bump @vercel/ncc from 0.38.3 to 0.44.1#621
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vercel/ncc-0.44.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor

Bumps @vercel/ncc from 0.38.3 to 0.44.1.

Release notes

Sourced from @​vercel/ncc's releases.

0.44.1

0.44.1 (2026-06-29)

Bug Fixes

0.44.0

0.44.0 (2026-06-09)

Features

0.43.0

0.43.0 (2026-06-09)

Changes

  • BREAKING CHANGE: add Node 24 and 26 support, remove 20 (#1318) (#1305)
  • switch npm releases to trusted publishing (OIDC) (#1325) (#1327) (#1328) (#1329) (#1330) (#1331) (#1332)
  • switch package management to pnpm (#1321)
  • fix predictable global cache directory in /tmp enables symlink/hijack risks (#1314)
  • reorder extension resolution to prioritise TypeScript over JSON (#1315)
  • support TypeScript 6 transpile builds (#1316)

0.38.4

0.38.4 (2025-09-18)

Bug Fixes

Commits
  • 8f0aefd fix: preserve runtime createRequire in ESM builds (#1334)
  • b9c6310 chore: Update vm2 to latest version (3.11.5) (#1333)
  • 88be21f chore(deps): Bump actions/checkout from 5 to 6 (#1300)
  • 5ea625e feat: read permissions pr.yml (#1323)
  • a1ff315 feat: remove npm devDependency (#1332)
  • 9e077ab feat: add publishConfig to package.json (#1331)
  • 7290aa7 feat(ci): upgrade python and remove LLVM LTO flags from MSVC build to fix Nod...
  • a428a10 feat: publish using node@24 (#1329)
  • 3192116 feat: use canonical package repository metadata (#1328)
  • 4461a52 feat: lock semantic-release publish dependencies (#1327)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vercel/ncc since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.38.3 to 0.44.1.
- [Release notes](https://github.com/vercel/ncc/releases)
- [Commits](vercel/ncc@0.38.3...0.44.1)

---
updated-dependencies:
- dependency-name: "@vercel/ncc"
  dependency-version: 0.44.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the 📦 Dependencies Pull requests that update a dependency file label Jul 29, 2026
@dependabot
dependabot Bot requested a review from AlbertHernandez as a code owner July 29, 2026 11:53
@dependabot dependabot Bot added the 📦 Dependencies Pull requests that update a dependency file label Jul 29, 2026
@github-actions github-actions Bot added the ignore-for-release Ignore pull request for a new release label Jul 29, 2026

@AlbertHernandez AlbertHernandez left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot squash and merge

@github-actions

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/@vercel/ncc 0.44.1 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1019 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • pnpm-lock.yaml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

📦 Dependencies Pull requests that update a dependency file ignore-for-release Ignore pull request for a new release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant