Dependency Audit Settings

Latest audit summary

No audit report in this build

reports/outdated-pins.md is generated by the weekly dependency audit and is not committed to the repository, so this build has no report to render. Numbers below stay empty until the next audit publishes one — nothing is wrong with your pins.

Generate one with bun run deps:outdated — it writes reports/outdated-pins.md.

Full breakdown Audit workflow

Threshold settings

No audit run recorded in this build

reports/outdated-pins-thresholds.json is written by the dependency audit and is not committed to the repository, so this build cannot show which values the last run actually used. The documented defaults below still apply.

Audit threshold settings: repository variable, active value, and shipped default.
Setting	Active value	Default
Minimum bump reported `PINS_MIN_BUMP` Smallest release severity that counts as outdated. `patch` reports everything; `major` reports only major releases.	patch	patch
Ignored bump kinds `PINS_IGNORE_BUMPS` Release kinds dropped from the findings. Pre-releases are ignored by default so beta tags never look like a missed update.	prerelease	prerelease
Ignored packages `PINS_IGNORE` Package names or `` globs excluded from the audit, e.g. `@types/` while a type-only upgrade is deferred.	none	none
Restricted to `PINS_ONLY` When set, ONLY these names/globs are audited — everything else is skipped. Empty means every exact pin is checked.	all pins	all pins
Reporting floor `PINS_MIN_OUTDATED` How many findings are needed before the audit opens an issue or update PR. Lower numbers file more, noisier reports.	1 finding(s)	1 finding(s)
Fail run on a major `PINS_FAIL_ON_MAJOR` When on, the scheduled audit exits non-zero (red run) if any pin is a full major version behind.	no	no

Values come from repository variables read by the scheduled audit; each run records them to reports/outdated-pins-thresholds.json. An unknown value is a hard error in the audit rather than a silent widening of the check.