rubric v1.0.0 ยท scored 2026-10-15 06:00:09 UTC

voyagi/bumpwarden-demo-app / morgan

morgan 1.10.0 to 1.12.1

Scored 16 of 100, which is clear. Every factor below is computed from a source you can open, and the sum decides the band. Nothing here is a judgement call.

Where this sits

The same axis as the queue, so this bump's place in the run is legible.

30
61
morgan 16
chalk 71
chalk 71
express 74
glob 87

Machine explanation, not verdict

Update morgan to 1.12.1 to resolve CVE-2026-87859 and add the :pid token

Morgan was updated from 1.10.0 to 1.12.1. This update addresses a security vulnerability (CVE-2026-87859 / GHSA-9f6g-j8ch-79g4). It introduces a new :pid token to log the process ID. Internal dependencies on-headers and on-finished were updated. The project migrated its CI to GitHub Actions, added OSSF scorecard reporting, and updated its Node.js test matrix. Documentation was updated with ES modules import examples and typo fixes. No usage sites of morgan were found in this repository, so the direct impact on the codebase could not be determined.

  • No breaking changes were identified in this minor version update.

Migration

  1. No migration steps are required as there are no breaking changes and no usage sites of morgan were detected in this repository.

Confidence high. Model gemini-3.5-flash. It named no call site in this repository. Some inputs were truncated to fit the token budget.

Provenance

Run
run-20261015T060009318Z-scheduled
First seen
2026-09-11 18:00:22 UTC
Last scored
2026-10-15 06:00:09 UTC
Rubric
v1.0.0
Bump key
voyagi/bumpwarden-demo-app#morgan@1.12.1

How 16 was reached

Semver distance, minor8
Your code imports the package, imported, but no changed symbol matched8
Breaking marker in release evidence, none found0
Advisories on the candidate, none on the candidate0
Deprecation, neither version is deprecated0
Engine range, candidate needs Node 0.8.0, you declare 18.0.00
Candidate release age, published 2026-09-11, 33 days ago0
Peer dependency range, peer range unchanged0
Release notes for the candidate, github.com0
Total16

What was done

updated issue #2806:00
updated issue #2818:00
updated issue #2806:00
updated issue #2818:00
updated issue #2806:00
updated issue #2818:00
updated issue #2806:00
updated issue #2818:00
updated issue #2806:00
updated issue #2818:00
updated issue #2806:00
updated issue #2818:01
Scored 16, rubric v1.0.006:00

Rule GRN-PR-1 Open a pull request with the bump and the brief. If Dependabot or Renovate already opened one for the same bump, comment there instead of duplicating it.