Skip to content

Update dependency @buape/carbon to ^0.16.0#5

Merged
kevinatbuape merged 1 commit into
mainfrom
renovate/buape-carbon-0.x
Jul 25, 2026
Merged

Update dependency @buape/carbon to ^0.16.0#5
kevinatbuape merged 1 commit into
mainfrom
renovate/buape-carbon-0.x

Conversation

@renovate

@renovate renovate Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@buape/carbon ^0.0.0-beta-20260708153607^0.16.0 age confidence

Release Notes

buape/carbon (@​buape/carbon)

v0.16.0

Compare Source

Minor Changes

  • df39f86 - feat: add Guild#createChannel

  • 0eee2e0 - feat: remove node/hono adapter from being built in to carbon, add it to create-carbon instead

  • bc9000b - feat: make channels nicer to use

Our Team

Thanks to @​k0d13, @​Codeize, and @​thewilloftheshadow for making this release happen

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.15.0...@​buape/carbon@0.16.0

v0.15.0

Compare Source

Minor Changes
  • 17203ef: feat: add support for Entry Point Commands (used in Activities)
  • 5c08a35: feat(breaking): change listener registration method to Client#registerListener
  • 472e576: feat: include original request on RateLimitError with method and url metadata
  • 52690dc: feat(runtime): add lane-based request/event queues, resilient forwarder delivery, and startup/runtime metrics
  • 31147dc: feat: add a CloudflareGatewayPlugin to allow long-lasting gateway connections on Cloudflare Workers
  • 67d403b: feat: rewrite GatewayPlugin for better Discord lifecycle handling and extending
  • 3ab417b: feat: add command middleware hooks (before/after) on client and command levels
Patch Changes
  • 51ffa8f: fix: reset gateway heartbeat ack state on reconnects
  • ec9a41c: fix: change component registration to allow multiple handlers sharing a custom ID across component types.
  • 4f425f8: feat: add parseRawData to GuildAvailable and GuildUnavailable listeners
  • 5c08a35: fix: add voice event forwarding
  • c4cf6f0: fix: reset reconnect backoff counter on READY/RESUMED instead of WebSocket open to prevent connection storms
  • 1b10265: fix: invalidate stale resume session after consecutive failures
  • 897a98a: fix: prevent TS2322 errors in listener data types
  • 11439f3: feat: add custom fetch injection to RequestClient
  • e7efbe0: feat: add support for sending voice messages
  • 3aae58c: fix: resolve Bun adapter type error for port-based server options
  • 6eed6eb: fix: avoid crashing when reconnect is requested after socket is already closed
  • db2cd1d: fix: Add GuildAvailabilityCache to GatewayForwarder to prevent GUILD_CREATE events from sending on startup
  • 521aa10: feat: add reconcile mode for Discord command deployment
  • be84aee: fix: change webhook query handling to avoid duplicating thread_id and other params

New Contributors

Our Team

Thanks to @​k0d13, @​Codeize, and @​thewilloftheshadow for making this release happen

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.14.0...@​buape/carbon@0.15.0

v0.14.0: @​buape/carbon v0.14.0

Compare Source

0.14.0

Minor Changes
  • f7a0f46: feat: misc performance improvements
  • 888c240: feat: Changed BaseInteraction#replyAndWaitForComponent to return the message from the interaction reply
  • b4c5614: feat: add a getMember method to the OptionsHandler to get the member data from a user option
  • 888c240: feat: Added BaseInteraction#editAndWaitForComponent
  • 20973ef: feat: checkbox and radio modal components
  • eff69b9: feat: add voice plugin with gateway adapter
  • 962f6ce: feat: Add Interaction#targetMessage and Interaction#targetUser for Message and User context menu commands
  • 401ade3: feat: allow direct instantiation of certain components
  • 3d09205: feat: add support for typing in DMs and group DMs
  • deae588: feat: remove client.components in favor of client.componentHandler.findComponent
  • 2f9d4ca: feat: Add better ratelimit handling and queue control for the RequestClient
  • 3d09205: feat: more heartbeat and event tuning for cpu usage
  • deae588: feat: allow globally registered Modals
  • e45684b: feat: add Command#getMention method
Patch Changes
  • 095a41b: fix: Add handling to the component customIdParser so long numerical strings do not get casted to a Number
  • 0ba80ae: fix: User#createDm took a userId parameter instead of using User#id
  • 1406843: fix: Fixed memory leak in GatewayForwarderPlugin by properly consuming HTTP response bodies
  • 660e2b9: chore: update dependencies
  • 0319ad0: fix: Fixed memory leak in ClientManager by consuming request bodies before error responses
  • 3d09205: fix: adjust heartbeat timing
  • 931dfcb: fix: Adjust how the nextjs handler is created
  • 3d09205: fix: handle per-route ratelimiting better
  • ec12049: fix: support numbers in autocomplete responses

New Contributors

Our Team

Thanks to @​apteryxxyz, @​Codeize, and @​thewilloftheshadow for making this release happen

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.13.0...@​buape/carbon@0.14.0

v0.13.0

Compare Source

@​buape/carbon@​0.13.0

Minor Changes
  • f53e175: feat: remove the Webhook's dependency on the Client
  • c143b31: feat: add GuildAvailable and GuildUnavailable events
    This prevents Carbon's gateway plugin from spamming GuildCreate events when it first connects
  • f5604c4: feat: remove the guildId parameter from several functions in Role, instead adding it to the constructor that Carbon uses
  • f5604c4: feat: add Guild#fetchRoleMemberCounts and Role#fetchMemberCount
  • 515dd10: feat: add option to gateway plugin to automatically listen to gateway interactionCreate events
  • 67fe8f5: feat: make gateway plugin options accessible to the user
  • 2bf2522: feat: Add the file upload component for modals
  • bb25fab: feat: add CDN URL methods with format and size support
  • 0da2786: feat: add ClientManager plugin for managing multiple clients
  • b955a5c: feat: add support for scheduled events
Patch Changes
  • ee937cb: chore(deps): update dependency @​types/bun to v1.2.23
  • db8230e: chore(deps): update dependencies
  • b258984: fix: incorrect content type for commands route from command data plugin

Our Team

Thanks to @​apteryxxyz, @​Codeize, and @​thewilloftheshadow for making this release happen

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.12.0...@​buape/carbon@0.13.0

v0.12.0: v0.12.0

Compare Source

0.12.0

Minor Changes
  • a25a9cf: feat: support more select menu types and text displays in modals

  • a2d0b68: feat: add support for ephemeral shorthand in message payloads

  • 2ed6026: feat: wildcard components and modals

  • 74eb89c: feat: add clientId to every event payload

  • c07806b: feat: add support for current member set banner/avatar/bio

  • 0944494: feat: add support for application emojis and add a guildemoji class

  • a25a9cf: feat: make some options/fields getters non-async
    Any getters for users, roles, or mentionables are no longer async, since Discord provides all the needed data already and we don't need to fetch it.
    Additionally, getChannelId/getChannelIds functions have been added to provide a synchronous option when you only need channel IDs, as Discord does not provide enough channel data to construct a full Channel in Carbon.

    This applies to both the FieldsHandler in Modals, and the OptionsHandler for chat interactions

  • 9bddb60: feat: allow optional webhook headers for the forwarder plugins

Patch Changes

New Contributors

Our Team

Thanks to @​apteryxxyz and @​thewilloftheshadow for making this release happen

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.11.0...@​buape/carbon@0.12.0

v0.11.0: v0.11.0

Compare Source

@​buape/carbon@​0.11.0

Minor Changes
  • e729515: feat: updated to new Label components in modals
🚨 Breaking Changes to Modals

Carbon now uses Discord's new Label-based modal structure. The old Row-based approach is no longer supported. You can find out more info in our migration guide

  • acd2a9c: feat: new pinned messages routes
  • fc680c4: feat: allow functions to be passed to set ephemeral and defer capabilities
  • b35008a: feat: allow option-specific autocomplete functions
  • f2b3c0b: feat: allow readonly access to the rawData for all classes
  • ecab49d: feat: add new ApplicationDeauthorizedEvent
Patch Changes
  • ecab49d: fix: remove position from thread channels

create-carbon@ 0.5.0

Minor Changes
  • 9d206f1: feat: add support for nodejs-style process.env in cloudflare and cleanup template files

New Contributors

Our Team

Thanks to @​apteryxxyz and @​thewilloftheshadow for making this release happen

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.10.0...@​buape/carbon@0.11.0

v0.10.0: v0.10.0

Compare Source

@​buape/carbon@​0.10.0

Minor Changes
  • ac7e683: feat: add support for subcommands alongside subcommand groups
  • 1aa8613: feat: make Client#validateDiscordRequest protected so it can be overridden
  • 4a2e54b: feat: Add support for sending gateway events
  • 0a6ec9e: feat: add ping tracking to the gateway plugin
  • e48999f: feat: add a Go To Page button for the Paginator
  • 4031390: feat: add a isConnected to the gateway plugin
Patch Changes
  • 4818a7e: fix: make Interaction#update() register components automatically like the other methods
  • d3a6f2c: chore(deps): update dependency @​hono/node-server to v1.18.2
  • 028b0d3: chore(deps): update dependency @​types/bun to v1.2.18
  • 2d28b80: chore(deps): update dependency @​types/bun to v1.2.20
  • 252dbfd: chore(deps): update dependency ws to v8.18.3
  • 93641eb: fix: Made Message#edit, Message#forward, and Message#reply methods properly return a Message class
  • f273125: feat: add a createPost function for forum channels
  • 07a8385: fix: resolve TypeScript build errors in Web Crypto API usage

create-carbon@​0.4.2

Patch Changes
  • b35a1f7: fix: missing "and" helper for plugins

New Contributors

Our Team

Thanks to @​apteryxxyz @​Asleep123 @​thewilloftheshadow and @​Codeize for making this release happen

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.9.0...@​buape/carbon@0.10.0

v0.9.0: v0.9.0

Compare Source

Minor Changes
  • 379b2b7: feat: Guild#fetchMembers method
  • 4b4141d: feat: support commands only in specific guilds
  • b5367f6: feat: add a Paginator class (implemented as a plugin)
  • 891892a: feat: Poll support
  • 7681111: fix: Clean up Listener types, provide raw data for overridden types
  • e39de8e: feat: voice state for GuildMember
  • 36ab053: feat: prechecks
  • 1666d1d: feat: full command data route
  • 6af69df: feat: name and description localizations
  • 0852797: feat: OptionsHandler#getAttachment
  • 8d01c89: feat: Fetch all channels in a guild
  • 314b16f: feat: mount components when used, allowing for custom constructor setups
  • 3cdcd07: feat: add new and improved global registering of components
  • 4650235: feat: Caching
  • 6b8c1b9: feat: add sharding to the forwarder plugin
  • 314b16f: feat: implement a custom ID parser system for component data specific to each usage of a component
  • 8f57795: feat: add fetchRole and fetchRoles methods on a guild
  • 7b2b785: feat: Message#disableAllButtons
  • 23ad89f: feat: more Guild properties
  • 7b2b785: feat: one off components (e.g. confirmation prompts)
  • e7e6da9: feat: add an error and docs page for missing components
  • ebc7d8b: feat: add more validation for incoming options
  • e0b6544: feat: command data plugin
  • 7b2b785: feat: have Interaction#reply return a Message you can use
  • 7681111: feat: ThreadMember structure
  • 4b0dfff: feat: toString() methods to generate mention strings
  • bebe424: feat: enforce the 25 choices limit with a console warning
  • ed32210: feat: add a way to fetch a guildmember's permissions
  • 6daed34: feat: Webhook support
  • aeaa47a: feat: return a Message object when you use Channel#send
Patch Changes
  • 1a347b4: feat: add preferred locale to guild
  • 4fa2e35: fix: ignore event filter on gateway plugins if not set
  • 3591b56: fix(temp): add a patch workaround for #​247
  • e2b2c69: Fixed gateway's reconnection system
  • 8e80185: fix: don't assume that channels and members always exist
  • c36a702: fix: update container id from 15 to 17
  • bc4a36a: fix: allow description to be optional for commands
  • 51df9d3: chore: bump dependencies
  • fd678c2: fix: fixed sharding on createIdentifyPayload

New Contributors

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.8.0...@​buape/carbon@0.9.0

v0.8.0

Compare Source

Minor Changes

  • a095849: feat: components v2
  • 98b165b: feat: support files in all MessagePayloads, not just interaction replies
  • 50cc5c8: feat: return name and type for autocomplete's getFocused() options as well as value
  • 4a1329f: feat: Gateway forwarder plugin to allow gateway events with a serverless http bot
  • 4a1329f: feat: add gateway support for server runtimes

Patch Changes

  • cfacfd5: chore: update dependencies
  • a095849: fix: make attachments work for standard interaction replies as well as channel sends
  • cc80d95: feat: add better fetching for partials, allowing you to reassign with the full class data

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.7.0...@​buape/carbon@0.8.0

v0.7.0

Compare Source

Minor Changes
  • 4b8d474: feat: webhook events
  • 29c323c: feat: command permissions
  • 626f3c3: refactor: replace creating handle with new adapters
Patch Changes
  • 137a2d9: chore: update dependencies
  • e20d29c: fix: move base url option back
  • c6c60a6: chore: remove beta tag for integrationTypes and contexts on commands
  • d5d1488: fix: send allowedMentions to discord in correct format

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.6.1...@​buape/carbon@0.7.0

v0.6.1

Compare Source

Patch Changes
  • 7f0796b: fix: invalid url for hono server
  • 5d43f99: refactor: change env vars and options requirements
  • 5d43f99: fix: trying to use __dirname in es module in create-carbon

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.6.0...@​buape/carbon@0.6.1

v0.6.0

Compare Source

Minor Changes
  • 407d4d2: feat: Bump required node version to v20
  • 6ab721f: refactor: move linked roles to core package
  • 0802dc2: feat: add icon_url property to embed author object
  • 8b489db: New Architecture
Patch Changes

Note: This version has a breaking change in how you initialize the client and router, including a new Plugins system from @​apteryxxyz. We advise you to read through the documentation's getting started guide to setup your client again, then bring in all your commands, etc after that.

https://carbon.buape.com/getting-started/introduction

Alongside this release, the following packages have been deprecated:

  • The @buape/carbon-linked-roles package has been deprecated and replaced with a built in Linked Roles plugin. Migration is simple, as they work the same way with their config.
  • The @buape/carbon-nodejs package has been deprecated and replaced with the nodejs adapter in Carbon.

v0.5.0

Compare Source

Minor Changes
  • 9e087a2: feat: add MessagePayload for replies and message sending
    This will allow you to pass just a string to reply with as the content, or the entire message payload.
  • 40f797b: feat: add fetchers to client
  • 63a6d07: feat: Add topic getter to all guild based text channels
Patch Changes
  • 3bf77fb: fix: OptionsHandler#getMentionable always returning user even when invalid
  • d76feb7: fix: interaction#options should never be null
  • 77b71ef: fix: don't require the user to cast types for button styles
  • b29eefd: fix: correctly get options of subcommands and subcommandgroups
  • a0074f0: refactor: add partial type parameters to structures to improve field types

In addition, we have also released our new create command for Carbon! You can try it out by using one of the following:

pnpm create carbon@latest

v0.4.2

Compare Source

Patch Changes

v0.4.1

Compare Source

Patch Changes
  • 5fdd006: fix: ModalHandler not awaiting modal run

v0.4.0: v0.4.0

Compare Source

What's Changed

Minor Changes
Patch Changes

New Contributors

All Commits: https://github.com/buape/carbon/compare/@buape/carbon@0.3.2...@​buape/carbon@0.4.0

v0.3.2: v0.3.1

Compare Source

Changes

  • c80ce0f: feat: embeds
  • f8b608f: fix: new interaction verification
  • 50c8200: feat: add ComponentInteraction#acknowledge
  • a15bf55: feat: add fields handler
  • 51d84c3: feat: add overloads for a required type for options and fields
  • dcf5b44: feat: add support for interaction#acknowledge for modals
  • c8e7c1c: feat: add followup messages for interactions

All Commits: https://github.com/buape/carbon/compare/@buape/carbon@0.2.0...@​buape/carbon@0.3.2

v0.3.1

Compare Source

v0.3.0

Compare Source

v0.2.0

Compare Source

Changes

  • ad9666b: feat: Modal support
  • 9e93027: feat: make components automatically registered

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.1.3...@​buape/carbon@0.2.0

v0.1.3: Beta v0.1.3

Compare Source

0.1.3

Patch Changes
  • fix: use Request instead of IRequestStrict for Client#handle

Full Changelog: https://github.com/buape/carbon/compare/@buape/carbon@0.1.2...@​buape/carbon@0.1.3

v0.1.2: Beta v0.1.2

Compare Source

0.1.2

Patch Changes
  • 2bdc7f3: fix: OptionsHandler#getInteger was not typed correctly
  • e79c435: feat: Allow users to use their own router instead of Carbon's router
  • 917416a: deps: update dependency discord-api-types to v0.37.99

All Commits: buape/carbon@@buape/carbon@0.1.1...@buape/carbon@0.1.2

v0.1.1: Beta v0.1.1

Compare Source

This is the first beta for Carbon!
Featuring interactions, commands, messages, subcommands, options, linked roles, and more.

If you'd like to help test, let us know at https://go.buape.com/discord

All Commits: https://github.com/buape/carbon/commits/@​buape/carbon@0.1.1


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-security Bot commented Jul 18, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​buape/​carbon@​0.0.0-beta-20260708153607 ⏵ 0.16.097 +11008899100

View full report

@socket-security

socket-security Bot commented Jul 18, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Medium
Potential security risk (AI signal): npm @buape/carbon is 62.0% likely risky

Notes: This module primarily behaves as an authenticated event-forwarding gateway. It does not show classic malware behaviors (no code execution primitives or persistence). However, it deterministically transmits highly sensitive secrets/tokens (DEPLOY_SECRET, DISCORD_BOT_TOKEN, and client identifiers) in an outbound JSON request to a fixed external “carbon.gateway” endpoint. If that destination/role is not strictly intended and protected, it represents a significant supply-chain security risk. Additionally, inbound JSON payloads are only minimally validated before being passed into downstream event handling.

Confidence: 0.62

Severity: 0.70

From: package.jsonnpm/@buape/carbon@0.16.0

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@buape/carbon@0.16.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Potential security risk (AI signal): npm @emnapi/core is 66.0% likely risky

Notes: This runtime bridge contains explicit high-impact dynamic code execution capabilities: it directly calls eval(...) in napi_run_script and uses new Function(...) to generate functions/class members in the definition path. While the rest of the code largely implements expected wasm threading/N-API glue (shared memory, Atomics queues, async callback dispatch, and worker coordination), the eval/new Function sinks substantially raise security risk. No overt data exfiltration or system-damage behavior is evident in the provided fragment, but the arbitrary code execution surface means the dependency should be treated as critically sensitive unless the wasm module and all inputs to the dynamic execution paths are fully trusted and integrity-protected.

Confidence: 0.66

Severity: 0.75

From: ?npm/@buape/carbon@0.16.0npm/@emnapi/core@1.11.3

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-android-arm-eabi

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-android-arm-eabi@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-android-arm-eabi@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-android-arm64

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-android-arm64@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-android-arm64@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-darwin-arm64

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-darwin-arm64@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-darwin-arm64@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-darwin-x64

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-darwin-x64@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-darwin-x64@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-freebsd-x64

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-freebsd-x64@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-freebsd-x64@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-linux-arm-gnueabihf

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-linux-arm-gnueabihf@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-linux-arm-gnueabihf@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-linux-arm64-gnu

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-linux-arm64-gnu@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-linux-arm64-gnu@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-linux-arm64-musl

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-linux-arm64-musl@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-linux-arm64-musl@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-wasm32-wasi

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-wasm32-wasi@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-wasm32-wasi@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-win32-arm64-msvc

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-win32-arm64-msvc@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-win32-arm64-msvc@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @snazzah/davey-win32-ia32-msvc

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey-win32-ia32-msvc@0.1.12

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey-win32-ia32-msvc@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: npm @snazzah/davey in module child_process

Module: child_process

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/@snazzah/davey@0.1.12

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@snazzah/davey@0.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: npm prism-media in module child_process

Module: child_process

Location: Package overview

From: ?npm/@buape/carbon@0.16.0npm/prism-media@1.3.5

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/prism-media@1.3.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovate Bot force-pushed the renovate/buape-carbon-0.x branch from 6eb3561 to de14be1 Compare July 25, 2026 11:50
@renovate
renovate Bot force-pushed the renovate/buape-carbon-0.x branch from de14be1 to 8c59cf7 Compare July 25, 2026 19:04
@renovate renovate Bot changed the title fix(deps): update dependency @buape/carbon to ^0.16.0 Update dependency @buape/carbon to ^0.16.0 Jul 25, 2026
@kevinatbuape
kevinatbuape merged commit f6fb3e1 into main Jul 25, 2026
4 checks passed
@kevinatbuape
kevinatbuape deleted the renovate/buape-carbon-0.x branch July 25, 2026 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant