fix(deps): update rhdh scorecard dependencies (patch) to v0.11.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@scalprum/react-core	0.11.1 → 0.11.3

---

Release Notes

scalprum/scaffolding (@​scalprum/react-core)

v0.11.3

Compare Source

v0.11.2

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[rhdh-gh-app]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
app-legacy	workspaces/scorecard/packages/app-legacy	none	v0.0.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.62%. Comparing base (f2c6e69) to head (221deeb).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3374   +/-   ##
=======================================
  Coverage   53.62%   53.62%           
=======================================
  Files        2256     2256           
  Lines       85870    85870           
  Branches    24188    24188           
=======================================
  Hits        46047    46047           
  Misses      39601    39601           
  Partials      222      222           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.70% <ø> (ø)		Carriedforward from f2c6e69
ai-integrations	67.95% <ø> (ø)		Carriedforward from f2c6e69
app-defaults	69.79% <ø> (ø)		Carriedforward from f2c6e69
augment	46.39% <ø> (ø)		Carriedforward from f2c6e69
boost	100.00% <ø> (ø)		Carriedforward from f2c6e69
bulk-import	72.46% <ø> (ø)		Carriedforward from f2c6e69
cost-management	14.10% <ø> (ø)		Carriedforward from f2c6e69
dcm	61.79% <ø> (ø)		Carriedforward from f2c6e69
extensions	61.53% <ø> (ø)		Carriedforward from f2c6e69
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from f2c6e69
global-header	59.71% <ø> (ø)		Carriedforward from f2c6e69
homepage	49.92% <ø> (ø)		Carriedforward from f2c6e69
install-dynamic-plugins	56.23% <ø> (ø)		Carriedforward from f2c6e69
konflux	91.49% <ø> (ø)		Carriedforward from f2c6e69
lightspeed	68.57% <ø> (ø)		Carriedforward from f2c6e69
mcp-integrations	85.46% <ø> (ø)		Carriedforward from f2c6e69
orchestrator	37.75% <ø> (ø)		Carriedforward from f2c6e69
quickstart	63.76% <ø> (ø)		Carriedforward from f2c6e69
sandbox	79.56% <ø> (ø)		Carriedforward from f2c6e69
scorecard	83.96% <ø> (ø)
theme	61.26% <ø> (ø)		Carriedforward from f2c6e69
translations	7.25% <ø> (ø)		Carriedforward from f2c6e69
x2a	78.68% <ø> (ø)		Carriedforward from f2c6e69

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f2c6e69...221deeb. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:59 AM UTC · Completed 9:02 AM UTC
Commit: 665cfa6 · View workflow run →

[fullsend-ai-review]

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

Previous run (4)

Looks good to me

Previous run (5)

Looks good to me

Previous run (6)

Looks good to me

Previous run (7)

Looks good to me

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

Previous run (10)

Looks good to me

Previous run (11)

Looks good to me

Previous run (12)

Looks good to me

Previous run (13)

Looks good to me

Previous run (14)

Looks good to me

Previous run (15)

Looks good to me

Previous run (16)

Looks good to me

Previous run (17)

Looks good to me

Previous run (18)

Looks good to me

Previous run (19)

Looks good to me

Previous run (20)

Looks good to me

Previous run (21)

Review

Findings

Medium

• [API contract violation] workspaces/scorecard/packages/app-legacy/package.json:58 — Bumping @scalprum/react-core to 0.11.3 in app-legacy while @red-hat-developer-hub/backstage-plugin-dynamic-home-page (v1.11.0) still depends on @scalprum/react-core pinned to exactly 0.11.1 creates a dual-instance React context problem. ScalprumContext.Provider from 0.11.3 (used in App.tsx) and useScalprum() from 0.11.1 (used inside DynamicCustomizableHomePage via useDynamicHomePageCards) reference different context objects. The provider value will not reach the consumer, causing useDynamicHomePageCards to return an empty array — resulting in a blank homepage.
  Remediation: Either (a) also bump the @scalprum/react-core dependency in @red-hat-developer-hub/backstage-plugin-dynamic-home-page to 0.11.3, or (b) add a resolutions field in the workspace root package.json to force a single version: "@scalprum/react-core": "0.11.3".

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 is not available on the deployment. This dimension was not evaluated.

Previous run (22)

Review

Findings

No findings.

Previous run (23)

Review

Findings

No findings.

Mechanical Renovate bot patch bump of @scalprum/react-core from 0.11.1 to 0.11.3 (and transitive @scalprum/core 0.9.0 → 0.9.3). The change is confined to a single package.json version field and the corresponding yarn.lock entries. No logic, security, or style concerns identified.

Previous run (24)

Review

Findings

No findings.

Previous run (25)

Review

Findings

No findings.

This is a clean patch-level dependency update by Renovate bot, bumping @scalprum/react-core from 0.11.1 to 0.11.3 in the scorecard workspace. The package.json and yarn.lock changes are consistent. The transitive @scalprum/core upgrade from 0.9.0 to 0.9.3 is expected since the new @scalprum/react-core@0.11.3 depends on @scalprum/core@^0.9.1.

Previous run (26)

Review

Findings

No findings.

Previous run (27)

Review

Findings

No findings.

Previous run (28)

Review

Findings

Info

• [transitive dependency side-effect] workspaces/scorecard/yarn.lock:13155 — The @scalprum/core resolution for ^0.9.0 is upgraded from 0.9.0 to 0.9.3 because Yarn merges the new ^0.9.1 range (required by @scalprum/react-core@0.11.3) with the existing ^0.9.0 range into a single resolution. This means @red-hat-developer-hub/backstage-plugin-dynamic-home-page@1.11.0, which transitively depends on @scalprum/core via @scalprum/react-core@0.11.1, will now resolve @scalprum/core to 0.9.3 instead of 0.9.0. The upgrade is semver-compatible and this deduplication is standard Yarn behavior.
• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model unavailable (claude-sonnet-4-5@20250929 not available on deployment). Given the trivial nature of this dependency version bump, no style concerns are expected.

Previous run (29)

Review

Findings

No findings.

Previous run (30)

Review

Findings

No findings.

Straightforward Renovate bot patch-level dependency bump of @scalprum/react-core from 0.11.1 to 0.11.3 (and transitive @scalprum/core 0.9.0 → 0.9.3) in the scorecard workspace. Other workspaces (global-header, homepage) are already on 0.11.3, so this change brings scorecard into alignment. The yarn.lock changes are consistent with the package.json change.

Previous run (31)

Review

Findings

No findings.

Previous run (32)

Review

Findings

No findings.

Previous run (33)

Review

Findings

No findings.

This is a clean Renovate patch-version dependency bump of @scalprum/react-core from 0.11.1 to 0.11.3, with the transitive @scalprum/core bump from 0.9.0 to 0.9.3. The lockfile updates are consistent, semver constraints are satisfied, and no stale references to the old versions exist in source code.

Previous run (34)

Review

Findings

No findings.

Previous run (35)

Review

Findings

No findings.

Previous run (36)

Review

Findings

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 unavailable on vertex deployment. This dimension was not evaluated; given the mechanical nature of this dependency bump (version string change only), no style findings are expected.

No blocking findings. This is a clean patch-level dependency bump of @scalprum/react-core (0.11.1 → 0.11.3) and its transitive dependency @scalprum/core (0.9.0 → 0.9.3), generated by Renovate bot. The package.json and yarn.lock changes are consistent and correct.

Previous run (37)

Review

Findings

No findings.

This is a well-formed Renovate bot patch dependency update bumping @scalprum/react-core from 0.11.1 to 0.11.3. The lockfile changes are correct: the old 0.11.1 resolution block is retained for the @red-hat-developer-hub/backstage-plugin-dynamic-home-page transitive dependency, @scalprum/core is deduplicated to 0.9.3 (satisfying both ^0.9.0 and ^0.9.1), and the new 0.11.3 resolution block is properly added.

Previous run (38)

Review

Reason: stale-head

The review agent reviewed commit d4a830abbd3680eec37b0314b80803e0eed57ebd but the PR HEAD is now e00edf59091724b582c47ef217cc5f3c20b36f82. This review was discarded to avoid approving unreviewed code.

Previous run (39)

Review

Findings

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 unavailable on deployment. This is a mechanical dependency version bump; style review would have early-exited with no findings per its own criteria.

Previous run (40)

Review

Findings

No findings.

Previous run (41)

Review

Findings

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 not available on vertex deployment. This is a mechanical dependency version bump where the style early-exit criteria would apply; no style concerns expected.

Previous run (42)

Review

Findings

Low

• [dependency version duplication] workspaces/scorecard/yarn.lock — After this change, @scalprum/react-core will exist in two versions in the dependency tree: 0.11.3 (used by app-legacy) and 0.11.1 (used by @red-hat-developer-hub/backstage-plugin-dynamic-home-page@1.11.0). Since nodeLinker: node-modules is configured, both versions will be installed. If these packages share React context objects across component boundaries, the context identity mismatch could cause the consumer to receive undefined. In practice, patch bumps (0.11.1 to 0.11.3) rarely change context shape, and Yarn may hoist one version if the resolution graph allows it, so this is low risk.

Info

• [sub-agent-failure] The style-conventions sub-agent did not return findings due to model unavailability. This does not affect the review outcome for this trivial dependency update.

Previous run (43)

Review

Findings

No findings.

Previous run (44)

Review

Findings

No findings.

This is a straightforward Renovate bot patch dependency update of @scalprum/react-core from 0.11.1 to 0.11.3 in the scorecard workspace. The version bump in package.json is consistent with the resolved versions in yarn.lock, and the transitive dependency @scalprum/core is correctly upgraded from 0.9.0 to 0.9.3 with compatible semver ranges.

Previous run (45)

Review

Findings

Medium

• [runtime mechanism] workspaces/scorecard/yarn.lock — After this change, two distinct versions of @scalprum/react-core will be installed: 0.11.1 (required by @red-hat-developer-hub/backstage-plugin-dynamic-home-page as a regular dependency) and 0.11.3 (required by app-legacy). Because @scalprum/react-core exports a React context (ScalprumContext), having two copies means the context provider instantiated from one version will not be visible to consumers using the other version — React contexts are matched by object identity. Before this PR, both consumers resolved to the same 0.11.1 copy.
  Remediation: Either (a) ensure @red-hat-developer-hub/backstage-plugin-dynamic-home-page is also updated to a version that depends on @scalprum/react-core 0.11.3 so yarn can deduplicate to a single copy, or (b) add a resolutions field in the workspace root package.json to force a single version of @scalprum/react-core across the workspace.

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model unavailable on deployment. This dimension was not evaluated but is unlikely to surface findings for a mechanical dependency version bump.

Previous run (46)

Review

Findings

No findings.

Previous run (47)

Review

Findings

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 is not available on the deployment. This dimension was not evaluated. Given the nature of this change (a mechanical dependency version bump), no style findings are expected.

No blocking findings. This is a straightforward Renovate bot patch-level dependency bump of @scalprum/react-core from 0.11.1 to 0.11.3 (with transitive @scalprum/core from 0.9.0 to 0.9.3). The lockfile and package.json changes are consistent and the version ranges are compatible.

Previous run (48)

Review

Findings

No findings.

This is a clean, automated patch-level dependency update from Renovate bot, bumping @scalprum/react-core from 0.11.1 to 0.11.3 (with transitive @scalprum/core 0.9.0 → 0.9.3). The lockfile changes are consistent with a normal patch-level npm registry update. No code, auth, permission, or API surface changes are introduced.

Previous run (49)

Review

Findings

No findings.

Previous run (50)

Review

Findings

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model not available on vertex deployment. This dimension has minimal relevance for a mechanical dependency version bump with no code changes.

No correctness, security, or architectural concerns. This is a straightforward Renovate bot patch bump of @scalprum/react-core from 0.11.1 to 0.11.3 (and transitive @scalprum/core from 0.9.0 to 0.9.3). The lockfile updates are consistent and the pinned version in package.json matches the resolved version in yarn.lock.

Previous run (51)

Review

Findings

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-6@default is not available on this deployment. This is a low-risk dependency version bump where the early-exit criteria would apply, so no style findings are expected.

Previous run (52)

Review

Findings

No findings.

Previous run (53)

Review

Findings

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 unavailable on this deployment. This dimension was not evaluated; however, the change is a mechanical dependency version bump with no style surface area.

No blocking findings. This is a straightforward automated patch-level dependency bump of @scalprum/react-core from 0.11.1 to 0.11.3 (and transitive @scalprum/core from 0.9.0 to 0.9.3). Lockfile changes are internally consistent — version ranges and deduplication are correct.

Previous run (54)

Review

Findings

Low

• [edge-case] workspaces/scorecard/yarn.lock — After this PR, two versions of @scalprum/react-core will coexist in the dependency tree: 0.11.3 (used by app-legacy) and 0.11.1 (used by @red-hat-developer-hub/backstage-plugin-dynamic-home-page). If ScalprumContext is a React context shared between these packages, the duplicate instances could cause context values provided by one version to be invisible to consumers from the other. This is a patch bump and unlikely to introduce behavioral differences, but worth monitoring.

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model unavailable on deployment. This is a trivial dependency version bump where the early-exit criteria would apply (no style findings expected).

Previous run (55)

Review

Findings

No findings.

Previous run (56)

Review

Findings

No findings.

This is a clean patch-level dependency bump of @scalprum/react-core from 0.11.1 to 0.11.3 (authored by Renovate bot). The lockfile changes are consistent with the package.json update, and the transitive @scalprum/core bump from 0.9.0 to 0.9.3 remains within the ^0.9.0 semver range. The same version (0.11.3) is already in use in the homepage workspace with the same API surface, confirming compatibility.

Previous run (57)

Review

Findings

High

• [logic-error] workspaces/scorecard/yarn.lock — After this update, app-legacy will use @scalprum/react-core@0.11.3 (direct dependency) while @red-hat-developer-hub/backstage-plugin-dynamic-home-page@1.11.0 (also a dependency of app-legacy) hard-pins @scalprum/react-core@0.11.1. The yarn.lock confirms both resolution entries coexist: the 0.11.1 block remains and a new 0.11.3 block is added. Since React contexts rely on referential identity, the ScalprumContext created by 0.11.3 in the app shell will be invisible to code running under 0.11.1 inside dynamic-home-page, potentially breaking dynamic home page mount points.
  Remediation: Either (1) update @red-hat-developer-hub/backstage-plugin-dynamic-home-page to a version compatible with @scalprum/react-core@0.11.3, or (2) add a resolutions entry in the workspace root package.json to force a single resolution of @scalprum/react-core to 0.11.3, or (3) hold this bump until the transitive dependency is aligned.

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 unavailable on deployment.
• [sub-agent-failure] N/A — The intent-coherence sub-agent did not return findings: model claude-sonnet-4-5@20250929 unavailable on deployment.

Previous run (58)

Review

Findings

No findings.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:14 AM UTC · Completed 9:22 AM UTC
Commit: 483a960 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:59 PM UTC · Completed 1:04 PM UTC
Commit: a85170e · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:11 PM UTC · Completed 2:16 PM UTC
Commit: 27b0488 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:03 PM UTC · Completed 8:07 PM UTC
Commit: 82225ba · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:22 PM UTC · Completed 8:26 PM UTC
Commit: 6069343 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:49 PM UTC · Completed 8:53 PM UTC
Commit: 578c694 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:02 PM UTC · Completed 9:06 PM UTC
Commit: 695f632 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:13 PM UTC · Completed 9:19 PM UTC
Commit: 695f632 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:25 PM UTC · Completed 9:29 PM UTC
Commit: e92645d · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:34 PM UTC · Completed 9:39 PM UTC
Commit: e92645d · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:46 PM UTC · Completed 9:50 PM UTC
Commit: 360a54f · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:58 PM UTC · Completed 10:02 PM UTC
Commit: e16c2a7 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:08 PM UTC · Completed 10:13 PM UTC
Commit: e16c2a7 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:40 PM UTC · Completed 10:44 PM UTC
Commit: 7c2f5d2 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:51 PM UTC · Completed 10:55 PM UTC
Commit: 6ddc27e · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:04 PM UTC · Completed 11:09 PM UTC
Commit: f2c6e69 · View workflow run →

[christoph-jerolimov]

We don't want bump scalprum, we want drop it instead

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open pull requests.

_{Posted by fullsend post-review check}

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (0.11.3). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.