This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.17%. Comparing base (54f02a2) to head (6341e55).
⚠️ Report is 15 commits behind head on main.

@@            Coverage Diff             @@
##             main    #2748      +/-   ##
==========================================
+ Coverage   78.23%   79.17%   +0.93%     
==========================================
  Files         473      670     +197     
  Lines       34520    54275   +19755     
  Branches      734      734              
==========================================
+ Hits        27008    42972   +15964     
- Misses       7432    11223    +3791     
  Partials       80       80              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Trivy is reporting the following issue:

| tar (package.json) │ CVE-2026-23950 │ HIGH     │ fixed  │ 7.5.3             │ 7.5.4         │ node-tar: tar: node-tar: Arbitrary file overwrite via │

found in:

│ usr/local/lib/node_modules/pnpm/dist/node_modules/tar/package.json               │  node-pkg  │

I think this is bundled with pnpm so we can either try to update the bundled tar package or wait for pnpm to fix. At this point I'm going to wait and maybe pnpm will fix it before we hit a release.