From f9e6247d43130097a126a548c1aa14706f3ad3f5 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Tue, 14 Jul 2026 07:32:49 +0100
Subject: [PATCH 01/24] ci(scorecard): fix workflow artifact handling

---
 .github/workflows/scorecard.yml | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 92b6872b..ed05535e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@4fae2f995a2bb2cfa3eb1f6359181ef7b9ce110b # v6.0.0
         with:
           persist-credentials: false
 
@@ -59,9 +59,10 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+        uses: actions/upload-artifact@v7
         with:
-          name: SARIF file
+          # Use a simple, lowercase artifact name without spaces to avoid API validation
+          name: results-sarif
           path: results.sarif
           retention-days: 5
 
@@ -71,3 +72,20 @@ jobs:
         uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         with:
           sarif_file: results.sarif
+
+  inspect-sarif:
+    name: Inspect SARIF artifact
+    needs: analysis
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Download SARIF artifact"
+        uses: actions/download-artifact@v4
+        with:
+          name: results-sarif
+
+      - name: "List SARIF file"
+        run: |
+          echo "Downloaded files:"
+          ls -la || true
+          echo "If results.sarif is present, show basic info:"
+          file results.sarif || true

From 9eb52f5d1cdab6396505c607e7c2d5f82b8119a7 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Tue, 14 Jul 2026 07:57:24 +0100
Subject: [PATCH 02/24] ci(scorecard): pin actions/checkout to v6.0.0 commit
 SHA

---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ed05535e..7d446e17 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@4fae2f995a2bb2cfa3eb1f6359181ef7b9ce110b # v6.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ffd01eeb3 # v6.0.0
         with:
           persist-credentials: false
 

From a865f9830ca44bbcbbc1a722492d053f01266af7 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Tue, 14 Jul 2026 08:01:36 +0100
Subject: [PATCH 03/24] ci(pages): restrict deploy-pages workflow to push and
 workflow_dispatch; remove id-token from permissions

---
 .github/workflows/deploy-pages.yml | 38 ++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 .github/workflows/deploy-pages.yml

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
new file mode 100644
index 00000000..429c9075
--- /dev/null
+++ b/.github/workflows/deploy-pages.yml
@@ -0,0 +1,38 @@
+name: Deploy GitHub Pages
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  pages: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v4
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: '.'
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

From f9b5ba74a4d784a2fe85cccf3342479e878683c9 Mon Sep 17 00:00:00 2001
From: Adrian Adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 16 Jul 2026 08:28:42 +0100
Subject: [PATCH 04/24] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 7d446e17..64ce85f3 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -87,5 +87,5 @@ jobs:
         run: |
           echo "Downloaded files:"
           ls -la || true
-          echo "If results.sarif is present, show basic info:"
-          file results.sarif || true
+          echo "If results-sarif/results.sarif is present, show basic info:"
+          file results-sarif/results.sarif || true

From d95feffbca170b40a51ae765f40d2239fc23dbf8 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 16 Jul 2026 08:34:31 +0100
Subject: [PATCH 05/24] ci(scorecard): fix workflow artifact handling and pin
 action SHAs

---
 .github/workflows/scorecard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 64ce85f3..fbe3fd2d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -59,7 +59,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           # Use a simple, lowercase artifact name without spaces to avoid API validation
           name: results-sarif
@@ -79,7 +79,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Download SARIF artifact"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: results-sarif
 

From a246ae92305b3bd0dbab4fc1663ebfd155c51143 Mon Sep 17 00:00:00 2001
From: Adrian Adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 16 Jul 2026 08:44:16 +0100
Subject: [PATCH 06/24] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/deploy-pages.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 429c9075..29237d96 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -9,6 +9,7 @@ on:
 permissions:
   contents: read
   pages: write
+  id-token: write
 
 concurrency:
   group: pages

From 99be9080916a3ef38a6c44f16bd06041b5e120de Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 16 Jul 2026 08:48:00 +0100
Subject: [PATCH 07/24] ci(pages): remove id-token permission from deploy-pages
 workflow

---
 .github/workflows/deploy-pages.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 29237d96..429c9075 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -9,7 +9,6 @@ on:
 permissions:
   contents: read
   pages: write
-  id-token: write
 
 concurrency:
   group: pages

From 89e4b80308c4353885a3eaf8935f97d7f38cd69c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 10:03:57 +0000
Subject: [PATCH 08/24] chore(deps): bump opencv-python in /lessons/5-NLP

Bumps [opencv-python](https://github.com/opencv/opencv-python) from 4.5.1.48 to 4.8.1.78.
- [Release notes](https://github.com/opencv/opencv-python/releases)
- [Commits](https://github.com/opencv/opencv-python/commits)

---
updated-dependencies:
- dependency-name: opencv-python
  dependency-version: 4.8.1.78
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 lessons/5-NLP/requirements-pytorch.txt | 2 +-
 lessons/5-NLP/requirements-tf.txt      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lessons/5-NLP/requirements-pytorch.txt b/lessons/5-NLP/requirements-pytorch.txt
index 4965ed82..f8549e69 100644
--- a/lessons/5-NLP/requirements-pytorch.txt
+++ b/lessons/5-NLP/requirements-pytorch.txt
@@ -3,7 +3,7 @@ huggingface==0.0.1
 matplotlib
 nltk==3.10.0
 numpy==1.22.0
-opencv-python==4.5.1.48
+opencv-python==4.8.1.78
 Pillow==12.2.0
 scikit-learn
 scipy
diff --git a/lessons/5-NLP/requirements-tf.txt b/lessons/5-NLP/requirements-tf.txt
index 2168dacf..44a8a460 100644
--- a/lessons/5-NLP/requirements-tf.txt
+++ b/lessons/5-NLP/requirements-tf.txt
@@ -3,7 +3,7 @@ huggingface==0.0.1
 matplotlib
 nltk==3.10.0
 numpy==1.22.0
-opencv-python==4.5.1.48
+opencv-python==4.8.1.78
 Pillow==12.2.0
 scikit-learn
 scipy

From 69a3840267868d235509b42944f4d1bae3f0633f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 10:04:05 +0000
Subject: [PATCH 09/24] chore(deps): bump pillow from 12.2.0 to 12.3.0 in
 /binder

Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.2.0 to 12.3.0.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0)

---
updated-dependencies:
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 binder/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/binder/requirements.txt b/binder/requirements.txt
index ef9d36dd..50e538f9 100644
--- a/binder/requirements.txt
+++ b/binder/requirements.txt
@@ -5,7 +5,7 @@ imageio==2.35.0
 keras==3.13.2
 nltk==3.10.0
 pandas==2.0.3
-pillow==12.2.0
+pillow==12.3.0
 pygame==2.6.0
 scikit-image==0.21.0
 seaborn==0.13.2

From 2f0dcbccf9bcd255275df42f1e6267011ca7d9d9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 10:10:52 +0000
Subject: [PATCH 10/24] chore(deps): bump json5, @vue/cli-service and
 babel-loader

Bumps [json5](https://github.com/json5/json5) to 2.2.3 and updates ancestor dependencies [json5](https://github.com/json5/json5), [@vue/cli-service](https://github.com/vuejs/vue-cli/tree/HEAD/packages/@vue/cli-service) and [babel-loader](https://github.com/babel/babel-loader). These dependencies need to be updated together.


Updates `json5` from 2.2.1 to 2.2.3
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](https://github.com/json5/json5/compare/v2.2.1...v2.2.3)

Updates `@vue/cli-service` from 5.0.8 to 5.0.9
- [Release notes](https://github.com/vuejs/vue-cli/releases)
- [Changelog](https://github.com/vuejs/vue-cli/blob/dev/CHANGELOG.md)
- [Commits](https://github.com/vuejs/vue-cli/commits/v5.0.9/packages/@vue/cli-service)

Updates `babel-loader` from 8.2.2 to 8.4.1
- [Release notes](https://github.com/babel/babel-loader/releases)
- [Changelog](https://github.com/babel/babel-loader/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel-loader/compare/v8.2.2...v8.4.1)

---
updated-dependencies:
- dependency-name: json5
  dependency-version: 2.2.3
  dependency-type: indirect
- dependency-name: "@vue/cli-service"
  dependency-version: 5.0.9
  dependency-type: direct:development
- dependency-name: babel-loader
  dependency-version: 8.4.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 etc/quiz-app/package-lock.json | 149 +++++++++++++++++++--------------
 etc/quiz-app/package.json      |   2 +-
 2 files changed, 89 insertions(+), 62 deletions(-)

diff --git a/etc/quiz-app/package-lock.json b/etc/quiz-app/package-lock.json
index 851595c8..2f7e6bd6 100644
--- a/etc/quiz-app/package-lock.json
+++ b/etc/quiz-app/package-lock.json
@@ -16,7 +16,7 @@
       "devDependencies": {
         "@vue/cli-plugin-babel": "~5.0.8",
         "@vue/cli-plugin-eslint": "~5.0.8",
-        "@vue/cli-service": "~5.0.8",
+        "@vue/cli-service": "~5.0.9",
         "babel-eslint": "^10.1.0",
         "eslint": "^9.33.0",
         "eslint-plugin-vue": "^10.4.0",
@@ -2745,9 +2745,9 @@
       }
     },
     "node_modules/@vue/cli-overlay": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-overlay/-/cli-overlay-5.0.8.tgz",
-      "integrity": "sha512-KmtievE/B4kcXp6SuM2gzsnSd8WebkQpg3XaB6GmFh1BJGRqa1UiW9up7L/Q67uOdTigHxr5Ar2lZms4RcDjwQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-overlay/-/cli-overlay-5.0.9.tgz",
+      "integrity": "sha512-aBdZWrYKxLuFz1FDsk/muFD7GycrsW73Gi11yRc7R2W7Bm8mDRc9HKAI790gdg4NV+chkDFmfkegjg5iMDEpAA==",
       "dev": true
     },
     "node_modules/@vue/cli-plugin-babel": {
@@ -2900,40 +2900,40 @@
       }
     },
     "node_modules/@vue/cli-plugin-router": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-router/-/cli-plugin-router-5.0.8.tgz",
-      "integrity": "sha512-Gmv4dsGdAsWPqVijz3Ux2OS2HkMrWi1ENj2cYL75nUeL+Xj5HEstSqdtfZ0b1q9NCce+BFB6QnHfTBXc/fCvMg==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-router/-/cli-plugin-router-5.0.9.tgz",
+      "integrity": "sha512-kopbO/8kIl5CAffwgptXEwV509i+M0FfwW4sSkgQ2RzpxOYBjQZvp+096mjZfFcWKSmryNP/ri/Mnu78vmhlhw==",
       "dev": true,
       "dependencies": {
-        "@vue/cli-shared-utils": "^5.0.8"
+        "@vue/cli-shared-utils": "^5.0.9"
       },
       "peerDependencies": {
         "@vue/cli-service": "^3.0.0 || ^4.0.0 || ^5.0.0-0"
       }
     },
     "node_modules/@vue/cli-plugin-vuex": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-vuex/-/cli-plugin-vuex-5.0.8.tgz",
-      "integrity": "sha512-HSYWPqrunRE5ZZs8kVwiY6oWcn95qf/OQabwLfprhdpFWAGtLStShjsGED2aDpSSeGAskQETrtR/5h7VqgIlBA==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-vuex/-/cli-plugin-vuex-5.0.9.tgz",
+      "integrity": "sha512-AQhgGNFVd4Pu2crvS0a+hRckgrJv07gzOASdbLd3I72wkT43dd01MLRp8IBRRsu92t3MXenW86AZUCbQBz3//A==",
       "dev": true,
       "peerDependencies": {
         "@vue/cli-service": "^3.0.0 || ^4.0.0 || ^5.0.0-0"
       }
     },
     "node_modules/@vue/cli-service": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-service/-/cli-service-5.0.8.tgz",
-      "integrity": "sha512-nV7tYQLe7YsTtzFrfOMIHc5N2hp5lHG2rpYr0aNja9rNljdgcPZLyQRb2YRivTHqTv7lI962UXFURcpStHgyFw==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-service/-/cli-service-5.0.9.tgz",
+      "integrity": "sha512-yTX7GVyM19tEbd+y5/gA6MkVKA6K61nVYHYAivD61Hx6odVFmQsaC3/R3cWAHM1P5oVKCevBbumPljbT+tFG2w==",
       "dev": true,
       "dependencies": {
         "@babel/helper-compilation-targets": "^7.12.16",
         "@soda/friendly-errors-webpack-plugin": "^1.8.0",
         "@soda/get-current-script": "^1.0.2",
         "@types/minimist": "^1.2.0",
-        "@vue/cli-overlay": "^5.0.8",
-        "@vue/cli-plugin-router": "^5.0.8",
-        "@vue/cli-plugin-vuex": "^5.0.8",
-        "@vue/cli-shared-utils": "^5.0.8",
+        "@vue/cli-overlay": "^5.0.9",
+        "@vue/cli-plugin-router": "^5.0.9",
+        "@vue/cli-plugin-vuex": "^5.0.9",
+        "@vue/cli-shared-utils": "^5.0.9",
         "@vue/component-compiler-utils": "^3.3.0",
         "@vue/vue-loader-v15": "npm:vue-loader@^15.9.7",
         "@vue/web-component-wrapper": "^1.3.0",
@@ -3032,9 +3032,9 @@
       }
     },
     "node_modules/@vue/cli-shared-utils": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-shared-utils/-/cli-shared-utils-5.0.8.tgz",
-      "integrity": "sha512-uK2YB7bBVuQhjOJF+O52P9yFMXeJVj7ozqJkwYE9PlMHL1LMHjtCYm4cSdOebuPzyP+/9p0BimM/OqxsevIopQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-shared-utils/-/cli-shared-utils-5.0.9.tgz",
+      "integrity": "sha512-lf4KykiG8j9KwvNVi7fKtASmHuLsxCcCsflVU2b2CHMRuR4weOIV3zuuCrjWKjk0APn/MHJhgCjJGzHMbTtd5w==",
       "dev": true,
       "dependencies": {
         "@achrinza/node-ipc": "^9.2.5",
@@ -3699,13 +3699,13 @@
       }
     },
     "node_modules/babel-loader": {
-      "version": "8.2.2",
-      "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.2.2.tgz",
-      "integrity": "sha512-JvTd0/D889PQBtUXJ2PXaKU/pjZDMtHA9V2ecm+eNRmmBCMR09a+fmpGTNwnJtFmFl5Ei7Vy47LjBb+L0wQ99g==",
+      "version": "8.4.1",
+      "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.4.1.tgz",
+      "integrity": "sha512-nXzRChX+Z1GoE6yWavBQg6jDslyFF3SDjl2paADuoQtQW10JqShJt62R6eJQ5m/pjJFDT8xgKIWSP85OY8eXeA==",
       "dev": true,
       "dependencies": {
         "find-cache-dir": "^3.3.1",
-        "loader-utils": "^1.4.0",
+        "loader-utils": "^2.0.4",
         "make-dir": "^3.1.0",
         "schema-utils": "^2.6.5"
       },
@@ -3717,6 +3717,20 @@
         "webpack": ">=2"
       }
     },
+    "node_modules/babel-loader/node_modules/loader-utils": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+      "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+      "dev": true,
+      "dependencies": {
+        "big.js": "^5.2.2",
+        "emojis-list": "^3.0.0",
+        "json5": "^2.1.2"
+      },
+      "engines": {
+        "node": ">=8.9.0"
+      }
+    },
     "node_modules/babel-plugin-dynamic-import-node": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/babel-plugin-dynamic-import-node/-/babel-plugin-dynamic-import-node-2.3.3.tgz",
@@ -7292,9 +7306,9 @@
       "dev": true
     },
     "node_modules/json5": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-      "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true,
       "bin": {
         "json5": "lib/cli.js"
@@ -7417,9 +7431,9 @@
       }
     },
     "node_modules/loader-utils/node_modules/json5": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-      "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+      "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
       "dev": true,
       "dependencies": {
         "minimist": "^1.2.0"
@@ -13858,9 +13872,9 @@
       }
     },
     "@vue/cli-overlay": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-overlay/-/cli-overlay-5.0.8.tgz",
-      "integrity": "sha512-KmtievE/B4kcXp6SuM2gzsnSd8WebkQpg3XaB6GmFh1BJGRqa1UiW9up7L/Q67uOdTigHxr5Ar2lZms4RcDjwQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-overlay/-/cli-overlay-5.0.9.tgz",
+      "integrity": "sha512-aBdZWrYKxLuFz1FDsk/muFD7GycrsW73Gi11yRc7R2W7Bm8mDRc9HKAI790gdg4NV+chkDFmfkegjg5iMDEpAA==",
       "dev": true
     },
     "@vue/cli-plugin-babel": {
@@ -13971,35 +13985,35 @@
       }
     },
     "@vue/cli-plugin-router": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-router/-/cli-plugin-router-5.0.8.tgz",
-      "integrity": "sha512-Gmv4dsGdAsWPqVijz3Ux2OS2HkMrWi1ENj2cYL75nUeL+Xj5HEstSqdtfZ0b1q9NCce+BFB6QnHfTBXc/fCvMg==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-router/-/cli-plugin-router-5.0.9.tgz",
+      "integrity": "sha512-kopbO/8kIl5CAffwgptXEwV509i+M0FfwW4sSkgQ2RzpxOYBjQZvp+096mjZfFcWKSmryNP/ri/Mnu78vmhlhw==",
       "dev": true,
       "requires": {
-        "@vue/cli-shared-utils": "^5.0.8"
+        "@vue/cli-shared-utils": "^5.0.9"
       }
     },
     "@vue/cli-plugin-vuex": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-vuex/-/cli-plugin-vuex-5.0.8.tgz",
-      "integrity": "sha512-HSYWPqrunRE5ZZs8kVwiY6oWcn95qf/OQabwLfprhdpFWAGtLStShjsGED2aDpSSeGAskQETrtR/5h7VqgIlBA==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-vuex/-/cli-plugin-vuex-5.0.9.tgz",
+      "integrity": "sha512-AQhgGNFVd4Pu2crvS0a+hRckgrJv07gzOASdbLd3I72wkT43dd01MLRp8IBRRsu92t3MXenW86AZUCbQBz3//A==",
       "dev": true,
       "requires": {}
     },
     "@vue/cli-service": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-service/-/cli-service-5.0.8.tgz",
-      "integrity": "sha512-nV7tYQLe7YsTtzFrfOMIHc5N2hp5lHG2rpYr0aNja9rNljdgcPZLyQRb2YRivTHqTv7lI962UXFURcpStHgyFw==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-service/-/cli-service-5.0.9.tgz",
+      "integrity": "sha512-yTX7GVyM19tEbd+y5/gA6MkVKA6K61nVYHYAivD61Hx6odVFmQsaC3/R3cWAHM1P5oVKCevBbumPljbT+tFG2w==",
       "dev": true,
       "requires": {
         "@babel/helper-compilation-targets": "^7.12.16",
         "@soda/friendly-errors-webpack-plugin": "^1.8.0",
         "@soda/get-current-script": "^1.0.2",
         "@types/minimist": "^1.2.0",
-        "@vue/cli-overlay": "^5.0.8",
-        "@vue/cli-plugin-router": "^5.0.8",
-        "@vue/cli-plugin-vuex": "^5.0.8",
-        "@vue/cli-shared-utils": "^5.0.8",
+        "@vue/cli-overlay": "^5.0.9",
+        "@vue/cli-plugin-router": "^5.0.9",
+        "@vue/cli-plugin-vuex": "^5.0.9",
+        "@vue/cli-shared-utils": "^5.0.9",
         "@vue/component-compiler-utils": "^3.3.0",
         "@vue/vue-loader-v15": "npm:vue-loader@^15.9.7",
         "@vue/web-component-wrapper": "^1.3.0",
@@ -14061,9 +14075,9 @@
       }
     },
     "@vue/cli-shared-utils": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/@vue/cli-shared-utils/-/cli-shared-utils-5.0.8.tgz",
-      "integrity": "sha512-uK2YB7bBVuQhjOJF+O52P9yFMXeJVj7ozqJkwYE9PlMHL1LMHjtCYm4cSdOebuPzyP+/9p0BimM/OqxsevIopQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@vue/cli-shared-utils/-/cli-shared-utils-5.0.9.tgz",
+      "integrity": "sha512-lf4KykiG8j9KwvNVi7fKtASmHuLsxCcCsflVU2b2CHMRuR4weOIV3zuuCrjWKjk0APn/MHJhgCjJGzHMbTtd5w==",
       "dev": true,
       "requires": {
         "@achrinza/node-ipc": "^9.2.5",
@@ -14586,15 +14600,28 @@
       }
     },
     "babel-loader": {
-      "version": "8.2.2",
-      "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.2.2.tgz",
-      "integrity": "sha512-JvTd0/D889PQBtUXJ2PXaKU/pjZDMtHA9V2ecm+eNRmmBCMR09a+fmpGTNwnJtFmFl5Ei7Vy47LjBb+L0wQ99g==",
+      "version": "8.4.1",
+      "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.4.1.tgz",
+      "integrity": "sha512-nXzRChX+Z1GoE6yWavBQg6jDslyFF3SDjl2paADuoQtQW10JqShJt62R6eJQ5m/pjJFDT8xgKIWSP85OY8eXeA==",
       "dev": true,
       "requires": {
         "find-cache-dir": "^3.3.1",
-        "loader-utils": "^1.4.0",
+        "loader-utils": "^2.0.4",
         "make-dir": "^3.1.0",
         "schema-utils": "^2.6.5"
+      },
+      "dependencies": {
+        "loader-utils": {
+          "version": "2.0.4",
+          "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+          "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+          "dev": true,
+          "requires": {
+            "big.js": "^5.2.2",
+            "emojis-list": "^3.0.0",
+            "json5": "^2.1.2"
+          }
+        }
       }
     },
     "babel-plugin-dynamic-import-node": {
@@ -17164,9 +17191,9 @@
       "dev": true
     },
     "json5": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-      "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true
     },
     "jsonfile": {
@@ -17259,9 +17286,9 @@
       },
       "dependencies": {
         "json5": {
-          "version": "1.0.1",
-          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-          "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+          "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
           "dev": true,
           "requires": {
             "minimist": "^1.2.0"
diff --git a/etc/quiz-app/package.json b/etc/quiz-app/package.json
index 5ba3bd54..63c86ed8 100644
--- a/etc/quiz-app/package.json
+++ b/etc/quiz-app/package.json
@@ -16,7 +16,7 @@
   "devDependencies": {
     "@vue/cli-plugin-babel": "~5.0.8",
     "@vue/cli-plugin-eslint": "~5.0.8",
-    "@vue/cli-service": "~5.0.8",
+    "@vue/cli-service": "~5.0.9",
     "babel-eslint": "^10.1.0",
     "eslint": "^9.33.0",
     "eslint-plugin-vue": "^10.4.0",

From 955eaa9910b50212c304187b2a6b4691b2d16352 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 11:11:13 +0100
Subject: [PATCH 11/24] Fix scorecard artifact upload action

---
 .github/workflows/scorecard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 92b6872b..30909edd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -59,9 +59,9 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+        uses: actions/upload-artifact@v7
         with:
-          name: SARIF file
+          name: results-sarif
           path: results.sarif
           retention-days: 5
 

From 64424b6638c74899b23411436a88e56990339b75 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 11:27:15 +0100
Subject: [PATCH 12/24] Fix main workflow and dependency update errors

---
 .github/workflows/scorecard.yml |  4 +-
 etc/quiz-app/package-lock.json  | 87 ++++++++++++++++++++-------------
 etc/quiz-app/package.json       |  9 ++++
 3 files changed, 65 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 92b6872b..30909edd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -59,9 +59,9 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+        uses: actions/upload-artifact@v7
         with:
-          name: SARIF file
+          name: results-sarif
           path: results.sarif
           retention-days: 5
 
diff --git a/etc/quiz-app/package-lock.json b/etc/quiz-app/package-lock.json
index 2f7e6bd6..98fdef15 100644
--- a/etc/quiz-app/package-lock.json
+++ b/etc/quiz-app/package-lock.json
@@ -21,6 +21,15 @@
         "eslint": "^9.33.0",
         "eslint-plugin-vue": "^10.4.0",
         "vue-template-compiler": "^2.6.11"
+      },
+      "overrides": {
+        "postcss": "8.5.12",
+        "@vue/vue-loader-v15": {
+          "loader-utils": "1.4.2"
+        },
+        "vue-style-loader": {
+          "loader-utils": "1.4.2"
+        }
       }
     },
     "node_modules/@achrinza/node-ipc": {
@@ -3196,20 +3205,31 @@
       "dev": true
     },
     "node_modules/@vue/component-compiler-utils/node_modules/postcss": {
-      "version": "7.0.39",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
+      "version": "8.5.12",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+      "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
       "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
       "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
       },
       "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
+        "node": "^10 || ^12 || >=14"
       }
     },
     "node_modules/@vue/component-compiler-utils/node_modules/yallist": {
@@ -7417,9 +7437,9 @@
       }
     },
     "node_modules/loader-utils": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz",
-      "integrity": "sha512-qH0WSMBtn/oHuwjy/NucEgbx5dbxxnxup9s4PVXJUDHZBQY+s0NWA9rJf53RBnQZxfch7euUui7hpoAPvALZdA==",
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.2.tgz",
+      "integrity": "sha512-I5d00Pd/jwMD2QCduo657+YM/6L3KZu++pmX9VFncxaxvHcru9jx1lBaFft+r4Mt2jK0Yhp41XlRAihzPxHNCg==",
       "dev": true,
       "dependencies": {
         "big.js": "^5.2.2",
@@ -8723,9 +8743,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.4.25",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.25.tgz",
-      "integrity": "sha512-7taJ/8t2av0Z+sQEvNzCkpDynl0tX3uJMCODi6nT3PfASC7dYCWV9aQ+uiCf+KBD4SEFcu+GvJdGdwzQ6OSjCw==",
+      "version": "8.5.12",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+      "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
       "dev": true,
       "funding": [
         {
@@ -8742,9 +8762,9 @@
         }
       ],
       "dependencies": {
-        "nanoid": "^3.3.6",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
       },
       "engines": {
         "node": "^10 || ^12 || >=14"
@@ -14209,13 +14229,14 @@
           "dev": true
         },
         "postcss": {
-          "version": "7.0.39",
-          "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
+          "version": "8.5.12",
+          "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+          "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
           "dev": true,
           "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
+            "nanoid": "^3.3.11",
+            "picocolors": "^1.1.1",
+            "source-map-js": "^1.2.1"
           }
         },
         "yallist": {
@@ -17275,9 +17296,9 @@
       "dev": true
     },
     "loader-utils": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz",
-      "integrity": "sha512-qH0WSMBtn/oHuwjy/NucEgbx5dbxxnxup9s4PVXJUDHZBQY+s0NWA9rJf53RBnQZxfch7euUui7hpoAPvALZdA==",
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.2.tgz",
+      "integrity": "sha512-I5d00Pd/jwMD2QCduo657+YM/6L3KZu++pmX9VFncxaxvHcru9jx1lBaFft+r4Mt2jK0Yhp41XlRAihzPxHNCg==",
       "dev": true,
       "requires": {
         "big.js": "^5.2.2",
@@ -18283,14 +18304,14 @@
       }
     },
     "postcss": {
-      "version": "8.4.25",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.25.tgz",
-      "integrity": "sha512-7taJ/8t2av0Z+sQEvNzCkpDynl0tX3uJMCODi6nT3PfASC7dYCWV9aQ+uiCf+KBD4SEFcu+GvJdGdwzQ6OSjCw==",
+      "version": "8.5.12",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+      "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
       "dev": true,
       "requires": {
-        "nanoid": "^3.3.6",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
       }
     },
     "postcss-calc": {
diff --git a/etc/quiz-app/package.json b/etc/quiz-app/package.json
index 63c86ed8..c9a1bf0c 100644
--- a/etc/quiz-app/package.json
+++ b/etc/quiz-app/package.json
@@ -22,6 +22,15 @@
     "eslint-plugin-vue": "^10.4.0",
     "vue-template-compiler": "^2.6.11"
   },
+  "overrides": {
+    "postcss": "8.5.12",
+    "@vue/vue-loader-v15": {
+      "loader-utils": "1.4.2"
+    },
+    "vue-style-loader": {
+      "loader-utils": "1.4.2"
+    }
+  },
   "eslintConfig": {
     "root": true,
     "env": {

From 724c5d23a0e03e5ce1072da6770980e9e5907abf Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 13:04:17 +0100
Subject: [PATCH 13/24] ci(scorecard): fix invalid action version constraints

---
 .github/workflows/scorecard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 720e31b7..71a27bac 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -59,7 +59,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
         with:
           name: results-sarif
           path: results.sarif
@@ -78,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Download SARIF artifact"
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@v4
         with:
           name: results-sarif
 

From 02dc069c3c0d8df9260ca626756dcfdfef9a00a1 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 13:19:47 +0100
Subject: [PATCH 14/24] ci(scorecard): disable publish_results on fork to fix
 api limits

---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 71a27bac..5fc3e5b4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -54,7 +54,7 @@ jobs:
           # For private repositories:
           #   - `publish_results` will always be set to `false`, regardless
           #     of the value entered here.
-          publish_results: true
+          publish_results: false
 
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.

From 36c31ce9e63c59e6a818af37e000de4955724927 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 14:09:36 +0100
Subject: [PATCH 15/24] ci: configure scorecard api token and update actions
 permissions

---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5fc3e5b4..430b39bd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -45,7 +45,7 @@ jobs:
           # - you want to enable the Branch-Protection check on a *public* repository, or
           # - you are installing Scorecard on a *private* repository
           # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
-          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+          repo_token: ${{ secrets.SCORECARD_TOKEN }}
 
           # Public repositories:
           #   - Publish results to OpenSSF REST API for easy access by consumers

From 34fb877d0a080e7659830afa35fcb57f9c5ff8dd Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 14:26:48 +0100
Subject: [PATCH 16/24] ci: uncomment scorecard token to activate
 authentication

---
 .github/workflows/scorecard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 430b39bd..3008cbf3 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -10,9 +10,9 @@ on:
   # To guarantee Maintained check is occasionally updated. See
   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
   schedule:
-    - cron: '44 15 * * 5'
+    - cron: "44 15 * * 5"
   push:
-    branches: [ "main" ]
+    branches: ["main"]
 
 # Declare default permissions as read only.
 permissions: read-all

From 695d31faa74fb716a337e43ef9b1b0bbb9c08426 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 14:40:06 +0100
Subject: [PATCH 17/24] ci: update scorecard token verification rules

---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3008cbf3..881144ac 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -54,7 +54,7 @@ jobs:
           # For private repositories:
           #   - `publish_results` will always be set to `false`, regardless
           #     of the value entered here.
-          publish_results: false
+          publish_results: true
 
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.

From beccfdbc57c2b3d6fec7d295abad5e9175c37057 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 14:49:25 +0100
Subject: [PATCH 18/24] ci(scorecard): standardize checkout action version and
 verify token parameters

---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 881144ac..d8fa646f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ffd01eeb3 # v6.0.0
+        uses: actions/checkout@v4 # v6.0.0
         with:
           persist-credentials: false
 

From 630a965b50d139b1e0f08c10929f5c03d2e119b3 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 15:00:00 +0100
Subject: [PATCH 19/24] ci(pages): skip deployment step on fork repositories

---
 .github/workflows/deploy-pages.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 429c9075..1ab497a0 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -16,11 +16,12 @@ concurrency:
 
 jobs:
   deploy:
+    if: github.repository == 'microsoft/AI-For-Beginners'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
-    
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -31,7 +32,7 @@ jobs:
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with:
-          path: '.'
+          path: "."
 
       - name: Deploy to GitHub Pages
         id: deployment

From fba0076a01eb8194e5f30fa24cca54256b0b7623 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Fri, 24 Jul 2026 15:09:48 +0100
Subject: [PATCH 20/24] ci(pages): reset path to root and add missing id-token
 permission permissions

---
 .github/workflows/deploy-pages.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 1ab497a0..0969f0db 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -9,6 +9,7 @@ on:
 permissions:
   contents: read
   pages: write
+  id-token: write
 
 concurrency:
   group: pages
@@ -16,7 +17,6 @@ concurrency:
 
 jobs:
   deploy:
-    if: github.repository == 'microsoft/AI-For-Beginners'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

From f0b072fae895e1c0bb671d411cb16d73507bf0e0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 15:14:14 +0000
Subject: [PATCH 21/24] chore(deps-dev): bump fast-uri from 3.1.3 to 3.1.5 in
 /etc/quiz-app

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.5.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.5)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 etc/quiz-app/package-lock.json | 108 ++++++++-------------------------
 1 file changed, 24 insertions(+), 84 deletions(-)

diff --git a/etc/quiz-app/package-lock.json b/etc/quiz-app/package-lock.json
index 98fdef15..5b104ec3 100644
--- a/etc/quiz-app/package-lock.json
+++ b/etc/quiz-app/package-lock.json
@@ -21,15 +21,6 @@
         "eslint": "^9.33.0",
         "eslint-plugin-vue": "^10.4.0",
         "vue-template-compiler": "^2.6.11"
-      },
-      "overrides": {
-        "postcss": "8.5.12",
-        "@vue/vue-loader-v15": {
-          "loader-utils": "1.4.2"
-        },
-        "vue-style-loader": {
-          "loader-utils": "1.4.2"
-        }
       }
     },
     "node_modules/@achrinza/node-ipc": {
@@ -3198,40 +3189,6 @@
         "yallist": "^2.1.2"
       }
     },
-    "node_modules/@vue/component-compiler-utils/node_modules/picocolors": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz",
-      "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==",
-      "dev": true
-    },
-    "node_modules/@vue/component-compiler-utils/node_modules/postcss": {
-      "version": "8.5.12",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
-      "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "dependencies": {
-        "nanoid": "^3.3.11",
-        "picocolors": "^1.1.1",
-        "source-map-js": "^1.2.1"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
     "node_modules/@vue/component-compiler-utils/node_modules/yallist": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
@@ -6184,9 +6141,9 @@
       "dev": true
     },
     "node_modules/fast-uri": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
-      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "dev": true,
       "funding": [
         {
@@ -8086,9 +8043,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
-      "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==",
+      "version": "3.3.17",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
       "dev": true,
       "funding": [
         {
@@ -10189,9 +10146,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz",
-      "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "dev": true,
       "engines": {
         "node": ">=0.10.0"
@@ -14066,7 +14023,7 @@
         "minimist": "^1.2.5",
         "module-alias": "^2.2.2",
         "portfinder": "^1.0.26",
-        "postcss": "^8.2.6",
+        "postcss": "8.5.12",
         "postcss-loader": "^6.1.1",
         "progress-webpack-plugin": "^1.0.12",
         "ssri": "^8.0.1",
@@ -14199,7 +14156,7 @@
         "hash-sum": "^1.0.2",
         "lru-cache": "^4.1.2",
         "merge-source-map": "^1.1.0",
-        "postcss": "^7.0.36",
+        "postcss": "8.5.12",
         "postcss-selector-parser": "^6.0.2",
         "prettier": "^1.18.2 || ^2.0.0",
         "source-map": "~0.6.1",
@@ -14222,23 +14179,6 @@
             "yallist": "^2.1.2"
           }
         },
-        "picocolors": {
-          "version": "0.2.1",
-          "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz",
-          "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==",
-          "dev": true
-        },
-        "postcss": {
-          "version": "8.5.12",
-          "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
-          "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
-          "dev": true,
-          "requires": {
-            "nanoid": "^3.3.11",
-            "picocolors": "^1.1.1",
-            "source-map-js": "^1.2.1"
-          }
-        },
         "yallist": {
           "version": "2.1.2",
           "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
@@ -14255,7 +14195,7 @@
       "requires": {
         "@vue/component-compiler-utils": "^3.1.0",
         "hash-sum": "^1.0.2",
-        "loader-utils": "^1.1.0",
+        "loader-utils": "1.4.2",
         "vue-hot-reload-api": "^2.3.0",
         "vue-style-loader": "^4.1.0"
       },
@@ -15350,7 +15290,7 @@
       "dev": true,
       "requires": {
         "icss-utils": "^5.1.0",
-        "postcss": "^8.4.21",
+        "postcss": "8.5.12",
         "postcss-modules-extract-imports": "^3.0.0",
         "postcss-modules-local-by-default": "^4.0.3",
         "postcss-modules-scope": "^3.0.0",
@@ -15393,7 +15333,7 @@
       "requires": {
         "cssnano": "^5.0.6",
         "jest-worker": "^27.0.2",
-        "postcss": "^8.3.5",
+        "postcss": "8.5.12",
         "schema-utils": "^4.0.0",
         "serialize-javascript": "^6.0.0",
         "source-map": "^0.6.1"
@@ -16402,9 +16342,9 @@
       "dev": true
     },
     "fast-uri": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
-      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "dev": true
     },
     "fastq": {
@@ -17806,9 +17746,9 @@
       }
     },
     "nanoid": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
-      "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==",
+      "version": "3.3.17",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
       "dev": true
     },
     "natural-compare": {
@@ -19328,9 +19268,9 @@
       "dev": true
     },
     "source-map-js": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz",
-      "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "dev": true
     },
     "source-map-support": {
@@ -19974,7 +19914,7 @@
       "dev": true,
       "requires": {
         "hash-sum": "^1.0.2",
-        "loader-utils": "^1.0.2"
+        "loader-utils": "1.4.2"
       },
       "dependencies": {
         "hash-sum": {

From a76c368e97d8fa2595afa3d6827de80e448cfcef Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 11:17:17 +0000
Subject: [PATCH 22/24] chore(deps): bump keras from 3.13.2 to 3.15.0 in
 /.devcontainer

Bumps [keras](https://github.com/keras-team/keras) from 3.13.2 to 3.15.0.
- [Release notes](https://github.com/keras-team/keras/releases)
- [Commits](https://github.com/keras-team/keras/compare/v3.13.2...v3.15.0)

---
updated-dependencies:
- dependency-name: keras
  dependency-version: 3.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .devcontainer/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.devcontainer/requirements.txt b/.devcontainer/requirements.txt
index bd2693a3..34e4a4e9 100644
--- a/.devcontainer/requirements.txt
+++ b/.devcontainer/requirements.txt
@@ -2,7 +2,7 @@ gensim==4.3.3
 gym==0.26.2
 huggingface==0.0.1
 imageio==2.35.0
-keras==3.13.2
+keras==3.15.0
 nltk==3.10.0
 pandas==2.2.2
 pillow==12.2.0

From b77cedaff70a51eed143bcd557d3062a4c3b1dbd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 11:53:44 +0000
Subject: [PATCH 23/24] chore(deps): bump keras from 3.13.2 to 3.15.0 in
 /binder

Bumps [keras](https://github.com/keras-team/keras) from 3.13.2 to 3.15.0.
- [Release notes](https://github.com/keras-team/keras/releases)
- [Commits](https://github.com/keras-team/keras/compare/v3.13.2...v3.15.0)

---
updated-dependencies:
- dependency-name: keras
  dependency-version: 3.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 binder/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/binder/requirements.txt b/binder/requirements.txt
index 50e538f9..7730c523 100644
--- a/binder/requirements.txt
+++ b/binder/requirements.txt
@@ -2,7 +2,7 @@ gensim==4.3.3
 gym==0.26.2
 huggingface==0.0.1
 imageio==2.35.0
-keras==3.13.2
+keras==3.15.0
 nltk==3.10.0
 pandas==2.0.3
 pillow==12.3.0

From bcbc29e0598813dd6c33cd60ebbf4ce1611e9702 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 10 Aug 2026 14:34:44 +0000
Subject: [PATCH 24/24] chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 in
 /etc/quiz-app

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 etc/quiz-app/package-lock.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/etc/quiz-app/package-lock.json b/etc/quiz-app/package-lock.json
index 5b104ec3..348a2c06 100644
--- a/etc/quiz-app/package-lock.json
+++ b/etc/quiz-app/package-lock.json
@@ -7219,9 +7219,9 @@
       "dev": true
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
@@ -17107,9 +17107,9 @@
       "dev": true
     },
     "js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "requires": {
         "argparse": "^2.0.1"