Skip to content

chore(deps): upgrade all dependencies (bullmq 6, ioredis 6, simplewebauthn 14) - #241

Merged
ralyodio merged 1 commit into
mainfrom
chore/deps-2026-10-26
Oct 26, 2026
Merged

chore(deps): upgrade all dependencies (bullmq 6, ioredis 6, simplewebauthn 14)#241
ralyodio merged 1 commit into
mainfrom
chore/deps-2026-10-26

Conversation

@ralyodio

@ralyodio ralyodio commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Fleet dependency upgrade.

  • No Next.js in this repo (Bun + Hono).
  • Majors taken: bullmq 5 -> 6 (packages/queue/src/retention.js now reads the raw Redis client from queue.getBackend().client; the retention suite failed 3/9 without it), ioredis 5 -> 6, @simplewebauthn/browser + server 13 -> 14 (API used is unchanged), @profullstack/coinpay 0.8 -> 0.25 (declared, not imported)
  • Also: hono 4.13.14, @profullstack/profile 0.1.6, notifications 0.1.4, throttle 0.3.4, leaderboard 0.3.1, @logicsrc/openaccess 0.3.1, footer 0.2.6 (spec stays latest), @biomejs/biome 2.6.3 (biome migrate; Markdown/YAML excluded from biome since 2.6 started formatting them), @electric-sql/pglite 0.5.11
  • Overrides: sharp ^0.35.5, tmp ^0.2.6 (both dev-only via @profullstack/favicon-generator; build:brand still runs)
  • Bun 1.4.0 -> 1.4.4 (Docker image, packageManager, CI)
  • Held: none
  • No migrations added or run.
  • Audit: 0 critical / 5 high -> 0 / 0 (bun audit clean)

Local gate: biome check, bun test 2564 pass / 0 fail, queue suite against a throwaway Redis (REDIS_TEST_URL) 13/13, build:client, police-source-discovery.test.py.

🤖 Generated with Claude Code

@ralyodio @claude
chore(deps): upgrade all dependencies; bullmq 6, ioredis 6, simpleweb…
7060af1 
…authn 14

bullmq 6 moved the raw Redis client to queue.getBackend().client; retention.js
reads it there (falls back to queue.client). Overrides sharp ^0.35.5 and tmp ^0.2.6
(dev-only via favicon-generator). biome 2.6 migrate; md/yaml left out of biome.
Bun 1.4.4 (image, packageManager, CI).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

socket-security Bot commented Oct 26, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​profullstack/​notifications@​0.1.3 ⏵ 0.1.475 +110097 +388100
Updated@​profullstack/​profile@​0.1.2 ⏵ 0.1.676 +1100100 +191100
Updated@​logicsrc/​openaccess@​0.3.0 ⏵ 0.3.17610093 +190100
Updated@​profullstack/​throttle@​0.3.3 ⏵ 0.3.478 +1100100 +195 +1100
Updated@​profullstack/​footer@​0.2.5 ⏵ 0.2.678 +1100100 +194 +1100
Updated@​electric-sql/​pglite@​0.5.8 ⏵ 0.5.119410099 +197 +480
Updated@​profullstack/​coinpay@​0.8.0 ⏵ 0.25.081 +9100100 +198 +4100
Updated@​simplewebauthn/​browser@​13.3.0 ⏵ 14.0.0100 +110092 +284100
Updated@​simplewebauthn/​server@​13.3.3 ⏵ 14.0.39810088 +292 +1100
Updatedioredis@​5.11.1 ⏵ 6.0.09410010091 +2100
Updatedbullmq@​5.81.4 ⏵ 6.4.293 -110010096 +1100
Updatedhono@​4.13.7 ⏵ 4.13.14100 +1100 +29796 +2100
Updated@​biomejs/​biome@​2.5.12 ⏵ 2.6.3100100100 +199 +2100

View full report

@socket-security

socket-security Bot commented Oct 26, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
Low adoption: npm @logicsrc/openaccess

Location: Package overview

From: apps/web/package.json → npm/@logicsrc/openaccess@0.3.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@logicsrc/openaccess@0.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

@ralyodio
ralyodio merged commit 608745a into main Oct 26, 2026
3 checks passed
@ralyodio
ralyodio deleted the chore/deps-2026-10-26 branch October 26, 2026 13:17
@ralyodio ralyodio mentioned this pull request Oct 26, 2026
Merged
ralyodio added a commit that referenced this pull request Oct 26, 2026
@ralyodio @claude
Revert "chore(deps): upgrade all dependencies" (#241): nichedb.dev cr…
8256a0c 
…ash-loops (#243)

bullmq 6 removed queue.getRepeatableJobs(); installSchedules throws at boot
and the app restarts forever (502). Restore prod first; the upgrade re-lands
with installSchedules on the job-scheduler API.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
ralyodio added a commit that referenced this pull request Oct 26, 2026
@ralyodio @claude
fix(queue): BullMQ 6 job schedulers — nichedb.dev is down (boot crash…
4a1125e 
… since #241) (#242)

* fix(sports): no broadcastSource on TheSportsDB fixtures without a broadcaster

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(queue): BullMQ 6 job schedulers; prod crash-looped on getRepeatableJobs

#241 moved to bullmq 6, which dropped repeatable jobs: getRepeatableJobs
and removeRepeatableByKey are gone (boot crash: 'queue.getRepeatableJobs
is not a function') and add(..., {repeat}) silently adds one plain job.
installSchedules now upserts job schedulers and removes every scheduler
the code does not name, which also clears the 5.x repeatables in Redis
(verified against a real Redis: v6 lists them by key and removes them).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio ralyodio mentioned this pull request Oct 26, 2026
Merged
ralyodio added a commit that referenced this pull request Oct 26, 2026
@ralyodio @claude
chore(deps): re-land dependency upgrade on bullmq 6 job schedulers (#244
ea756dc 
)

Re-lands #241 (reverted in #243) on top of #242, which ported installSchedules
to upsertJobScheduler/getJobSchedulers/removeJobScheduler. Adds a Redis-backed
test that runs installSchedules twice in a child process (fails on the old
getRepeatableJobs code with 'is not a function').

bullmq 6, ioredis 6, simplewebauthn 14, coinpay 0.25; retention.js reads the raw
client from queue.getBackend().client. Overrides sharp ^0.35.5, tmp ^0.2.6.
biome 2.6 migrate; md/yaml left out of biome. Bun 1.4.4.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ralyodio