Skip to content

chore: update dependencies and resolve security alerts - #150

Merged
Anush008 merged 2 commits into
masterfrom
stack-upgrade
Jul 3, 2026
Merged

chore: update dependencies and resolve security alerts#150
Anush008 merged 2 commits into
masterfrom
stack-upgrade

Conversation

@Anush008

@Anush008 Anush008 commented Jul 1, 2026

Copy link
Copy Markdown
Member

Description

This PR updates the dependency stack to the latest compatible versions and resolves all 52 Dependabot alerts.

Notes

@Anush008
Anush008 merged commit 58ddf87 into master Jul 3, 2026
7 checks passed
@Anush008
Anush008 deleted the stack-upgrade branch July 3, 2026 19:10
IvanPleshkov added a commit that referenced this pull request Aug 3, 2026
#150 raised openapi-typescript from ^6.2.6 to ^7.13.0 without regenerating the
client, so the incompatibility with @qdrant/openapi-typescript-fetch@1.2.6 went
unnoticed until this release regenerated. Put the range back exactly as it was
before that bump rather than hard-pinning: it is a dev dependency, the lockfile
still resolves 6.2.6, and the generated output is unchanged.

Also drop the notes this branch added to how_to_release.md, leaving it as it is
on master.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
IvanPleshkov added a commit that referenced this pull request Aug 3, 2026
Regenerate both clients from the qdrant `dev` branch and bump to 1.19.0.

gRPC: memory placement (`Memory` enum on vector/index/quantization params,
`PayloadStorageParams`), keyword prefix matching, `SliceCondition`, per-request
IDF corpus, `Datatype::Turbo4`, `max_disk_usage_percent`, explicit no-stemming.
The search/recommend/discover RPCs are marked deprecated upstream.

REST: same feature set. Qdrant also dropped the eight deprecated
search/recommend/discover endpoints from its OpenAPI spec (qdrant/qdrant#9982),
so the generator no longer emits them, but the actix handlers still serve
traffic. They are preserved by hand in `src/openapi/deprecated_*.ts` and marked
`@deprecated` in `qdrant-client.ts`, matching the additive-only line the Rust
and Go clients took for 1.19.

Also:

- Pin `openapi-typescript` back to 6.2.6. It was bumped to ^7.13.0 in #150
  without regenerating; v7 emits `requestBody?: never`, which collapses
  `OpArgType` to `never` in `@qdrant/openapi-typescript-fetch@1.2.6` and breaks
  every call site. Later 6.x patches widen nullable `anyOf` fields such as
  `ScoredPoint.payload` to `unknown`.
- Teach `generate_client_construction.ts` to skip semicolons inside doc
  comments; the rewritten `/readyz` description contains one and split an
  interface member in half.
- Forward `payload` and `metadata` from `createCollection`/`recreateCollection`
  (`metadata` was missed in 1.18).
- Cover the new API surface in the REST integration tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
IvanPleshkov added a commit that referenced this pull request Aug 3, 2026
#150 raised openapi-typescript from ^6.2.6 to ^7.13.0 without regenerating the
client, so the incompatibility with @qdrant/openapi-typescript-fetch@1.2.6 went
unnoticed until this release regenerated. Put the range back exactly as it was
before that bump rather than hard-pinning: it is a dev dependency, the lockfile
still resolves 6.2.6, and the generated output is unchanged.

Also drop the notes this branch added to how_to_release.md, leaving it as it is
on master.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants