chore(deps): bump npm minor/patch group, redis 6, tar, simple-import-sort

[kubo6472]

Consolidates Dependabot PRs #469, #470, #471 (partial), and #472 into one lockfile-consistent update on current main.

Included

Package	Notes
eslint, globals, knip, nuxt, prettier, typescript-eslint, @vue/language-core, vue-tsc	Root tooling minor/patch
eslint-plugin-simple-import-sort	13 → 14 (#469)
@sentry/cloudflare, @sentry/nuxt	→ 10.69
wrangler, @cloudflare/workers-types, @types/node	Cloudflare / Node types
@aws-sdk/client-s3, @aws-sdk/s3-request-presigner	→ 3.1098+
@stripe/stripe-js, @tiptap/* (incl. pm)	Web editor / checkout
redis	5 → ^6.1 (#470); lock resolves 6.2.0 within range
tar	Override ^7.5.22 (#472; transitive via @mapbox/node-pre-gyp)

Code fix for redis 6

• packages/media-pipeline/packagingQueue.ts — use a concrete client type from createClient({ url }) so TypeScript accepts redis@6’s default RESP3 typing (fixes media-pipeline Docker tsc build).

Deferred (with reasons)

Dependabot	Why deferred
typescript 6 → 7 (#468)	typescript-eslint peer still requires typescript@>=4.8.4 <6.1.0 (including latest 8.66.x). npm ci fails without --legacy-peer-deps.
@moq/net / @moq/watch (#471)	0.4.x removes MultiBackend; watch page + composable still use that API. Needs a dedicated MoQ player migration (prefer <moq-watch> element).

Files changed

• package.json / package-lock.json — root deps + tar override (^7.5.22)
• packages/api/package.json — sentry, workers-types, @types/node, wrangler
• packages/api-node/package.json — aws-sdk, sentry, workers-types, @types/node
• packages/storage/package.json — aws-sdk, workers-types, @types/node
• packages/web/package.json — sentry, stripe, tiptap, nuxt, vue-tsc, wrangler, @types/node
• packages/media-pipeline/package.json — redis, @types/node
• packages/media-pipeline/packagingQueue.ts — redis@6 typing
• packages/payments/package.json, packages/offloading/package.json — @types/node

Verification

• npm run typecheck (shared, storage, api, api-node, web)
• npm run verify:api-node
• npm run build --workspace=@vmp/media-pipeline
• CI green on typecheck / api-node / media-pipeline Docker build

After merge, close Dependabot PRs #469–#472 (and #471 if MoQ remains deferred).

  

Summary by CodeRabbit

• Chores
  • Updated platform components and development tooling to newer supported versions.
  • Improved compatibility across cloud services, storage, media processing, payments, and web functionality.
  • Strengthened security and stability through refreshed underlying packages.
  • Updated Redis integration typing while preserving existing connection and reuse behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 85f8163e-77b7-48d8-ab09-111b106e3b81

📥 Commits

Reviewing files that changed from the base of the PR and between 761a648 and ff7f73d.

📒 Files selected for processing (1)

• package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json

---

📝 Walkthrough

Walkthrough

The pull request updates dependency versions and the root tar override across workspace packages. It also changes packaging queue Redis client typing to derive from a configured client factory while preserving cached-client and connection initialization behavior.

Changes

Dependency refresh

Layer / File(s)	Summary
Workspace dependency policy package.json	Development dependency ranges were updated. A tar override now requires version 7.5.22 or newer.
Package dependency refresh packages/api-node/package.json, packages/api/package.json, packages/media-pipeline/package.json, packages/offloading/package.json, packages/payments/package.json, packages/storage/package.json, packages/web/package.json	Package dependency ranges were updated for AWS, Cloudflare, Sentry, Node, Nuxt, Stripe, Tiptap, Wrangler, Vue tooling, and Redis.
Packaging Redis client typing packages/media-pipeline/packagingQueue.ts	Redis client types now derive from a packaging-specific factory. Cached client and connection promise handling remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• tojemoc/vmp#466: Both changes update the redis dependency in packages/media-pipeline/package.json.
• tojemoc/vmp#121: Both changes update Vue and TypeScript tooling related to web type checking.
• tojemoc/vmp#70: Both changes update the wrangler dependency in API and web package manifests.

Suggested labels: dependencies, javascript

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency updates, including Redis 6, the tar override, and simple-import-sort.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/bump-deps-dependabot-944b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit dd404af

Command	Status	Duration	Result
nx affected -t typecheck typecheck:scripts --ba...	✅ Succeeded	2s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-08-04 14:01:50 UTC

[coderabbitai]

🧹 Nitpick comments (1)

package.json (1)

59-60: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Unbounded lower-bound override on tar allows unconstrained future major versions.

The tar override uses ">=7.5.22" with no upper bound, so any future major release of tar (v8, v9, etc.) will be installed transitively without any manual gate. This is riskier than the neighboring ws override on Line 59, which pins an exact version. Since this override was added specifically to remediate a known issue in the ^7.4.0 range used transitively (per the package-lock.json context), a caret range such as "^7.5.22" would satisfy the same remediation while still blocking unreviewed breaking changes from a future major bump.

♻️ Proposed fix to bound the tar override

-    "tar": ">=7.5.22"
+    "tar": "^7.5.22"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 59 - 60, Update the tar override in package.json
from the unbounded >=7.5.22 range to a caret-bounded ^7.5.22 range, preserving
the remediation while preventing automatic adoption of future major versions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@package.json`:
- Around line 59-60: Update the tar override in package.json from the unbounded
>=7.5.22 range to a caret-bounded ^7.5.22 range, preserving the remediation
while preventing automatic adoption of future major versions.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1acb3cf1-3d70-4fee-b2b1-33219b4ce00e

📥 Commits

Reviewing files that changed from the base of the PR and between 9ddc7f4 and 761a648.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (9)

• package.json
• packages/api-node/package.json
• packages/api/package.json
• packages/media-pipeline/package.json
• packages/media-pipeline/packagingQueue.ts
• packages/offloading/package.json
• packages/payments/package.json
• packages/storage/package.json
• packages/web/package.json