chore(deps): bump npm minor/patch group, redis 6, tar, simple-import-sort by kubo6472 · Pull Request #474 · tojemoc/vmp

kubo6472 · 2026-08-04T13:41:11Z

Consolidates Dependabot PRs #469, #470, #471 (partial), and #472 into one lockfile-consistent update on current main.

Included

Package	Notes
eslint, globals, knip, nuxt, prettier, typescript-eslint, @vue/language-core, vue-tsc	Root tooling minor/patch
eslint-plugin-simple-import-sort	13 → 14 (#469)
@sentry/cloudflare, @sentry/nuxt	→ 10.69
wrangler, @cloudflare/workers-types, @types/node	Cloudflare / Node types
@aws-sdk/client-s3, @aws-sdk/s3-request-presigner	→ 3.1098+
@stripe/stripe-js, @tiptap/* (incl. pm)	Web editor / checkout
redis	5 → ^6.1 (#470); lock resolves 6.2.0 within range
tar	Override `^7.5.22` (#472; transitive via `@mapbox/node-pre-gyp`)

Code fix for redis 6

packages/media-pipeline/packagingQueue.ts — use a concrete client type from createClient({ url }) so TypeScript accepts redis@6’s default RESP3 typing (fixes media-pipeline Docker tsc build).

Deferred (with reasons)

Dependabot	Why deferred
typescript 6 → 7 (#468)	`typescript-eslint` peer still requires `typescript@>=4.8.4 <6.1.0` (including latest 8.66.x). `npm ci` fails without `--legacy-peer-deps`.
`@moq/net` / `@moq/watch` (#471)	0.4.x removes `MultiBackend`; watch page + composable still use that API. Needs a dedicated MoQ player migration (prefer `<moq-watch>` element).

Files changed

package.json / package-lock.json — root deps + tar override (^7.5.22)
packages/api/package.json — sentry, workers-types, @types/node, wrangler
packages/api-node/package.json — aws-sdk, sentry, workers-types, @types/node
packages/storage/package.json — aws-sdk, workers-types, @types/node
packages/web/package.json — sentry, stripe, tiptap, nuxt, vue-tsc, wrangler, @types/node
packages/media-pipeline/package.json — redis, @types/node
packages/media-pipeline/packagingQueue.ts — redis@6 typing
packages/payments/package.json, packages/offloading/package.json — @types/node

Verification

npm run typecheck (shared, storage, api, api-node, web)
npm run verify:api-node
npm run build --workspace=@vmp/media-pipeline
CI green on typecheck / api-node / media-pipeline Docker build

After merge, close Dependabot PRs #469–#472 (and #471 if MoQ remains deferred).

Summary by CodeRabbit

Chores
- Updated platform components and development tooling to newer supported versions.
- Improved compatibility across cloud services, storage, media processing, payments, and web functionality.
- Strengthened security and stability through refreshed underlying packages.
- Updated Redis integration typing while preserving existing connection and reuse behavior.

…imple-import-sort Consolidate Dependabot updates from #469–#472 and most of #471: - Root tooling: eslint 10.8, globals, knip, nuxt 4.5.1, prettier 3.9.6, typescript-eslint 8.65+, vue-language-core/vue-tsc 3.3.8+, simple-import-sort 14 - API/web: sentry 10.69, wrangler 4.115+, workers-types, @types/node 26.1.2 - Storage/api-node: aws-sdk 3.1098+, sentry - Web: stripe-js, tiptap 3.29.2 (incl. pm), nuxt 4.5.1 - media-pipeline: redis ^6.1.0 - Override tar >=7.5.22 (transitive via @mapbox/node-pre-gyp) Deferred: - typescript 7.0.2 — typescript-eslint peer still requires <6.1.0 (#468) - @moq/net/@moq/watch — MultiBackend removed in 0.4.x; needs a migration PR (#471) Co-authored-by: Jakub Doboš <[email protected]>

coderabbitai · 2026-08-04T13:41:21Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 85f8163e-77b7-48d8-ab09-111b106e3b81

📥 Commits

Reviewing files that changed from the base of the PR and between 761a648 and ff7f73d.

📒 Files selected for processing (1)

package.json

🚧 Files skipped from review as they are similar to previous changes (1)

package.json

📝 Walkthrough

Walkthrough

The pull request updates dependency versions and the root tar override across workspace packages. It also changes packaging queue Redis client typing to derive from a configured client factory while preserving cached-client and connection initialization behavior.

Changes

Dependency refresh

Layer / File(s)	Summary
Workspace dependency policy `package.json`	Development dependency ranges were updated. A `tar` override now requires version `7.5.22` or newer.
Package dependency refresh `packages/api-node/package.json`, `packages/api/package.json`, `packages/media-pipeline/package.json`, `packages/offloading/package.json`, `packages/payments/package.json`, `packages/storage/package.json`, `packages/web/package.json`	Package dependency ranges were updated for AWS, Cloudflare, Sentry, Node, Nuxt, Stripe, Tiptap, Wrangler, Vue tooling, and Redis.
Packaging Redis client typing `packages/media-pipeline/packagingQueue.ts`	Redis client types now derive from a packaging-specific factory. Cached client and connection promise handling remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

tojemoc/vmp#466: Both changes update the redis dependency in packages/media-pipeline/package.json.
tojemoc/vmp#121: Both changes update Vue and TypeScript tooling related to web type checking.
tojemoc/vmp#70: Both changes update the wrangler dependency in API and web package manifests.

Suggested labels: dependencies, javascript

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency updates, including Redis 6, the tar override, and simple-import-sort.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cursor/bump-deps-dependabot-944b

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

nx-cloud · 2026-08-04T13:42:22Z

View your CI Pipeline Execution ↗ for commit dd404af

Command	Status	Duration	Result
`nx affected -t typecheck typecheck:scripts --ba...`	✅ Succeeded	2s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

☁️ Nx Cloud last updated this comment at 2026-08-04 14:01:50 UTC

ReturnType<typeof createClient> is overloaded across RESP versions; pin a concrete PackagingRedisClient from createClient({ url }) so tsc accepts the redis@6 default RESP3 client. Co-authored-by: Jakub Doboš <[email protected]>

coderabbitai

🧹 Nitpick comments (1)

package.json (1)
59-60: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Unbounded lower-bound override on tar allows unconstrained future major versions.

The tar override uses ">=7.5.22" with no upper bound, so any future major release of tar (v8, v9, etc.) will be installed transitively without any manual gate. This is riskier than the neighboring ws override on Line 59, which pins an exact version. Since this override was added specifically to remediate a known issue in the ^7.4.0 range used transitively (per the package-lock.json context), a caret range such as "^7.5.22" would satisfy the same remediation while still blocking unreviewed breaking changes from a future major bump.
♻️ Proposed fix to bound the tar override
-    "tar": ">=7.5.22"
+    "tar": "^7.5.22"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 59 - 60, Update the tar override in package.json
from the unbounded >=7.5.22 range to a caret-bounded ^7.5.22 range, preserving
the remediation while preventing automatic adoption of future major versions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@package.json`:
- Around line 59-60: Update the tar override in package.json from the unbounded
>=7.5.22 range to a caret-bounded ^7.5.22 range, preserving the remediation
while preventing automatic adoption of future major versions.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1acb3cf1-3d70-4fee-b2b1-33219b4ce00e

📥 Commits

Reviewing files that changed from the base of the PR and between 9ddc7f4 and 761a648.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (9)

package.json
packages/api-node/package.json
packages/api/package.json
packages/media-pipeline/package.json
packages/media-pipeline/packagingQueue.ts
packages/offloading/package.json
packages/payments/package.json
packages/storage/package.json
packages/web/package.json

Keep the security floor at 7.5.22 while preventing automatic adoption of a future major via the previous unbounded >= range. Co-authored-by: Jakub Doboš <[email protected]>

kubo6472 marked this pull request as ready for review August 4, 2026 13:50

prelint Bot approved these changes Aug 4, 2026

View reviewed changes

coderabbitai Bot reviewed Aug 4, 2026

View reviewed changes

chore(deps): bound tar override to ^7.5.22

ff7f73d

Keep the security floor at 7.5.22 while preventing automatic adoption of a future major via the previous unbounded >= range. Co-authored-by: Jakub Doboš <[email protected]>

prelint Bot approved these changes Aug 4, 2026

View reviewed changes

kubo6472 merged commit b03af85 into main Aug 4, 2026
11 of 12 checks passed

kubo6472 deleted the cursor/bump-deps-dependabot-944b branch August 4, 2026 14:34

Navigation Menu

Uh oh!

chore(deps): bump npm minor/patch group, redis 6, tar, simple-import-sort - #474

chore(deps): bump npm minor/patch group, redis 6, tar, simple-import-sort#474
kubo6472 merged 3 commits into
mainfrom
cursor/bump-deps-dependabot-944b

kubo6472 commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

nx-cloud Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kubo6472 commented Aug 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Included

Code fix for redis 6

Deferred (with reasons)

Files changed

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

nx-cloud Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kubo6472 commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

nx-cloud Bot commented Aug 4, 2026 •

edited

Loading