[Feature] Dependency sweep 2026-09: every manifest to latest, and off the deprecated nats package

[pathosDev]

Use case

Every manifest in the repository is behind, in four separate dependency closures that no single
command covers: the root (runtime + dev + 28 optional peers), tests/integration/brokers/,
docs/, devtools-ui/, benchmarks/comparison/, and eight example frontends. Dependabot sees
only some of them and never touches a bun.lock, so drift accumulates silently.

Five optional peers have shipped a new major since they were pinned, one of them
(nats) is deprecated on npm in favour of a renamed package set.

Proposed behaviour

One branch, one commit per manifest group, each keeping typecheck + bun test green.

Peer-floor rule for this sweep

peerDependencies ranges are not raised. A higher floor is consumer-visible — npm 7+ reports
ERESOLVE against an already-installed older peer — and buys nothing while no adapter needs a newer
API. What moves is the installed and tested version: devDependencies, the brokers manifest and
the lockfiles. A new major is widened into the range with ||, never swapped in.

One constraint worth writing down: tests/unit/runtime/HonoRunnerFrameCap.test.ts parses the
@hono/node-ws peer with a single-caret regex, so that entry can never grow a ||.

Root + brokers manifest

• fastify -> ^5.12.3. Three files quote this range verbatim and tests/unit/ci/SecurityPolicy.test.ts enforces the bijection: package-health.yml's audit comment (which also quotes the bun.lock pins for fastify and find-my-way) and operations/security/supply-chain.mdx EN+DE. scripts/build-devtools-ui.mjs folds the root dependencies into the check:ui source hash, so bun run build:ui belongs in the same commit.
• Patch/minor: hono ^4.13.7, @hono/node-server ^2.1.1, ws ^8.21.3, better-sqlite3 ^13.0.3, @fastify/static ^10.1.3, protobufjs ^8.8.0, publint ^0.3.24, knip ^6.35.1, @arethetypeswrong/cli ^0.18.5; brokers-side @aws-sdk/* ^3.1128.0, @grpc/grpc-js ^1.14.4, mariadb ^3.5.4, mqtt ^5.15.2, mssql ^12.7.1, pg ^8.23.0, cassandra-driver ^4.9.0.
• New majors, widened:
  • mongodb ^6.21.0 || ^7.6.0 — closes [Feature] Widen the mongodb optional peer to ^6 || ^7 — v7 imports cleanly on Bun 1.4 #1340. v7 needs Node >= 20.19 and drops useNewUrlParser and friends; the Bun caveat becomes conditional ("v7 requires Bun >= 1.4") rather than disappearing, because the support floor stays at 1.3. Docs EN+DE plus the pin rationale in src/persistence/journals/MongoClient.ts's header.
  • ioredis ^5.10.1 || ^6.0.0 — v6 defaults to RESP3. RedisStreamsActor constructs its own client and parses xreadgroup replies in RESP2 array shape; if the live suite shows a different shape, the fix is protocol: 2 at construction, not a second parser.
  • nodemailer ^9.0.4 || ^10.0.1 and imapflow ^1.7.1 || ^2.0.0 — both rewritten in TypeScript with dual ESM/CJS builds; EmailBridgeActor already resolves default vs named createTransport.
  • @libsql/client ^0.15.15 || ^0.17.0 || ^0.18.0 — no release notes upstream, so the Docker suite is the check.
• @types/node stays on 24 (Dependabot re-proposes @types/node majors against the deliberate engines-floor pin (4th round: #481) #906).
• Coverage of the old major: after this, the Docker suites exercise only the new major of each of the five. The old one stays admissible but is then covered by nothing. Stated per driver here and in the CHANGELOG rather than left implicit.

NATS: migrate off the deprecated nats package

nats@2.29.3 is the last v2 and npm-deprecated ("moved to @nats-io/transport-node"). Four
adapters load it, not two — NatsActor, JetStreamActor, JetStreamKeyValueActor,
JetStreamObjectStoreActor, all through lazyImportModule('nats').

• @nats-io/transport-node ^3.4.0 replaces nats (connect, headers)
• @nats-io/jetstream ^3.4.0 — nc.jetstream() / nc.jetstreamManager() became free functions
• @nats-io/kv ^3.4.0 — js.views.kv() became new Kvm(js); bindOnly maps to .open()
• @nats-io/obj ^3.4.0 — js.views.os() became new Objm(js)
• The one real break: v3 removed push consumers, so js.subscribe(subject, { stream, consumer }) has no equivalent. The replacement is consumer.consume({ max_messages, expires }) with messages.status() surfacing heartbeats_missed. JetStreamConsumerConfig.mode therefore stops meaning 'push' | 'pull' and becomes 'consume' | 'fetch' — a BREAKING rename, refusing the retired spellings at startup the way [Feature] Convert the last camelCase HOCON leaves to kebab-case — http.client, http.websocket, cache.in-memory #1405 did, rather than silently accepting a word the client no longer honours.
• jsm "already exists / in use" detection moves from a regex over e.message to v3's typed JetStreamApiError.code (10058 / 10148), keeping the regex as fallback
• KV/Object-Store watch entries carry isUpdate in v3; initializedFn is gone
• The four exported *Like stubs keep their names (they are public API through src/io/index.ts); the duplicate NatsConnectionLike declaration in two files collapses into one
• docker-compose.nats.yml starts the server without -js, so JetStream, KV and Object Store have no live coverage at all today. Add -js and four scenarios: a driver-shape probe (the NATS equivalent of cassandra/scenarios/01-driver-shape.ts, since OptionalPeerModuleShapes.test.ts never covers NATS), consume+fetch with ack/nak/term, KV, Object Store.
• Deno stays ⚠ in the compatibility matrix and finally gets a footnote saying why: @nats-io/transport-deno is JSR-only, so one npm specifier serves all three runtimes.

Docs site, DevTools UI, example frontends

• docs/: astro ^7.3.2, starlight ^0.42.0 (needs astro >= 7.2.10 and markdown-remark >= 7.3.0; the exact @astrojs/markdown-remark pin follows what astro declares, per c85688cf), starlight-typedoc ^0.23.1, typedoc-plugin-markdown ^4.13.0, sharp, fontsource, playwright. Starlight 0.42's breaking changes (mobile-menu markup, removed tagline config option) were checked against custom.css and astro.config.mjs — neither is affected.
• devtools-ui/: Angular 22.1.5/22.1.7, jsdom ^30. Not vitest 5 (@angular/build peers ^4.0.8) and not TypeScript 7 (Angular peers >=6.0 <6.1). bun run build:ui in the same commit.
• Eight frontends: Angular 22.1.x, next ^16.3.4, react ^19.2.8, vite ^8.2.2, svelte ^5.57.0, zone.js ^0.16.3. Both lockfiles regenerated per directory — the bun.lock half is what build(deps): bump the npm_and_yarn group across 4 directories with 4 updates #1518 left stale, and bun install --frozen-lockfile --dry-run cannot see a merely outdated transitive.

Alternatives considered

Letting Dependabot do it: it never writes bun.lock, does not see the brokers manifest, opens
group PRs that bundle unrelated drift, and would raise peer floors as a side effect.

Acceptance criteria

Every manifest at its chosen version with a written reason for each deliberate hold (@types/node
24, vitest 4, TypeScript 6 in the UI, xstate/nact frozen until the #1331 re-measure); bun install --frozen-lockfile --dry-run exits 0 in all twelve directories; lint:audit no worse and no new
--ignore; the five widened peers each green against their live Docker suite; NATS migrated with
JetStream coverage that did not exist before; CHANGELOG Changed covering the consumer-visible
range widenings and the BREAKING mode rename.

[pathosDev]

Landed: four of five manifests. Not landed: the five new majors and the NATS migration.

Merged as 524aac39, four commits on features/deps-sweep-2026-09, all on the Bun 1.4.2 pin
(#1519).

Done

commit	what
26a711f3	root + brokers manifests
f84459b8	the eight example frontends, plus #1518's bun.lock half
fb9d4be8	DevTools UI, including jsdom 27 → 30
8f3a9f02	docs site, minus astro 7.3 (see below)

Peer floors did not move, as the issue said they would not. ws is a ^8.21.3 devDependency
against a ^8.0.0 peer, better-sqlite3 ^13.0.3 against ^12.9.0 || ^13.0.0, and so on.

Three things came out of it that were not in the plan:

• The knip 6.29 → 6.35 bump made five ignoreDependencies entries dead, because 6.35 started attributing @hono/node-server, @hono/node-ws, hono, express and @types/express to their lazy call sites. knip.jsonc already says an unneeded ignore entry hides a finding later, so they are gone and lint:knip is now silent rather than merely green.
• The Angular frontend bump is much bigger than its version number — @angular/build 22.0.8 → 22.1.7 drags 26 transitive majors (Babel 7 → 8, vite 7 → 8, chokidar 4 → 5, lru-cache 5 → 11, a rollup-to-oxc binding swap). Verified by building rather than resolving: npm ci plus a real build in one directory per toolchain, all four green.
• The documentation site did not build at all, for a reason unrelated to any dependency — filed and fixed as [Bug] The documentation site does not build: four pages have a colon in an unquoted frontmatter description, and only the release-time workflow would notice #1525. That is also why the docs half is verified by a full astro build (4 951 pages) rather than by a frozen install.

bun audit over docs/bun.lock goes 12 → 11 advisories; reported on #1413.

Not landed, and why

The five optional peers with a new major — mongodb ^7, ioredis ^6, nodemailer ^10,
imapflow ^2, @libsql/client 0.18 — and the migration off the deprecated nats package.

Both need the live broker suites, and those need Docker images this machine has no room for: the
disk is at 99 %, and the ~12 GB Docker could reclaim is someone else's data to decide about, not
a sweep's. Widening a peer range that nothing then exercises is the state OptionalPeerDeclarations
exists to prevent, so they are better left than half-done:

• ioredis 6 defaults to RESP3, and RedisStreamsActor parses xreadgroup replies in RESP2 array shape. Whether that needs protocol: 2 at construction is a question the live suite answers and static reading does not.
• mongodb 7 needs Node ≥ 20.19 and drops several options; it also cannot be imported on Bun 1.3, which is still the engines floor, so the caveat becomes conditional rather than disappearing.
• nodemailer 10 and imapflow 2 are both TypeScript rewrites with dual ESM/CJS builds and changed export maps.
• @libsql/client 0.18 ships no release notes at all.
• NATS v3 is a genuine code change across four adapters, not two — NatsActor, JetStreamActor, JetStreamKeyValueActor and JetStreamObjectStoreActor all call lazyImportModule('nats') — and v3 removed push consumers outright, so JetStreamConsumerConfig.mode has to stop meaning 'push' | 'pull'. That is a BREAKING rename, and the suite that would prove it does not exist yet: docker-compose.nats.yml starts the server without -js, so JetStream, KV and Object Store have no live coverage today.

The NATS checklist in the issue body stands as written; nothing in it changed on inspection except
that the adapter count is four.

[pathosDev]

NATS is migrated, and the plan for it in this issue was wrong in one important way

Landed as 528d8ecd, merged in f690b87a. The checklist above is done, with one item that
should be struck rather than ticked.

The correction

The checklist says v3 removed push consumers, so JetStreamConsumerConfig.mode had to stop
meaning 'push' | 'pull' and become 'consume' | 'fetch' — a BREAKING rename refusing the old
spellings at startup.

That is not what v3 did, and there is no rename. v3 removed JetStreamClient.subscribe, not
push consumers. They are reached through consumers.getPushConsumer(stream, durable).consume(),
and what comes back is the same async iterable the existing pump already walked. mode keeps
both spellings and every configuration keeps working.

The claim came from reading the release notes. What corrected it was importing the package and
asking it: Object.keys(await import('@nats-io/jetstream')) lists isPushConsumer, and the type
declarations carry PushConsumer.consume(). Worth recording because the wrong version would have
shipped a breaking change nobody needed.

What the probing did find

The default JetStream mode has never worked — filed as #1526 and fixed here. mode defaults
to 'push', and that path bound to a durable the actor's own upsertConsumer created without a
deliver_subject, which makes it a pull consumer server-side. Measured on v2 against a real
nats-server -js, so this predates the migration entirely:

consumers.add (as upsertConsumer does)          ok
  resulting consumer deliver_subject            null
  => server considers it                        PULL
js.subscribe({stream, consumer}) [PUSH PATH]    THROWS
consumers.get(...).fetch()      [PULL PATH]     ok

Invisible because docker-compose.nats.yml ran the server without -js: JetStream, key-value and
object store had no live coverage at all, and the unit suites assert against hand-written
stubs that a fake satisfies by construction.

What landed

Four packages replace nats — @nats-io/transport-node, @nats-io/jetstream, @nats-io/kv,
@nats-io/obj — across four adapters. jetstream() and jetstreamManager() became free
functions, so NatsConnectionLike no longer carries them and the adapters grew module seams; the
KV and object-store views moved behind Kvm and Objm, where create: false is now open();
"already exists" detection moved from a message regex to JetStreamApiError.code; and fetch's
expiresMs is clamped to the second nats.js enforces client-side.

The suite went from three core-NATS scenarios to eight, including a driver-shape probe that
asserts the hand-written stubs against the real modules. That check is the one worth keeping past
this change: it is what OptionalPeerModuleShapes.test.ts does for the peers the root install
materialises, and NATS — living only in the brokers manifest — never had it. Its absence is
exactly why a driver surface could move this far unnoticed.

All eight verified green against nats-server -js 2.14.6, and the push scenario was checked for
discrimination by re-introducing the defect and watching only it fail.

Still open on this issue

The five optional peers with a new major — mongodb ^7, ioredis ^6, nodemailer ^10,
imapflow ^2, @libsql/client 0.18 — are untouched. They need their own live suites, and unlike
NATS those need Docker rather than a single downloadable binary.

[pathosDev]

The sweep is complete, including the five majors

30e40e65 (merged 5c5a9108) closes the last item. Full ledger:

part	commit
root + brokers manifests	26a711f3
eight example frontends, plus #1518's bun half	f84459b8
DevTools UI, jsdom 27 → 30	fb9d4be8
docs site	8f3a9f02
NATS off the deprecated package (and #1526)	528d8ecd
the five optional peers with a new major	30e40e65

All five widenings verified against real brokers in Docker: redis-streams 3/3, email 4/4, mongodb 39/39, libsql 39/39. Ranges are widened (||), never moved, so nothing a consumer has installed stops resolving.

Two findings are worth more than the version bumps:

• ioredis 6 does default to RESP3, so the risk this issue flagged was real. It passes anyway because ioredis pairs protocol: 3 with replyMapping: "legacy", which its own docs call shapes "identical across both protocols". No protocol: 2 pin needed; what would break RedisStreamsActor is replyMapping: "resp3", which nothing sets.
• mongodb 7 still cannot be imported on the Bun engines admits (1.3.0 throws ERR_NOT_IMPLEMENTED from bson; 1.4.2 is fine). Detail on [Feature] Widen the mongodb optional peer to ^6 || ^7 — v7 imports cleanly on Bun 1.4 #1340.

Deliberately not done, each with a reason

• astro 7.1 → 7.3 with Starlight 0.42. Astro 7.3 replaces the markdown pipeline this site pins exactly for rehype-mermaid, and no develop push builds the docs — docs.yml runs on main only. Landing a pipeline swap that nothing verifies until a release is the wrong shape; it wants its own change where the mermaid path can be compared before and after. Filed separately.
• @types/node 26 (Dependabot re-proposes @types/node majors against the deliberate engines-floor pin (4th round: #481) #906 policy), vitest 5 and TypeScript 7 in the DevTools UI (both blocked by @angular/build's peers), xstate/nact (frozen until the [Feature] Re-measure the comparison benchmarks on Bun 1.4.0 and carry the figures to the five hand-maintained surfaces #1331 re-measure).

Closing. The astro work continues in its own issue.