Skip to content

ci(deps): bump the major-updates group across 1 directory with 8 updates - #133

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/major-updates-fa97190098
Closed

ci(deps): bump the major-updates group across 1 directory with 8 updates#133
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/major-updates-fa97190098

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the major-updates group with 8 updates in the / directory:

Package From To
bullmq 5.78.0 6.1.2
ioredis 5.11.1 6.0.0
js-yaml 4.3.1 5.3.0
openai 6.42.0 7.4.0
typeorm 0.3.31 1.1.0
@types/node 25.9.2 26.2.0
jscpd 4.2.4 5.0.15
typescript 6.0.3 7.0.2

Updates bullmq from 5.78.0 to 6.1.2

Release notes

Sourced from bullmq's releases.

v6.1.2

6.1.2 (2026-08-16)

Bug Fixes

  • deps: update security patches [security] (#4566) (cb37233)

v6.1.1

6.1.1 (2026-08-14)

Bug Fixes

v6.1.0

6.1.0 (2026-08-12)

Features

  • postgres: make schema migrations explicit (#4544) (ee714dc)

v6.0.11

6.0.11 (2026-08-10)

Bug Fixes

  • deps: update security patches [security] (#4539) (48c5426)

v6.0.10

6.0.10 (2026-08-10)

Bug Fixes

v6.0.9

6.0.9 (2026-08-07)

Bug Fixes

  • events: type completed event returnvalue as deserialized value (#4441) fixes #4147 (5910ccc)

v6.0.8

... (truncated)

Commits

Updates ioredis from 5.11.1 to 6.0.0

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)
  • types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

BREAKING CHANGES

  • ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)
  • types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

BREAKING CHANGES

  • ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.
Commits

Updates js-yaml from 4.3.1 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.

Changed

  • Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
  • Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

  • Deprecated flat constant exports. Use grouped ones instead.

Removed

  • Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

  • Validate << sequence items at merge time, so aliased merge sources are checked too.
  • Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

[5.2.3] - 2026-08-01

Fixed

  • Prevent prototype fallback when resolving tags and mapping entries, #782.
  • Resolve !!timestamp years 0000-0099 correctly, #775.
  • Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
  • Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

  • Quote flow scalars where a colon precedes a flow indicator, #773.

Security

  • Avoid exponential parsing time for nested flow sequence pairs.

... (truncated)

Commits
  • 04db458 5.3.0 released
  • 22ce0a0 Changelog update
  • fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
  • b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
  • cc665ec docs: review and update annotations
  • 2aa24a6 Changelog update
  • eec6902 Restore deprecated parser constant exports
  • 03397ac Move throwErrorAt to YAMLException as throwAt
  • d9dd2c7 docs: new condensed theme
  • 0f898e6 docs: annotation tweaks
  • Additional commits viewable in compare view

Updates openai from 6.42.0 to 7.4.0

Release notes

Sourced from openai's releases.

v7.4.0

7.4.0 (2026-08-03)

Features

  • api: Add gpt-5.5 model and tool metadata fields (#2049) (6d8fb53)

Bug Fixes

Documentation

Build System

  • deps-dev: bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064) (481b325)
  • deps-dev: bump @​types/web from 0.0.194 to 0.0.354 (#2061) (f61f267)
  • deps-dev: bump publint from 0.2.12 to 0.3.22 (#2058) (823d7df)
  • deps: bump dotenv from 16.6.1 to 17.4.2 (#2065) (3576574)
  • deps: bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edge (#2050) (590982f)
  • deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel-edge (#2056) (4d927de)
  • migrate release workflow to upstream release-please (#2048) (d41c272)

v7.3.0

7.3.0 (2026-07-31)

Full Changelog: v7.2.0...v7.3.0

Features

  • api: content provenance checks (c6f9339)

Chores

Documentation

  • organize SDK guides and repository metadata (#2032) (275dff4)
  • remove root-level provider guides (98a2ae7)

... (truncated)

Changelog

Sourced from openai's changelog.

7.4.0 (2026-08-03)

Features

  • api: Add gpt-5.5 model and tool metadata fields (#2049) (6d8fb53)

Bug Fixes

Documentation

Build System

  • deps-dev: bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064) (481b325)
  • deps-dev: bump @​types/web from 0.0.194 to 0.0.354 (#2061) (f61f267)
  • deps-dev: bump publint from 0.2.12 to 0.3.22 (#2058) (823d7df)
  • deps: bump dotenv from 16.6.1 to 17.4.2 (#2065) (3576574)
  • deps: bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edge (#2050) (590982f)
  • deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel-edge (#2056) (4d927de)
  • migrate release workflow to upstream release-please (#2048) (d41c272)

7.3.0 (2026-07-31)

Full Changelog: v7.2.0...v7.3.0

Features

  • api: content provenance checks (c6f9339)

Chores

Documentation

  • organize SDK guides and repository metadata (#2032) (275dff4)
  • remove root-level provider guides (98a2ae7)

7.2.0 (2026-07-30)

... (truncated)

Commits
  • 83c437f release: 7.4.0 (#2055)
  • a97cbff ci: prepare checks for merge queue (#2066)
  • 481b325 build(deps-dev): bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064)
  • 3576574 build(deps): bump dotenv from 16.6.1 to 17.4.2 (#2065)
  • 823d7df build(deps-dev): bump publint from 0.2.12 to 0.3.22 (#2058)
  • f61f267 build(deps-dev): bump @​types/web from 0.0.194 to 0.0.354 (#2061)
  • 85ea6b2 [dependabot] Configure a seven-day npm cooldown (#2054)
  • 4d927de build(deps): bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel...
  • 590982f build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edg...
  • 6d8fb53 feat(api): Add gpt-5.5 model and tool metadata fields (#2049)
  • Additional commits viewable in compare view

Updates typeorm from 0.3.31 to 1.1.0

Release notes

Sourced from typeorm's releases.

1.1.0

What's Changed

New Contributors

Full Changelog: typeorm/typeorm@1.0.0...1.1.0

1.0.0

TypeORM v1.0 is here! 🥳

👉 For a structured walk-through of the changes in v1.0 — breaking changes, new features, security fixes, and the upgrade path from 0.3.x — see the v1.0 Release Notes.

... (truncated)

Changelog

Sourced from typeorm's changelog.

1.1.0 (2026-07-13)

Bug Fixes

  • cache: release query runner on error in storeInCache (#12545) (a84b9b3)
  • correct grammar in AlreadyHasActiveConnectionError message (#12554) (304d129)
  • entity-manager: default invalidWhereValuesBehavior to throw on the write path (#12690) (44d8052)
  • entity-manager: validate where criteria in increment/decrement (#12692) (8a51b75)
  • mongodb: use cursor.transform for doc to entity transformation and skip load broadcast in next if toArray (#11926) (0bbefc9)
  • move hashing function to PlatformTools (#12648) (c456cbd)
  • multiple recursive cte problems (#12490) (7c26654)
  • normalization of FindOptionsWhere for arrays and Buffers (#12577) (a8173fc)
  • persistence: preserve select false columns on the in-memory entity after save() (#12501) (324c46c)
  • postgres: improve normalizeDatetimeFunction for tstzrange data type (#12182) (bf47c9f)
  • query-builder: reject empty where criteria on update and delete operations (#12629) (81b9466)
  • query-builder: wrap inner joins under left joins correctly (#11137) (d5f4b9d)
  • remove require() calls that break bundlers (#12647) (30f9fc7)
  • tree-entity: tree entity schema propagation in internal TreeRepository methods (#12590) (7fb7c2c)

Features

1.0.0 (2026-05-19)

👉 For a structured walk-through of the changes in v1.0 — breaking changes, new features, security fixes, and the upgrade path from 0.3.x — see the v1.0 Release Notes.

The list below is the set of commits between 0.3.30 and 1.0.0 — fixes already shipped on the 0.3.x line are listed under their respective 0.3.x entries below.

Bug Fixes

  • cascade: propagate withDeleted to relation-id loader for many-to-many recover (#12287) (cfba9e7)
  • cascade: support cascade remove for OneToMany relations with composite PKs (#12286) (09183c8)
  • cli: preserve devDependencies needed by init command in published package (#12281) (c3b771c)
  • cockroachdb: preserve structured query results during txn retry replay (#11861) (09db48c)
  • codemod: apply find-options select/relations rewrites to .exists() too (#12399) (4461063)
  • codemod: correct relation-count guidance and flag loadRelationCountAndMap (#12374) (5de5490)
  • codemod: cover ColumnMetadata args.options in column option rewrites (#12400) (7a68cf2)
  • codemod: exclude type declarations from build (#12292) (4c645f0)
  • codemod: handle aliases, quoted keys, and ObjectProperty variants (#12377) (2d15644)
  • codemod: handle lock option objects correctly and increase test coverage (#12353) (b871719)
  • codemod: handle typeof type queries and use getStringValue consistently (#12379) (dedea37)
  • codemod: harden destructure and DI accessor rewrites for connection to dataSource rename (#12398) (057ddbc)
  • codemod: harden scope and type-name detection across more AST shapes (#12394) (9d1fd8d)
  • codemod: harden scope, idempotency, and import-strip semantics (#12391) (ed5a19b)
  • codemod: recognize typeorm deep-path imports (#12382) (a96b097)
  • codemod: rename .connection on EntityMetadata, ColumnMetadata, IndexMetadata (#12383) (8a51e30), closes #12249
  • codemod: rewrite typeorm re-exports in barrel files (#12373) (25f0b5f)

... (truncated)

Commits
  • 8748b1b chore(release): prepare v1.1.0 (#12697)
  • 0caca21 style(test): format migration test
  • 41d1c62 Merge commit from fork
  • 8a51b75 fix(entity-manager): validate where criteria in increment/decrement (#12692)
  • 44d8052 fix(entity-manager): default invalidWhereValuesBehavior to throw on the write...
  • af5f2a5 chore: update dependencies (#12678)
  • f5c6aa3 ci: improve pr triage script (#12677)
  • 81b9466 fix(query-builder): reject empty where criteria on update and delete operatio...
  • 30f9fc7 fix: remove require() calls that break bundlers (#12647)
  • c456cbd fix: move hashing function to PlatformTools (#12648)
  • Additional commits viewable in compare view

Updates @types/node from 25.9.2 to 26.2.0

Commits

Updates jscpd from 4.2.4 to 5.0.15

Release notes

Sourced from jscpd's releases.

Release v5.0.15

New Features

  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error, matching the threshold check that fails the build. Default output is unchanged when neither option is set. (#908)
  • SARIF: clone fingerprints — each result carries token_count and a clone_hash in its properties bag, plus a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. The hash is order-insensitive, so the same clone pair produces the same hash regardless of file discovery order. (#909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message (Duplicated at <path>:<line>), and the primary message references it via a SARIF embedded link so GitHub code scanning displays it. (#911)
  • SARIF: richer rule metadata — the jscpd/duplicate-code rule now includes a display name, full description, default configuration, and quality tags for better presentation in SARIF viewers and Azure DevOps. (#914)

Bug Fixes

  • Scan-root-relative report paths — fragments store their scan root separately (source_root), so report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve and read source files; SARIF emits originalUriBaseIds with per-root base ids. Fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#872, #892)
  • Report version stamping — the SARIF tool.driver.version (previously hardcoded 5.0.3) and the HTML report version now match cpd --version, bundled at build time. (#915)
  • Multi-root blame attribution — with multiple scan roots containing the same relative path, git blame data is now keyed by resolved path, so the second root no longer inherits the first root's authors.
  • Git root discovery — walking up from a relative scan path no longer terminates early before reaching the repository root.

Dependencies

  • Bump serde_json to 1.0.151 in /rust
  • Bump ignore to 0.4.32 in /rust
  • Bump anyhow to 1.0.104 in /rust

Thank You ❤️

This release was shaped by community contributions — huge thanks to:

Published Packages

  • cpd-core@0.1.8 on crates.io
  • cpd-finder@0.1.10 on crates.io
  • cpd-reporter@0.1.8 on crates.io
  • cpd-tokenizer@0.1.9 on crates.io
  • jscpd@5.0.15 on crates.io
  • cpd@5.0.15 on npm
  • jscpd-darwin-arm64@5.0.15 on npm
  • jscpd-darwin-x64@5.0.15 on npm
  • jscpd-linux-x64-gnu@5.0.15 on npm
  • jscpd-linux-arm64-gnu@5.0.15 on npm
  • jscpd-linux-x64-musl@5.0.15 on npm
  • jscpd-windows-x64-msvc@5.0.15 on npm
  • jscpd@5.0.15 on npm

Release v5.0.14

New Features

... (truncated)

Changelog

Sourced from jscpd's changelog.

5.0.15

New Features

  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialF...

    Description has been truncated

Bumps the major-updates group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bullmq](https://github.com/taskforcesh/bullmq) | `5.78.0` | `6.1.2` |
| [ioredis](https://github.com/redis/ioredis) | `5.11.1` | `6.0.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `5.3.0` |
| [openai](https://github.com/openai/openai-node) | `6.42.0` | `7.4.0` |
| [typeorm](https://github.com/typeorm/typeorm) | `0.3.31` | `1.1.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.2.0` |
| [jscpd](https://github.com/kucherenko/jscpd/tree/HEAD/rust/jscpd) | `4.2.4` | `5.0.15` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |



Updates `bullmq` from 5.78.0 to 6.1.2
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v5.78.0...v6.1.2)

Updates `ioredis` from 5.11.1 to 6.0.0
- [Release notes](https://github.com/redis/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.11.1...v6.0.0)

Updates `js-yaml` from 4.3.1 to 5.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.1...5.3.0)

Updates `openai` from 6.42.0 to 7.4.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v6.42.0...v7.4.0)

Updates `typeorm` from 0.3.31 to 1.1.0
- [Release notes](https://github.com/typeorm/typeorm/releases)
- [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md)
- [Commits](typeorm/typeorm@0.3.31...1.1.0)

Updates `@types/node` from 25.9.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `jscpd` from 4.2.4 to 5.0.15
- [Release notes](https://github.com/kucherenko/jscpd/releases)
- [Changelog](https://github.com/kucherenko/jscpd/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kucherenko/jscpd/commits/v5.0.15/rust/jscpd)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: bullmq
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: ioredis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: js-yaml
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: jscpd
  dependency-version: 5.0.15
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: openai
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typeorm
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title ci(deps): bump the major-updates group with 8 updates ci(deps): bump the major-updates group across 1 directory with 8 updates Aug 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/major-updates-fa97190098 branch from 4769f71 to 15424e6 Compare August 19, 2026 11:16
@vineethkrishnan

Copy link
Copy Markdown
Owner

Closing: broken by the bump, not by pre-existing CI.

Failing here: Build, Test, Lint, Strict Type Safety, Code Duplication, Dead Code. Trivy is red on every PR in this repo so it is pre-existing and I am ignoring it, but the rest are not: #134 was green apart from Trivy and has been merged, and #131 shows only the pre-existing Trivy red. The build and test failures belong to this PR.

The group stacks majors on runtime-critical infrastructure: bullmq 5.78.0 -> 6.1.1, ioredis 5.11.1 -> 6.0.0, typeorm 0.3.31 -> 1.1.0, openai 6.42.0 -> 7.4.0, js-yaml 4.3.1 -> 5.3.0, typescript 6.0.3 -> 7.0.2. ioredis and bullmq together are the queue and Redis layer.

Worth splitting per package with real testing. Closing rather than merging red.

@dependabot @github

dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/major-updates-fa97190098 branch August 19, 2026 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant