Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 4 updates - #461

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/production-dependencies-02f4a15ca3
Open

chore(deps): bump the production-dependencies group across 1 directory with 4 updates#461
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/production-dependencies-02f4a15ca3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 4 updates in the / directory: bullmq, express-rate-limit, jose and lucide-react.

Updates bullmq from 5.81.2 to 6.0.2

Release notes

Sourced from bullmq's releases.

v6.0.2

6.0.2 (2026-07-31)

Bug Fixes

v6.0.1

6.0.1 (2026-07-31)

Bug Fixes

  • add missing sql files to release packages (elixir) (python) (#4413) (a138230)

v6.0.0

6.0.0 (2026-07-30)

BREAKING CHANGES

v5.81.3

5.81.3 (2026-07-30)

Bug Fixes

  • deps: update dependency msgpackr to v2.0.5 [security] (#4387) (6fccb59)
  • deps: update dependency redis [security] (#4369) (2a120df)
  • worker: recover blocking client after sentinel disconnect, fixes… (#4384) (93649b8)
Commits
  • 2ac754f fix(deps): update dependency redis to v7.4.1 (#4426)
  • a13de5a chore(release): vpy3.0.1 (#4427)
  • 2c700d0 chore(release): vex2.0.1 (#4428)
  • c428aa6 chore(deps): update dependency @​types/pg to v8.20.0 [security] (#4415) [elixi...
  • c99c323 chore(deps): update actions/setup-node digest to 2499707 (#4420)
  • 889844c ci: consolidate API docs into main site and restore older versions (#4414)
  • 640d50e chore(deps): update actions/checkout digest to d23441a (#4419)
  • 93d9d45 chore(deps): update devdependencies (non-major) [security] (#4416)
  • a138230 fix: add missing sql files to release packages (elixir) (python) (#4413)
  • 8a06098 ci: add api pages to main documentation site (#4408)
  • Additional commits viewable in compare view

Updates express-rate-limit from 8.6.0 to 8.6.1

Release notes

Sourced from express-rate-limit's releases.

v8.6.1

You can view the changelog here.

Commits

Updates jose from 6.2.4 to 6.2.5

Release notes

Sourced from jose's releases.

v6.2.5

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

  • assert key shape and type from the entry (971057e)
  • avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
  • correct swapped JWE unprotected header type error messages (894c498)
  • describe each JWS algorithm once (7375028)
  • discriminate a key once (0b59a69)
  • fold single-consumer modules into their consumers (c2f0ca3)
  • generate and import keys from the entry (da69b68)
  • keep JWE out of the JWKS and embedded-JWK paths (241dd48)
  • keep JWS and JWE out of each other's bundles (2a98564)
  • parse a Protected Header in one place (30f72af)
  • resolve the content encryption algorithm once (98b50ab)
  • tighten key property checks (fe0dc3b)
  • types: add discriminated JOSE error types (f7f764e)
  • types: add JOSE identifier unions and JWK narrowing (2a20f49)
  • types: improve key and result inference (cb25e77)
  • types: trim published declaration comments (544f179)
  • unify base64 decode errors (3a91833)
  • validate each token once rather than once per layer (bbdae09)
  • write each algorithm identifier once (73d83b5)
Changelog

Sourced from jose's changelog.

6.2.5 (2026-07-29)

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

  • assert key shape and type from the entry (971057e)
  • avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
  • correct swapped JWE unprotected header type error messages (894c498)
  • describe each JWS algorithm once (7375028)
  • discriminate a key once (0b59a69)
  • fold single-consumer modules into their consumers (c2f0ca3)
  • generate and import keys from the entry (da69b68)
  • keep JWE out of the JWKS and embedded-JWK paths (241dd48)
  • keep JWS and JWE out of each other's bundles (2a98564)
  • parse a Protected Header in one place (30f72af)
  • resolve the content encryption algorithm once (98b50ab)
  • tighten key property checks (fe0dc3b)
  • types: add discriminated JOSE error types (f7f764e)
  • types: add JOSE identifier unions and JWK narrowing (2a20f49)
  • types: improve key and result inference (cb25e77)
  • types: trim published declaration comments (544f179)
  • unify base64 decode errors (3a91833)
  • validate each token once rather than once per layer (bbdae09)
  • write each algorithm identifier once (73d83b5)
Commits
  • 3bac350 chore(release): 6.2.5
  • 544f179 refactor(types): trim published declaration comments
  • ef6b73e ci: enforce the family split and check the built dist
  • c2f0ca3 refactor: fold single-consumer modules into their consumers
  • 0b59a69 refactor: discriminate a key once
  • 30f72af refactor: parse a Protected Header in one place
  • 73d83b5 refactor: write each algorithm identifier once
  • da69b68 refactor: generate and import keys from the entry
  • 971057e refactor: assert key shape and type from the entry
  • 98b50ab refactor: resolve the content encryption algorithm once
  • Additional commits viewable in compare view

Updates lucide-react from 1.26.0 to 1.28.0

Release notes

Sourced from lucide-react's releases.

Version 1.28.0

What's Changed

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

Version 1.27.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
e7ad93c 
…y with 4 updates

Bumps the production-dependencies group with 4 updates in the / directory: [bullmq](https://github.com/taskforcesh/bullmq), [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit), [jose](https://github.com/panva/jose) and [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react).


Updates `bullmq` from 5.81.2 to 6.0.2
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v5.81.2...v6.0.2)

Updates `express-rate-limit` from 8.6.0 to 8.6.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.6.0...v8.6.1)

Updates `jose` from 6.2.4 to 6.2.5
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.4...v6.2.5)

Updates `lucide-react` from 1.26.0 to 1.28.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react)

---
updated-dependencies:
- dependency-name: bullmq
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependabot PR javascript Pull requests that update javascript code labels Aug 3, 2026
@dependabot
dependabot Bot requested a review from RaminNietzsche as a code owner August 3, 2026 17:36
@dependabot dependabot Bot added dependencies Dependabot PR javascript Pull requests that update javascript code labels Aug 3, 2026
@mergify mergify Bot added the size/L label Aug 3, 2026
@mergify

mergify Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Merge Protections

🔴 5 of 7 protections blocking · waiting on 🤖 CI and 🙋 you

Protection Waiting on
🔴 CI / App 🤖 CI
🔴 Quality / Codecov 🤖 CI
🔴 Quality / SonarCloud 🤖 CI
🔴 Security / Trivy 🤖 CI
🔴 🚦 Auto-queue 🙋 you
🟢 Security / npm audit —
🟢 Security / CodeQL (javascript-typescript) —

🔴 CI / App

Waiting for

  • check-success = App (lint · typecheck · build)
This rule is failing.

App lint, typecheck, tests, and build must pass when app code changes

  • check-success = App (lint · typecheck · build)

🔴 Quality / Codecov

Waiting for any of

  • check-skipped = Run tests and collect coverage
  • check-success = Run tests and collect coverage
This rule is failing.

Coverage and bundle analysis when app code changes

  • any of:
    • check-skipped = Run tests and collect coverage
    • check-success = Run tests and collect coverage

🔴 Quality / SonarCloud

Waiting for any of

  • check-skipped = SonarCloud Code Analysis
  • check-success = SonarCloud Code Analysis
This rule is failing.

SonarCloud analysis when app code changes

  • any of:
    • check-skipped = SonarCloud Code Analysis
    • check-success = SonarCloud Code Analysis

🔴 Security / Trivy

Waiting for any of

  • check-skipped = Trivy
  • check-success = Trivy
This rule is failing.

Container scan when Docker or runtime deps change

  • any of:
    • check-skipped = Trivy
    • check-success = Trivy

🔴 🚦 Auto-queue

Waiting for

  • label = automerge
This rule is failing.

When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.

  • label = automerge
  • -closed
  • -conflict
  • -draft
  • base = main
Show 2 satisfied protections

🟢 Security / npm audit

npm audit when lockfiles change

  • any of:
    • check-success = npm audit
    • check-skipped = npm audit

🟢 Security / CodeQL (javascript-typescript)

CodeQL for JS/TS when app code changes

  • any of:
    • check-success = Analyze (javascript-typescript)
    • check-skipped = Analyze (javascript-typescript)

@codecov

codecov Bot commented Aug 3, 2026

Copy link
Copy Markdown

❌ 19 Tests Failed:

Tests completed Failed Passed Skipped
569 19 550 0
View the top 3 failed test(s) by shortest run time 
test::tests/server/healthProbes.test.ts
Stack Traces | 3.08s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/reportHandlers.test.ts
Stack Traces | 3.09s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/jobHandlers.test.ts
Stack Traces | 3.1s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/k8sDiscovery.test.ts
Stack Traces | 3.11s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/translateLocale.test.ts
Stack Traces | 3.13s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/detailedHealthAuth.test.ts
Stack Traces | 3.13s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/sbomHandlers.test.ts
Stack Traces | 3.2s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/rbac.test.ts
Stack Traces | 3.22s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/healthMirror.test.ts
Stack Traces | 3.24s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/opaPolicy.test.ts
Stack Traces | 3.25s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/tenantNotificationPrefs.test.ts
Stack Traces | 3.35s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/authOidc.test.ts
Stack Traces | 3.38s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/api.test.ts
Stack Traces | 3.39s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/apiAuth.test.ts
Stack Traces | 3.4s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/scanImport.test.ts
Stack Traces | 3.4s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/metrics.test.ts
Stack Traces | 3.41s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/server/notificationTest.test.ts
Stack Traces | 3.42s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/integration/multi-tenant-api.test.ts
Stack Traces | 4.18s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }
test::tests/integration/cross-tenant-negative.test.ts
Stack Traces | 4.66s run time 
[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RaminNietzsche RaminNietzsche Awaiting requested review from RaminNietzsche RaminNietzsche is a code owner

Assignees

No one assigned

Labels

dependencies Dependabot PR javascript Pull requests that update javascript code size/L

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants