chore: update dependencies (incl. majors), upgrade Bun to 1.4.3, fix security advisories by sasagar · Pull Request #272 · Love-Rox/rox

sasagar · 2026-10-13T17:06:07Z

Summary

Bun 1.3.14 → 1.4.3

CI BUN_VERSION, Dockerfiles (oven/bun:1.4), bun-types / @types/bun

Major upgrades

Package	Change
@sentry/* 10 → 11	`sendDefaultPii` removed; v11 collects everything by default → explicit `dataCollection` opt-outs (headers, cookies, bodies, query, DB/queue data, stack vars, genAI, GraphQL)
jotai 2 → 3	`atomFamily` moved to `jotai-family`
bullmq 5 → 6, ioredis 5 → 6	Drop ioredis override (bullmq 6 uses peer ioredis); `protocol: 2` to keep RESP2 behavior
@simplewebauthn/* 13 → 14	No code change (ML-DSA-44 now preferred for new registrations)
eventsource 5, @hono/zod-validator 0.9	No code change
vite-plus 0.2 → 1.1	Bundles vitest 5
katex 0.17 → 0.19	Security advisory; `strict: false`, root `.katex` class unchanged

Minor/patch

waku 1.0.0-rc.3 (SpaLink adapted to PrefetchOptions), React 19.3, vite 8.3, Lingui 6.9, hono 4.13, zod 4.6, sharp 0.35.5, etc.

Security

bun audit: 32 → 2 (2 critical / 21 high → 1 high / 1 moderate)
Remaining: braces (via @lingui/cli, no upstream fix) and old esbuild (via drizzle-kit; dev server not used) — dev-only
bun.lock regenerated to pick up patched transitive deps
GitHub Actions bumped to latest; build-images.yml actions pinned by SHA

Format

Root vite.config.ts with fmt.ignorePatterns for generated files (drizzle meta, lingui messages)
Formatted remaining files; added Format check step to CI

Verification

✅ typecheck / vp lint / vp fmt --check
✅ unit tests 1026 pass, SQLite integration 28 pass
✅ bun run build (SSG 85 files)
✅ BullMQ 6 + ioredis 6 smoke test against Dragonfly (enqueue → process → complete, cache ops), RESP2 and RESP3

Supersedes Dependabot PRs #233, #254, #255, #256, #257, #265, #268, #270, #271.

🤖 Generated with Claude Code

Summary by CodeRabbit

変更点
- Bunを1.4に更新し、アプリの実行・ビルド環境をアップデートしました。
- 各種ライブラリを更新し、フロントエンドの画面遷移やバックエンドのRedis接続設定を調整しました。
- エラー監視で、ユーザー情報やリクエスト内容などの収集を明示的に無効化しました。
- CIにフォーマットチェックを追加し、コード品質を確認できるようにしました。
- GitHub Actionsの実行環境を更新しました。

…isories - Bun 1.3.14 -> 1.4.3 (CI BUN_VERSION, Dockerfiles oven/bun:1.4, bun-types/@types/bun) - waku 1.0.0-beta.6 -> 1.0.0-rc.3 (adapt SpaLink to PrefetchOptions API) - react/react-dom/react-server-dom-webpack 19.3.0, @types/react(-dom) 19.3.0 - vite 8.3.4, @lingui/* 6.9.1, @sentry/* 10.76.2 (align @sentry/core pin) - hono 4.13.13, zod 4.6.7, sharp 0.35.5, @aws-sdk/client-s3, bullmq, mysql2, pg, etc. - katex 0.17.0 -> 0.19.0 (prototype-pollution trust bypass advisory) - Regenerate bun.lock to pick up patched transitive deps - Add overrides for tinypool/vitest/@vitest/mocker (critical/moderate advisories) bun audit: 32 -> 2 vulnerabilities (remaining are dev-only with no upstream fix)

- actions/checkout v6 -> v7.0.1, docker/build-push-action v6 -> v7.4.0, docker/metadata-action v5 -> v6.2.0, docker/login-action v3 -> v4.6.0, docker/setup-buildx-action v3 -> v4.4.1 - softprops/action-gh-release 3.0.3, actions/deploy-pages 5.0.1, actions/attest-build-provenance 4.2.2, anchore/sbom-action 0.24.3 - Pin build-images.yml actions by commit SHA like other workflows - Fix github-script version comment (pinned SHA is v9.0.0)

- Add root vite.config.ts with fmt.ignorePatterns for generated files (drizzle-kit meta snapshots, lingui compiled messages) - Apply vp fmt to remaining source files - Add Format check step to CI

- @sentry/bun, @sentry/core, @sentry/react 10 -> 11 (replace removed sendDefaultPii with explicit dataCollection opt-outs; v11 collects everything by default) - jotai 2 -> 3 (atomFamily moved to jotai-family) - bullmq 5 -> 6, ioredis 5 -> 6 (drop ioredis override; pin RESP2 via protocol: 2 to keep v5 wire behavior) - @simplewebauthn/server, @simplewebauthn/browser 13 -> 14 - eventsource 4 -> 5, @hono/zod-validator 0.8 -> 0.9 - vite-plus 0.2 -> 1.1 (bundles vitest 5; drop tinypool/vitest overrides)

coderabbitai · 2026-10-13T17:06:26Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: Love-Rox/rox/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 65ba4206-dab2-4c5b-bd65-8fca3adf8dfd

📥 Commits

Reviewing files that changed from the base of the PR and between 5907a72 and 5a59d69.

⛔ Files ignored due to path filters (1)

bun.lock is excluded by !**/*.lock

📒 Files selected for processing (25)

.github/workflows/auto-tag.yml
.github/workflows/build-images.yml
.github/workflows/ci.yml
.github/workflows/close-issues.yml
.github/workflows/docs.yml
.github/workflows/release.yml
.github/workflows/sync-dev.yml
docker/Dockerfile.backend
docker/Dockerfile.frontend
package.json
packages/backend/package.json
packages/backend/src/adapters/cache/DragonflyCacheAdapter.ts
packages/backend/src/lib/sentry.ts
packages/backend/src/services/ReceivedActivitiesCleanupService.ts
packages/backend/src/services/RemoteInstanceRefreshService.ts
packages/backend/src/services/ScheduledNotePublisher.ts
packages/backend/src/services/ap/ActivityDeliveryQueue.ts
packages/frontend/package.json
packages/frontend/src/components/layout/Sidebar.tsx
packages/frontend/src/components/ui/SpaLink.tsx
packages/frontend/src/lib/atoms/column.ts
packages/frontend/src/lib/sentry.ts
packages/frontend/src/styles/globals.css
packages/shared/package.json
vite.config.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

GitHub Actions、Bun、アプリケーション依存関係を更新します。RedisとSentryの設定を変更し、Waku連携とatomFamilyのimport元を調整します。ルートにVite+設定を追加し、CIにフォーマット検査を追加します。

Changes: ツールチェーンとランタイム

Layer / File(s)	Summary
ワークフローの更新 `.github/workflows/*`	Checkout、Buildx、GHCR、SBOM、provenance、リリースなどの各アクションの参照を更新します。CIとドキュメントワークフローのBunを`1.4.3`に更新し、イメージ作成ワークフローのアクションをコミットSHAに固定します。
Bunとパッケージ依存関係の更新 `docker/Dockerfile.*`, `package.json`, `packages/backend/package.json`, `packages/frontend/package.json`, `packages/shared/package.json`	Dockerのビルド・本番ステージをBun `1.4`に変更します。各パッケージの依存バージョンを更新し、`jotai-family`を追加します。ルートの`ioredis` overrideを削除します。
ランタイム連携設定 `packages/backend/src/adapters/cache/DragonflyCacheAdapter.ts`, `packages/backend/src/services/ap/ActivityDeliveryQueue.ts`, `packages/backend/src/lib/sentry.ts`, `packages/frontend/src/lib/sentry.ts`, `packages/frontend/src/components/ui/SpaLink.tsx`, `packages/frontend/src/lib/atoms/column.ts`	Redis接続でRESP2を指定します。Sentryのデータ収集設定を、対象項目を明示的に無効化する構成に変更します。`SpaLink`は`prefetchOnEnter`が真の場合に空のオプションを渡し、`atomFamily`のimport元を`jotai-family`に変更します。
フォーマット設定と適用 `vite.config.ts`, `.github/workflows/ci.yml`, `packages/backend/src/services/*`, `packages/backend/src/lib/sentry.ts`, `packages/frontend/src/components/layout/Sidebar.tsx`, `packages/frontend/src/styles/globals.css`	Vite+のフォーマット対象からDrizzleの生成メタデータとLinguiの生成メッセージを除外します。CIに`bun run format:check`を追加します。監視呼び出し、型宣言、サイドバー条件式、CSSの記述を整形します。

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 5a59d

No actionable issue was established in the reviewed changes; the PR is mergeable subject to normal checks.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		タイトルは、依存関係の更新、Bun 1.4.3への更新、セキュリティアドバイザリへの対応という変更の主要内容を明確に示しています。
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 11 files. (14 skipped: …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

style: fix format:check on dev after merging #272 and #274

sasagar added 4 commits October 13, 2026 17:45

style: fix format:check and enforce it in CI

aacf6ff

- Add root vite.config.ts with fmt.ignorePatterns for generated files (drizzle-kit meta snapshots, lingui compiled messages) - Apply vp fmt to remaining source files - Add Format check step to CI

sasagar mentioned this pull request Oct 13, 2026

fix: BullMQ fails on Dragonfly without --default_lua_flags=allow-undeclared-keys #273

Closed

sasagar merged commit 2893837 into dev Oct 13, 2026
11 checks passed

sasagar mentioned this pull request Oct 13, 2026

style: fix format:check on dev after merging #272 and #274 #275

Merged

sasagar added a commit that referenced this pull request Oct 13, 2026

Merge pull request #275 from Love-Rox/style/format-after-273

450b6cd

style: fix format:check on dev after merging #272 and #274

Navigation Menu

Repository navigation

chore: update dependencies (incl. majors), upgrade Bun to 1.4.3, fix security advisories - #272

chore: update dependencies (incl. majors), upgrade Bun to 1.4.3, fix security advisories#272
sasagar merged 4 commits into
devfrom
chore/update-deps-2026-10

sasagar commented Oct 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

sasagar commented Oct 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Bun 1.3.14 → 1.4.3

Major upgrades

Minor/patch

Security

Format

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

sasagar commented Oct 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading