chore(deps): bump all dependencies to latest #251

sionzee · 2026-10-22T16:48:26+02:00

sionzee commented

2026-10-22 16:48:26 +02:00

Bumps every dependency to its latest version.

Changes

Package	From	To
@orpc/client / contract / server	1.14.3	1.16.1
zod	4.4.3	4.6.7
pg / @types/pg	8.20.0	8.23.1
jose	6.2.3	6.2.13
node-cron	4.2.1	4.6.0
@electric-sql/pglite	0.5.4	0.5.11
drizzle-orm / drizzle-kit	1.0.0-rc.5-ab785fc	1.0.0-rc.5 (`rc` dist-tag, published 2026-10-21)
drizzle-zod	1.0.0-beta.9-e89174b	1.0.0-beta.14-a36c63d (`beta` dist-tag)
@types/bun	1.3.14	1.4.3
oxlint	1.64.0	1.89.0
oxlint-tsgolint	7.0.2001	7.0.2004
csv-parse	7.0.2	7.0.3
@typescript/native-preview	still `latest`	lockfile now resolves 7.0.0-dev.20260707.2

Drizzle stays on the 1.0 pre-release line. The latest tags (0.45 / 0.31 / 0.8) would be a downgrade.

Code fix

With the newer lib types, crypto.subtle.* no longer accepts a Uint8Array<ArrayBufferLike> as BufferSource. The relevant signatures in src/utils/playtest-crypto.ts and src/utils/totp.ts are now typed as Uint8Array<ArrayBuffer>. This is a type-only change.

Verification

bunx tsgo --noEmit: clean
bunx oxlint --type-aware: 198 warnings, 0 errors (same as main)
bun test: 721 pass, 0 fail

🤖 Generated with Claude Code

Bumps every dependency to its latest version. ## Changes | Package | From | To | |---|---|---| | @orpc/client / contract / server | 1.14.3 | 1.16.1 | | zod | 4.4.3 | 4.6.7 | | pg / @types/pg | 8.20.0 | 8.23.1 | | jose | 6.2.3 | 6.2.13 | | node-cron | 4.2.1 | 4.6.0 | | @electric-sql/pglite | 0.5.4 | 0.5.11 | | drizzle-orm / drizzle-kit | 1.0.0-rc.5-ab785fc | 1.0.0-rc.5 (`rc` dist-tag, published 2026-10-21) | | drizzle-zod | 1.0.0-beta.9-e89174b | 1.0.0-beta.14-a36c63d (`beta` dist-tag) | | @types/bun | 1.3.14 | 1.4.3 | | oxlint | 1.64.0 | 1.89.0 | | oxlint-tsgolint | 7.0.2001 | 7.0.2004 | | csv-parse | 7.0.2 | 7.0.3 | | @typescript/native-preview | still `latest` | lockfile now resolves 7.0.0-dev.20260707.2 | Drizzle stays on the 1.0 pre-release line. The `latest` tags (0.45 / 0.31 / 0.8) would be a downgrade. ## Code fix With the newer lib types, `crypto.subtle.*` no longer accepts a `Uint8Array<ArrayBufferLike>` as `BufferSource`. The relevant signatures in `src/utils/playtest-crypto.ts` and `src/utils/totp.ts` are now typed as `Uint8Array<ArrayBuffer>`. This is a type-only change. ## Verification - `bunx tsgo --noEmit`: clean - `bunx oxlint --type-aware`: 198 warnings, 0 errors (same as `main`) - `bun test`: 721 pass, 0 fail 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sionzee added 1 commit

2026-10-22 16:48:26 +02:00

chore(deps): bump all dependencies to latest

OpenCodeReview / review (deepseek) (pull_request) Failing after 5s

Details

Tests / test (pull_request) Successful in 55s

Details

OpenCodeReview / review (luna) (pull_request) Successful in 1m36s

Details

a912032988

- orpc 1.16.1, zod 4.6.7, pg 8.23.1, jose 6.2.13, node-cron 4.6.0,
  pglite 0.5.11, oxlint 1.89.0, @types/bun 1.4.3 and other patch bumps
- drizzle-orm / drizzle-kit: 1.0.0-rc.5-ab785fc -> 1.0.0-rc.5 (rc tag)
- drizzle-zod: 1.0.0-beta.9-e89174b -> 1.0.0-beta.14-a36c63d (beta tag)
- type Web Crypto inputs as Uint8Array<ArrayBuffer>; the newer lib types
  no longer accept ArrayBufferLike-backed views as BufferSource

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sionzee merged commit 640d8ac60c into main

2026-10-22 16:48:54 +02:00

sionzee deleted branch claude/bump-deps

2026-10-22 16:48:54 +02:00

sionzee referenced this pull request from a commit

2026-10-22 16:48:55 +02:00

Merge pull request 'chore(deps): bump all dependencies to latest' (#251) from claude/bump-deps into main

ocr-bot reviewed

2026-10-22 16:50:03 +02:00

ocr-bot left a comment

OpenCodeReview (`openai/gpt-5.6-luna`) — 1 finding

1 posted inline.

_{model openai/gpt-5.6-luna · 3 file(s) reviewed · 161,000 tokens (150,846 in / 10,154 out / 125,404 cached — 83% of input) · 1m31s}

### OpenCodeReview (`openai/gpt-5.6-luna`) — 1 finding 1 posted inline. --- <sub>model `openai/gpt-5.6-luna` · 3 file(s) reviewed · 161,000 tokens (150,846 in / 10,154 out / 125,404 cached — 83% of input) · 1m31s</sub>

src/utils/playtest-crypto.ts

					
				@ -252,3 +252,3 @@

				 * invite tokens - where there is nothing to brute-force.

				 */

				export async function sha256Hex(value: string | Uint8Array): Promise<string> {

				export async function sha256Hex(value: string | Uint8Array<ArrayBuffer>): Promise<string> {

[maintainability · medium] This exported parameter is now narrower than the previous Uint8Array API: a caller with a Uint8Array<ArrayBufferLike> (including a normal unparameterized Uint8Array in newer TypeScript or a view backed by SharedArrayBuffer) can no longer pass it, even though hashing the bytes is otherwise valid. Accept the broader view and copy/normalize it to an ArrayBuffer-backed Uint8Array before calling subtle.digest so the dependency/type upgrade does not introduce a source-compatible API break.

export async function sha256Hex(value: string | Uint8Array): Promise<string> {
	const bytes: Uint8Array<ArrayBuffer> =
		typeof value === "string" ? new TextEncoder().encode(value) : new Uint8Array(value);

**[maintainability · medium]** This exported parameter is now narrower than the previous `Uint8Array` API: a caller with a `Uint8Array<ArrayBufferLike>` (including a normal unparameterized `Uint8Array` in newer TypeScript or a view backed by `SharedArrayBuffer`) can no longer pass it, even though hashing the bytes is otherwise valid. Accept the broader view and copy/normalize it to an `ArrayBuffer`-backed `Uint8Array` before calling `subtle.digest` so the dependency/type upgrade does not introduce a source-compatible API break. ```suggestion export async function sha256Hex(value: string | Uint8Array): Promise<string> { const bytes: Uint8Array<ArrayBuffer> = typeof value === "string" ? new TextEncoder().encode(value) : new Uint8Array(value); ```

Sign in to join this conversation.

No reviewers