Evobug/bot

Watch

Fork 0

chore(deps): bump all dependencies to latest #294

Merged

sionzee merged 1 commit from claude/bump-deps into main

2026-10-22 16:49:03 +02:00

sionzee commented

2026-10-22 16:45:38 +02:00

Owner

Bumps every dependency to its latest major, minor or patch version.

Majors

Package	From	To	Notes
openai	6.37.0	7.42.0	Only type imports from `openai/resources/chat/completions` plus the client in `utils/openrouter.ts`; type-check passes
dotenv	17.4.2	18.0.8	Not imported anywhere in `src` (Bun loads `.env` itself)
execa	9.6.1	10.2.0	Not imported anywhere in `src`
@types/node (dev)	25.8.0	26.6.5
oxlint-tsgolint (dev)	0.25.0	7.0.2004	Version scheme now follows tsgo 7; oxlint 1.89 needs `>=7.0.2003`

Minor/patch

zod 4.6.7, livekit-server-sdk 2.19.2, oxlint 1.89.0, @types/bun 1.4.3, @faker-js/faker 10.6.0, @snazzah/davey 0.1.12, tsgo nightly, plus transitive updates.

discord.js family

discord.js stays on the dev tag and moves to 15.0.0-dev.1792497873-5050a3b54.
@discordjs/builders and @discordjs/formatters move from the old pr-11006 build to the matching dev build (same 5050a3b54 commit). That is the formatters version discord.js@dev depends on itself. Their npm latest (1.x/0.x) would be a downgrade.

Verification

bun run ts: the 3 schema-extractor.ts zod errors are gone, since zod now matches ../api (4.6.7). The 4 remaining errors (../api crypto BufferSource ×3, user.factory.ts ×1) fail the same way before and after this bump, so this PR doesn't cause them.
bun run lint: passes (warnings only).
bun test: 1147 pass, 10 skip, 0 fail.

Replaces Renovate PRs #281, #282, #287, #288, #292.

🤖 Generated with Claude Code

Bumps every dependency to its latest major, minor or patch version. ## Majors | Package | From | To | Notes | |---|---|---|---| | openai | 6.37.0 | 7.42.0 | Only type imports from `openai/resources/chat/completions` plus the client in `utils/openrouter.ts`; type-check passes | | dotenv | 17.4.2 | 18.0.8 | Not imported anywhere in `src` (Bun loads `.env` itself) | | execa | 9.6.1 | 10.2.0 | Not imported anywhere in `src` | | @types/node (dev) | 25.8.0 | 26.6.5 | | | oxlint-tsgolint (dev) | 0.25.0 | 7.0.2004 | Version scheme now follows tsgo 7; oxlint 1.89 needs `>=7.0.2003` | ## Minor/patch zod 4.6.7, livekit-server-sdk 2.19.2, oxlint 1.89.0, @types/bun 1.4.3, @faker-js/faker 10.6.0, @snazzah/davey 0.1.12, tsgo nightly, plus transitive updates. ## discord.js family - `discord.js` stays on the `dev` tag and moves to `15.0.0-dev.1792497873-5050a3b54`. - `@discordjs/builders` and `@discordjs/formatters` move from the old `pr-11006` build to the matching `dev` build (same `5050a3b54` commit). That is the formatters version discord.js@dev depends on itself. Their npm `latest` (1.x/0.x) would be a downgrade. ## Verification - `bun run ts`: the 3 `schema-extractor.ts` zod errors are gone, since zod now matches `../api` (4.6.7). The 4 remaining errors (`../api` crypto `BufferSource` ×3, `user.factory.ts` ×1) fail the same way before and after this bump, so this PR doesn't cause them. - `bun run lint`: passes (warnings only). - `bun test`: 1147 pass, 10 skip, 0 fail. Replaces Renovate PRs #281, #282, #287, #288, #292. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sionzee added 2 commits

2026-10-22 16:45:38 +02:00

fix(docker): clear image CVEs (OpenSSL, bundled ffmpeg, undici/ws/brace-expansion)

OpenCodeReview / review (deepseek) (pull_request) Failing after 7s

Details

CI / test (pull_request) Failing after 50s

Details

OpenCodeReview / review (luna) (pull_request) Successful in 1m21s

Details

55ea65d106

- Drop ffmpeg-static: prism-media preferred its bundled ffmpeg 7.0.2 over the
  system one. Voice now uses Alpine's ffmpeg (8.1.2 on the current base).
- apk upgrade at build and pull: true in CI so base packages (OpenSSL) are
  never served from a stale cached base.
- Install with --production: tsgo/tsgolint ship Go binaries with stdlib CVEs
  and faker is test-only; none are needed at runtime.
- discord.js dev -> undici 8.12.3; ws 8.22.0; brace-expansion 5.0.12;
  @orpc/* 1.16.1 (CORS Vary header CVE).

Trivy on the built image: 0 vulnerabilities at any severity.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

chore(deps): bump all dependencies to latest

OpenCodeReview / review (deepseek) (pull_request) Failing after 5s

Details

CI / test (pull_request) Failing after 39s

Details

OpenCodeReview / review (luna) (pull_request) Successful in 1m17s

Details

f11059f6c6

Majors: openai 7, dotenv 18, execa 10, @types/node 26, oxlint-tsgolint 7
(oxlint 1.89 requires tsgolint >=7.0.2003).

- @discordjs/builders + formatters move from the stale pr-11006 build to the
  dev build that matches discord.js@dev (same 5050a3b54 commit).
- discord.js stays on "dev" and @typescript/native-preview on "latest".
- zod 4.6.7 matches ../api, which clears 3 schema-extractor type errors.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sionzee force-pushed claude/bump-deps from f11059f6c6

OpenCodeReview / review (deepseek) (pull_request) Failing after 5s

Details

CI / test (pull_request) Failing after 39s

Details

OpenCodeReview / review (luna) (pull_request) Successful in 1m17s

Details

to 0f0196f3b1

CI / test (pull_request) Failing after 33s

Details

2026-10-22 16:46:52 +02:00

Compare

ocr-bot reviewed

2026-10-22 16:46:55 +02:00

ocr-bot left a comment

OpenCodeReview

Review complete: 0 finding(s) across 3 selected item(s).

_{model openai/gpt-5.6-luna · 3 file(s) reviewed · 153,356 tokens (145,828 in / 7,528 out / 98,618 cached — 68% of input) · 1m9s}

### OpenCodeReview Review complete: 0 finding(s) across 3 selected item(s). --- <sub>model `openai/gpt-5.6-luna` · 3 file(s) reviewed · 153,356 tokens (145,828 in / 7,528 out / 98,618 cached — 68% of input) · 1m9s</sub>