fix: unblock ioredis/bullmq bumps by deduping stale lockfile by LucasSantana-Dev · Pull Request #2033 · LucasSantana-Dev/Lucky

LucasSantana-Dev · 2026-08-15T22:11:49Z

Summary

Merges dependabot #2028 (ioredis 5.11.1 -> 6.0.0) and #2026 (bullmq 5.81.3 -> 6.0.9), which were both held on the same TS2322 break in packages/bot/src/utils/batch/batchQueue.ts:30. The break was a stale package-lock.json, not a code incompatibility: each dependabot PR's lockfile diff was generated independently, and merging both left two conflicting ioredis copies in the tree (root 5.11.1 vs packages/shared/node_modules 6.0.0), so TypeScript rejected passing one Redis client type into bullmq's ConnectionOptions.

Fix: rm -rf node_modules package-lock.json && npm install to force a full re-resolve, dedupes to a single ioredis@6.0.0. No source changes.

Full root-cause writeup and repro steps: closes #2032.

Test plan

packages/bot: tsc --noEmit clean
packages/backend: tsc --noEmit clean
bot suite: 240/241 passed (1 pre-existing skip, unrelated), 3133 tests
backend suite: 85/85 suites, 1352 tests
shared suite: 73/73 suites, 1407 tests

Summary by cubic

Dedupes the lockfile and upgrades to ioredis@6 and bullmq@6 so TypeScript no longer sees mixed ioredis versions. Previously we resolved both ioredis@5 and @6 (TS2322); now we resolve a single ioredis@6.0.0 and declare it explicitly where used.

Bumps bullmq to ^6 in root, packages/bot, and packages/shared; bumps ioredis to ^6 in packages/shared and adds ioredis ^6 as a direct dependency in packages/bot; regenerates package-lock.json to dedupe to one ioredis@6.0.0. No TypeScript code changes.
Required: clean install to clear stale duplicates (remove node_modules and package-lock.json, then run npm install or npm ci).

^{Written for commit 144155a. Summary will update on new commits.}

Summary by CodeRabbit

Chores
- Updated BullMQ to version 6 across the application.
- Updated the Redis client library to version 6 in shared components.
- Improved compatibility with the latest queue and Redis infrastructure.

Bumps [bullmq](https://github.com/taskforcesh/bullmq) from 5.81.3 to 6.0.9. - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](taskforcesh/bullmq@v5.81.3...v6.0.9) --- updated-dependencies: - dependency-name: bullmq dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [ioredis](https://github.com/redis/ioredis) from 5.11.1 to 6.0.0. - [Release notes](https://github.com/redis/ioredis/releases) - [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md) - [Commits](redis/ioredis@v5.11.1...v6.0.0) --- updated-dependencies: - dependency-name: ioredis dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…6.0.0' into fix/2028-2026-ioredis-bullmq-batchqueue

….0.9' into fix/2028-2026-ioredis-bullmq-batchqueue

Closes #2032

coderabbitai · 2026-08-15T22:12:07Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8c10158a-690c-4957-b7f1-21d0b1d517e0

📥 Commits

Reviewing files that changed from the base of the PR and between 522139c and 01cd119.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

package.json
packages/bot/package.json
packages/shared/package.json

📝 Walkthrough

Walkthrough

The change updates BullMQ from version 5 to version 6 in the root, bot, and shared packages. The shared package also updates ioredis from version 5 to version 6.

Changes

Dependency updates

Layer / File(s)	Summary
Update dependency version ranges `package.json`, `packages/bot/package.json`, `packages/shared/package.json`	The manifests update BullMQ to version 6. The shared package updates ioredis to version 6.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 01cd1

The PR refreshes dependency resolutions to remove conflicting ioredis versions without changing source behavior, and the documented checks pass; no actionable merge-blocking risk remains beyond normal review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The dependency bumps match issue `#2032`, but the required lockfile deduplication cannot be verified because package-lock.json was excluded.	Include package-lock.json in the review or provide evidence that it resolves to a single ioredis@6.0.0 installation.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The reviewed changes only update the ioredis and bullmq dependencies, which directly support issue `#2032`.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency bumps and stale lockfile deduplication, which are the main changes in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/2028-2026-ioredis-bullmq-batchqueue

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-15T22:12:32Z

Failed to generate code suggestions for PR

socket-security · 2026-08-15T22:12:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@commitlint/cli@21.2.1 ⏵ 21.2.2			⁺⁴
globals@17.10.0 ⏵ 17.11.0	⁺¹	⁺¹	⁺²
rollup-plugin-visualizer@7.0.1 ⏵ 7.1.1	⁺¹		⁺⁶
@testing-library/user-event@14.6.3 ⏵ 14.6.4		⁺¹
@swc/core@1.15.47 ⏵ 1.16.0			⁺¹
zustand@5.0.14 ⏵ 5.0.15	⁺¹	⁺¹	⁺⁶
ioredis@5.11.1 ⏵ 6.0.0			⁺²
bullmq@5.81.3 ⏵ 6.1.1			⁺¹
@commitlint/config-conventional@21.2.0 ⏵ 21.2.2			⁺⁴
@hookform/resolvers@5.7.1 ⏵ 5.9.0			⁺²

View full report

socket-security · 2026-08-15T22:12:51Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `mediaplex-android-arm-eabi` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-android-arm-eabi@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-android-arm-eabi@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-android-arm64` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-android-arm64@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-android-arm64@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-darwin-arm64` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-darwin-arm64@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-darwin-arm64@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-darwin-universal` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-darwin-universal@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-darwin-universal@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-darwin-x64` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-darwin-x64@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-darwin-x64@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-freebsd-x64` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-freebsd-x64@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-freebsd-x64@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-linux-arm-gnueabihf` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-linux-arm-gnueabihf@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-linux-arm-gnueabihf@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-linux-arm-musleabihf` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-linux-arm-musleabihf@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-linux-arm-musleabihf@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-linux-arm64-gnu` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-linux-arm64-gnu@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-linux-arm64-gnu@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-linux-arm64-musl` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-linux-arm64-musl@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-linux-arm64-musl@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-linux-riscv64-gnu` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-linux-riscv64-gnu@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-linux-riscv64-gnu@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-linux-x64-musl` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-linux-x64-musl@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-linux-x64-musl@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-win32-arm64-msvc` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-win32-arm64-msvc@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-win32-arm64-msvc@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-win32-ia32-msvc` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-win32-ia32-msvc@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-win32-ia32-msvc@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `mediaplex-win32-x64-msvc` Location: Package overview From: package-lock.json → `npm/discord-player@7.2.0` → `npm/mediaplex-win32-x64-msvc@1.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mediaplex-win32-x64-msvc@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-08-15T22:13:10Z

	Warnings
⚠️	Big PR — 5283 lines changed across 4 files. Consider splitting into smaller, reviewable chunks.

Generated by 🚫 dangerJS against 144155a

cubic-dev-ai

All reported issues were addressed across 4 files

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic}

graphify-labs

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify review — findings

This PR bumps a large number of dependency versions in package-lock.json, most notably upgrading the root bullmq dependency from ^5 to ^6, along with many transitive AWS SDK and Smithy package version updates. It also removes a nested source-map dependency entry and touches related package.json/lockfile metadata across the bot and shared packages. The changes are confined to dependency/lockfile updates and package configuration rather than application source logic.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 343 functions depend on the 343 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 343 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

verification_scope: 343 function(s) in the blast radius were not formally verified this run

Bot used the ioredis Redis type directly (batchJobWorker.ts) but only got it via transitive hoisting from packages/shared. Pin it explicitly to the same version so it can't silently drift to a second copy again.

LucasSantana-Dev · 2026-08-15T22:24:26Z

Fixed in 144155a — declared ioredis explicitly in packages/bot/package.json (pinned to ^6.0.0, matching packages/shared's pin) instead of relying on transitive hoisting. Good catch, this is exactly the kind of implicit-resolution fragility that caused the original break.

cubic-dev-ai

0 issues found across 2 files (changes from recent commits).

_{Requires human review: Major version upgrade of queue/Redis libs (bullmq 5->6, ioredis 5->6) with large lockfile churn; operational impact and compatibility need human sign-off.

Re-trigger cubic}

graphify-labs

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify review — findings

This PR is primarily a dependency update to the package-lock.json lockfile in a monorepo containing bot and shared packages. It bumps bullmq from ^5 to ^6 and updates numerous transitive/optional dependencies (notably many @aws-sdk/@smithy packages) to newer patch/minor versions, and removes a nested source-map entry. Based on the changed symbol list, it also appears to touch various package.json files across the root, bot, and shared packages (dependencies, devDependencies, scripts, engines, exports, and overrides).

No blocking issues surfaced. 1 lower-confidence candidate did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 345 functions depend on the 345 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 345 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

verification_scope: 345 function(s) in the blast radius were not formally verified this run

sonarqubecloud · 2026-08-15T22:28:32Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

🤖 I have created a release *beep* *boop* --- <details><summary>2.39.5</summary> ## [2.39.5](v2.39.4...v2.39.5) (2026-08-19) ### Bug Fixes * **bot:** support yt-dlp cookies file to dodge YouTube 403 ([#2036](#2036)) ([2ec1868](2ec1868)) * **deps:** override deepmerge-ts to 8.0.1 to close security gate ([#2038](#2038)) ([04a7f85](04a7f85)) * drop dead guild-guard entry for nonexistent features route ([#2030](#2030)) ([522139c](522139c)) * unblock ioredis/bullmq bumps by deduping stale lockfile ([#2033](#2033)) ([0c6cb0d](0c6cb0d)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

dependabot Bot and others added 5 commits August 15, 2026 07:58

Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/ioredis-…

6640180

…6.0.0' into fix/2028-2026-ioredis-bullmq-batchqueue

Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/bullmq-6…

fb498aa

….0.9' into fix/2028-2026-ioredis-bullmq-batchqueue

fix: regenerate lockfile to dedupe stale ioredis after dependabot merge

01cd119

Closes #2032

github-actions Bot added dependencies Pull requests that update a dependency file bot shared size/xl labels Aug 15, 2026

LucasSantana-Dev enabled auto-merge (squash) August 15, 2026 22:12

cubic-dev-ai Bot reviewed Aug 15, 2026

View reviewed changes

Comment thread packages/bot/package.json

graphify-labs Bot reviewed Aug 15, 2026

View reviewed changes

fix: declare ioredis as explicit dependency in packages/bot

144155a

Bot used the ioredis Redis type directly (batchJobWorker.ts) but only got it via transitive hoisting from packages/shared. Pin it explicitly to the same version so it can't silently drift to a second copy again.

cubic-dev-ai Bot reviewed Aug 15, 2026

View reviewed changes

graphify-labs Bot reviewed Aug 15, 2026

View reviewed changes

LucasSantana-Dev merged commit 0c6cb0d into main Aug 15, 2026
49 checks passed

LucasSantana-Dev deleted the fix/2028-2026-ioredis-bullmq-batchqueue branch August 15, 2026 22:34

This was referenced Aug 15, 2026

chore(deps): bump ioredis from 5.11.1 to 6.0.0 #2028

Closed

chore: release 2.39.5 #2031

Merged

chore(deps): bump bullmq from 5.81.3 to 6.0.9 #2026

Closed

LucasSantana-Dev mentioned this pull request Aug 19, 2026

chore: release 2.39.6 #2039

Merged

LucasSantana-Dev mentioned this pull request Sep 7, 2026

chore: release 2.43.0 #2294

Merged

This was referenced Oct 1, 2026

chore: release 2.47.5 #2533

Merged

chore: release 2.52.0 #2665

Merged

LucasSantana-Dev mentioned this pull request Oct 8, 2026

chore: release 2.58.8 #2775

Merged

Conversation

LucasSantana-Dev commented Aug 15, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by cubic

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 inconclusive)

Uh oh!

github-actions Bot commented Aug 15, 2026

Uh oh!

socket-security Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

graphify-labs Bot left a comment

Choose a reason for hiding this comment

Graphify review — findings

Impact & health

Graphify review

Gate & verification

graphify gate

Uh oh!

LucasSantana-Dev commented Aug 15, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

graphify-labs Bot left a comment

Choose a reason for hiding this comment

Graphify review — findings

Impact & health

Graphify review

Gate & verification

graphify gate

Uh oh!

sonarqubecloud Bot commented Aug 15, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

LucasSantana-Dev commented Aug 15, 2026 •

edited by cubic-dev-ai Bot

Loading

coderabbitai Bot commented Aug 15, 2026 •

edited

Loading

socket-security Bot commented Aug 15, 2026 •

edited

Loading

socket-security Bot commented Aug 15, 2026 •

edited

Loading

github-actions Bot commented Aug 15, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading