chore(deps): Update production (non-major) #141

Merged

renovate merged 1 commit from renovate/production-(non-major) into main 2026-09-11 09:25:50 +00:00

Conversation 0 Commits 1 Files changed 1 +140 -127

renovate commented 2026-09-11 09:04:49 +00:00

Collaborator

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
nodemailer (source)	10.0.2 → 10.0.3
pg-boss (source)	12.30.0 → 12.31.0
vite (source)	8.2.2 → 8.3.0
zod (source)	4.6.0 → 4.6.2

---

Release Notes

nodemailer/nodemailer (nodemailer)

v10.0.3

Compare Source

Bug Fixes

• fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #​1856

timgit/pg-boss (pg-boss)

v12.31.0

Compare Source

What's Changed

Schema version: 41 (a migration runs on upgrade — see Upgrading).

• Schedules gain RRULE expression format, can catch up after an outage, and can be read back without a query of your own.
• Bun support

Highlights

Schedules take RRULE expressions

schedule() now accepts a recurrence rule (RFC 5545) anywhere a cron expression goes, for the schedules cron cannot express — the last Friday of the month, every second Monday, a schedule that stops on a date or after a number of runs.

// 5pm on the last Friday of the month, Chicago time
await boss.schedule('report', 'FREQ=MONTHLY;BYDAY=-1FR;BYHOUR=17', null, { tz: 'America/Chicago' })

The expression is either the rule on its own or the recurrence lines of a calendar entry — DTSTART, RRULE, and optional RDATE and EXDATE:

await boss.schedule('standup', [
  'DTSTART;TZID=Europe/Berlin:20260901T090000',
  'RRULE:FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR',
  'EXDATE;TZID=Europe/Berlin:20261224T090000'
].join('\n'))

An expression carrying FREQ=, or a line opening with an iCalendar property, is a rule; everything else is cron, which cannot be mistaken for one since no cron field contains =, : or ;. schedule() decides once and stores the answer in the schedule table's new kind column, so an expression is never validated as one format and evaluated as the other. getSchedules() returns it.

schedule() rejects the rules a parser would quietly read differently than they were meant, such as an unknown part or a value out of range, and the combinations RFC 5545 forbids outright. A finite rule with nothing left to send is also rejected rather than stored.

Schedules can catch up after an outage

When the Timekeeper does a schedule check, the pass sends the occurrences of the preceding 60 seconds, which is compared against the history to see if a job was missed. The new missed option decides what a schedule does about that.

missed	What a schedule sends for a gap
skip	Nothing. The default, and what every earlier release did
once	One job, for the most recent missed occurrence, however many were missed

// a nightly report reads the current state of the world, so three missed nights are one report
await boss.schedule('report', '0 3 * * *', null, { missed: 'once' })

Worth knowing before choosing once: a caught-up job is indistinguishable from an on-time one, it names the most recent missed occurrence rather than each one, and it can arrive beside the occurrence due now — two jobs, filed under two minutes, unless queue policy or a singletonKey collapses them. The option applies to both expression formats.

New scheduling funcitons: getSchedule() and previewSchedule()

const schedule = await boss.getSchedule('report', 'eu')

getSchedule(name, key) reads the one row a (name, key) pair can have, or null, instead of filtering the array getSchedules() returns. key defaults to the empty string, the key schedule() uses when none is given.

const next = boss.previewSchedule('FREQ=MONTHLY;BYDAY=-1FR;BYHOUR=17', { tz: 'America/Chicago', count: 3 })

previewSchedule(cron, options) answers with the next occurrences as an array of Date. It is pure computation — no query, no started instance — and it tells the two formats apart the way schedule() does, so a stored schedule can be previewed straight from its cron column. count defaults to 5 and is capped at 1000; from defaults to database time and takes the last occurrence of one page to get the next; the expression and zone are validated exactly as schedule() validates them, so anything it previews can also be stored. The walk gives up after a second rather than hold the event loop, so a sparse expression asked for a large count answers with fewer.

Every schedule names the job it last produced

The schedule row now carries lastJobId, so a schedule can be joined to its most recent run without keeping a record of your own. It is nullable and unconstrained on purpose: the job it names is subject to retention and will eventually be deleted, so a foreign key would either block retention or take the schedule with it.

pg-boss runs on Bun

Bun is now a supported runtime, exercised in CI on every commit: a conformance suite drives install, send, fetch, complete, workers, scheduling and maintenance through bun test against a real PostgreSQL.

Bun's own client is supported as a driver alongside pg, so a Bun application can share one client and one pool with pg-boss:

import { SQL } from 'bun'
import PgBoss, { fromBunSql } from 'pg-boss'

const boss = new PgBoss({ db: fromBunSql(new SQL(process.env.DATABASE_URL)) })

sql.listen() is used where the runtime has it (Bun 1.4.0 and later), so a Bun deployment gets the same LISTEN/NOTIFY delivery a pg one does, and falls back to polling on an older runtime. The client stays yours — pg-boss never calls end() on it. You do not need the adapter to run on Bun: the bundled pg driver works under the runtime, and a connection string is the simpler choice.

Two fixes underneath it reach further than Bun:

• json parameters are cast through ::text for drivers that infer parameter types from the statement and would otherwise reject a json argument (#​880, #​897).
• array parameters are expanded for drivers that cannot encode a JavaScript array, which also repairs the completion paths under fromDrizzle() on bun-sql.

The CLI knows which engine it is talking to

A connection string does not say which engine answers it, and the engines do not accept the same schema — so pg-boss migrate against CockroachDB emitted table partitioning, advisory locks and covering indexes, and failed partway through. The CLI now takes the same backend profile the library constructor does:

pg-boss migrate --backend cockroachdb --connection-string postgres://root@localhost:26257/mydb

PGBOSS_BACKEND=yugabytedb pg-boss migrate

--backend, PGBOSS_BACKEND or "backend" in the config file, resolved through the library's own resolver, so create, migrate, rollback, plans, doctor and reindex all emit what that backend accepts and the CLI cannot disagree with a running instance. reindex now says so up front on an engine that has no REINDEX, instead of surfacing a raw catalog error. pglite is in-process and rejected here.

The exported plan functions take the same profile, for a caller that generates SQL from code rather than from the CLI:

const sql = getMigrationPlans('pgboss', 39, { backend: 'cockroachdb' })
const ddl = getConstructionPlans('pgboss', { backend: 'cockroachdb', createSchema: false })

getConstructionPlans(), getMigrationPlans() and getRollbackPlans() each accept backend in their options, resolved by the same resolver the constructor and the CLI use, and default to stock PostgreSQL as before. The profile is read capability by capability rather than as one distributed switch, so a plan drops only what that engine actually refuses: CockroachDB loses table partitioning, advisory locks, covering indexes and deferrable constraints, while YugabyteDB loses the first two and keeps the rest. Migration and rollback plans are built from the same backend-filtered migration set a live migration runs, so a statement an engine cannot execute — the column written in the transaction that added it, which noAddColumnBackfill drops — is left out of the exported SQL for the same reason and at the same place. A name that is not a profile throws where it is named, rather than reaching the script.

getConstructionPlans() takes an options object at all for the first time, which also makes createSchema: false reachable from the export for a schema that already exists or is created by something else. getIndexBloatPlans() is unchanged: it reads catalog statistics rather than emitting DDL.

Also in this release

• A new noAddColumnBackfill compatibility flag for engines that refuse to write a column in the transaction that added it. CockroachDB sets it, which is what lets it migrate at all — see Upgrading.
• previewScheduleMaxCount is exported, so a service putting previewSchedule() behind an API can validate count against the same ceiling rather than a literal of its own.

Upgrading

Schema 41 adds schedule.kind (defaulted and CHECK-constrained) and schedule.last_job_id uuid, backfills schedule.timezone and gives it a default — catalog-only changes, no table rewrite.

Every cron schedule can send twice during a rolling upgrade. The internal key that collapses a schedule's occurrence to one job changes format, and the two formats do not collide with each other, so while instances straddle releases one occurrence can produce two jobs. Passes claim every cronMonitorIntervalSeconds (30 by default) against a 60-second window, so at least two passes land inside every occurrence's window and a rollout only has to put one of them on each release. Handlers that are not idempotent are worth stopping the schedulers for across the switch. The change itself fixes a real loss: the old key concatenated the queue name and the schedule key with __, and _ is legal in both, so ('report_', 'daily') and ('report', '_daily') produced the same key and one of the two schedules silently lost its job every minute the occurrences coincided.

Schedules with no time zone become UTC. Rows written before zones were validated could hold timezone IS NULL, which read as the local zone of whatever instance evaluated them. The migration backfills those to UTC and the column now defaults to it. A deployment relying on the old reading should set the zone it wants before upgrading.

Rule schedules should wait for the deployment to finish. An instance still on an older release reads a rule as cron, cannot parse it, and reports an invalid_schedule warning until it is replaced, so add rule schedules once every instance is on 12.31.0.

CockroachDB can migrate again. It refuses to write a column in the transaction that added it, which schema 40 does — so a CockroachDB deployment on schema 39 could not reach 40 in 12.30.0, and would not have reached 41 either. Both migrations now leave that statement out on a backend that declares noAddColumnBackfill, and both give the runtime the same answer without it: the monitor claim falls back to monitor_on when it is NULL, which is the value the skipped statement would have written, so the upgrade stampede that seed prevents is closed on every backend rather than only on the ones whose migration could write the column. Schema 41's label is left to the first cron pass instead, so a schedule holding a rule reads as cron from getSchedules() until a pass reaches it and corrects it — nothing is lost, and a deployment running passes closes that window in one interval.

Scripted migrations against a non-PostgreSQL engine need --backend. A pg-boss migrate in a deploy script keeps assuming stock PostgreSQL unless the profile is named, so add --backend cockroachdb (or PGBOSS_BACKEND) wherever the CLI runs against one of the distributed engines.

Rolling back to 40 drops both columns and leaves timezone's default in place, which is harmless: a 12.30.0 instance names the column on every write.

New Contributors

• @​jperelli made their first contribution in #​892
• @​toruiwasa made their first contribution in #​897

Full Changelog: https://github.com/timgit/pg-boss/compare/12.30.0...12.31.0

vitejs/vite (vite)

v8.3.0

Compare Source

Features

• build: avoid settling seen preload dependencies for performance (#​23446) (e6f6b3e)
• devtools: enable dev server integration (#​23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#​23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#​23110) (e17d2d5)
• add top-level tsconfig option (#​23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#​23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#​23042) (a500dee)
• config: warn on named imports from JSON modules (#​23378) (472385e)
• css: minify style tag (#​23183) (8156684)
• searched params attached to workers are now preserved (#​22280) (517b97f)
• support subpath imports in dynamic import statements (#​23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#​22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#​22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#​22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#​23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #​17467) (#​23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#​23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#​23373) (a6d43bc)
• deps: update all non-major dependencies (#​23445) (fc7c104)
• html: don't inline preload link targets (fix #​13355) (#​23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#​23356) (8492422)
• shortcuts extend error (#​23447) (4ec58d1)
• config: close bundles when generation fails (#​23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#​23265) (4f9d2f4)
• deps: update all non-major dependencies (#​23337) (d550815)
• deps: update all non-major dependencies (#​23404) (238ad81)
• deps: update rolldown-related dependencies (#​23338) (76e8082)
• deps: update rolldown-related dependencies (#​23405) (b882566)
• dev: run closeBundle after buildEnd failure (#​23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#​23171) (6162968)
• utils: handle dot in srcset density descriptor (#​23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#​23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#​23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#​23357) (f794133)
• remove unnecessary comment (#​23448) (b919a1a)
• delete unused PluginContainerOptions (#​23382) (ee64401)
• use oxfmt sortImports (#​23319) (97ad042)

Code Refactoring

• delete unused esbuildPlugin (#​23381) (f40efef)
• exclude postfix from __VITE_ASSET__ (#​22886) (a6c08e1)
• remove HmrUrl concept (#​23172) (67a6807)
• use urlId of import.meta.ROLLDOWN_FILE_URL in wasm plugin (#​22962) (92bd2a7)

Tests

• add renderBuiltUrl change changes hash (#​23118) (0291408)

Beta Changelogs

8.3.0-beta.1 (2026-09-07)

See 8.3.0-beta.1 changelog

8.3.0-beta.0 (2026-09-02)

See 8.3.0-beta.0 changelog

colinhacks/zod (zod)

v4.6.2

Compare Source

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#​6587) — closes #​6585
• 0c483c58 docs: the Zod 4.6 announcement post (#​6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

Compare Source

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#​6582) — closes #​6577
• dd9c36fa fix(v4): defer recursive object index inference (#​6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#​6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#​6583)

---

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [nodemailer](https://nodemailer.com/) ([source](https://github.com/nodemailer/nodemailer)) | [`10.0.2` → `10.0.3`](https://renovatebot.com/diffs/npm/nodemailer/10.0.2/10.0.3) |  |  | | [pg-boss](https://pgboss.io) ([source](https://github.com/timgit/pg-boss)) | [`12.30.0` → `12.31.0`](https://renovatebot.com/diffs/npm/pg-boss/12.30.0/12.31.0) |  |  | | [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.2.2` → `8.3.0`](https://renovatebot.com/diffs/npm/vite/8.2.2/8.3.0) |  |  | | [zod](https://zod.dev) ([source](https://github.com/colinhacks/zod)) | [`4.6.0` → `4.6.2`](https://renovatebot.com/diffs/npm/zod/4.6.0/4.6.2) |  |  | --- ### Release Notes <details> <summary>nodemailer/nodemailer (nodemailer)</summary> ### [`v10.0.3`](https://github.com/nodemailer/nodemailer/blob/HEAD/CHANGELOG.md#1003-2026-09-10) [Compare Source](https://github.com/nodemailer/nodemailer/compare/v10.0.2...v10.0.3) ##### Bug Fixes - **fetch:** honor the cookie Domain attribute without accepting public suffixes ([1608391](https://github.com/nodemailer/nodemailer/commit/1608391ff4ccd5422a88e4cf760b26068aad6d39)), closes [#&#8203;1856](https://github.com/nodemailer/nodemailer/issues/1856) </details> <details> <summary>timgit/pg-boss (pg-boss)</summary> ### [`v12.31.0`](https://github.com/timgit/pg-boss/releases/tag/12.31.0) [Compare Source](https://github.com/timgit/pg-boss/compare/12.30.0...12.31.0) #### What's Changed Schema version: **41** (a migration runs on upgrade — see [Upgrading](#upgrading)). - Schedules gain RRULE expression format, can catch up after an outage, and can be read back without a query of your own. - Bun support #### Highlights ##### Schedules take RRULE expressions `schedule()` now accepts a recurrence rule ([RFC 5545](https://datatracker.ietf.org/doc/html/rfc5545#section-3.3.10)) anywhere a cron expression goes, for the schedules cron cannot express — the last Friday of the month, every second Monday, a schedule that stops on a date or after a number of runs. ```js // 5pm on the last Friday of the month, Chicago time await boss.schedule('report', 'FREQ=MONTHLY;BYDAY=-1FR;BYHOUR=17', null, { tz: 'America/Chicago' }) ``` The expression is either the rule on its own or the recurrence lines of a calendar entry — `DTSTART`, `RRULE`, and optional `RDATE` and `EXDATE`: ```js await boss.schedule('standup', [ 'DTSTART;TZID=Europe/Berlin:20260901T090000', 'RRULE:FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR', 'EXDATE;TZID=Europe/Berlin:20261224T090000' ].join('\n')) ``` An expression carrying `FREQ=`, or a line opening with an iCalendar property, is a rule; everything else is cron, which cannot be mistaken for one since no cron field contains `=`, `:` or `;`. `schedule()` decides once and stores the answer in the schedule table's new `kind` column, so an expression is never validated as one format and evaluated as the other. `getSchedules()` returns it. `schedule()` rejects the rules a parser would quietly read differently than they were meant, such as an unknown part or a value out of range, and the combinations RFC 5545 forbids outright. A finite rule with nothing left to send is also rejected rather than stored. ##### Schedules can catch up after an outage When the Timekeeper does a schedule check, the pass sends the occurrences of the preceding 60 seconds, which is compared against the history to see if a job was missed. The new `missed` option decides what a schedule does about that. | `missed` | What a schedule sends for a gap | | -------- | ------------------------------------------------------------------------ | | `skip` | Nothing. The default, and what every earlier release did | | `once` | One job, for the most recent missed occurrence, however many were missed | ```js // a nightly report reads the current state of the world, so three missed nights are one report await boss.schedule('report', '0 3 * * *', null, { missed: 'once' }) ``` Worth knowing before choosing `once`: a caught-up job is indistinguishable from an on-time one, it names the most recent missed occurrence rather than each one, and it can arrive beside the occurrence due now — two jobs, filed under two minutes, unless queue policy or a `singletonKey` collapses them. The option applies to both expression formats. ##### New scheduling funcitons: getSchedule() and previewSchedule() ```js const schedule = await boss.getSchedule('report', 'eu') ``` `getSchedule(name, key)` reads the one row a `(name, key)` pair can have, or `null`, instead of filtering the array `getSchedules()` returns. `key` defaults to the empty string, the key `schedule()` uses when none is given. ```js const next = boss.previewSchedule('FREQ=MONTHLY;BYDAY=-1FR;BYHOUR=17', { tz: 'America/Chicago', count: 3 }) ``` `previewSchedule(cron, options)` answers with the next occurrences as an array of `Date`. It is pure computation — no query, no started instance — and it tells the two formats apart the way `schedule()` does, so a stored schedule can be previewed straight from its `cron` column. `count` defaults to 5 and is capped at 1000; `from` defaults to database time and takes the last occurrence of one page to get the next; the expression and zone are validated exactly as `schedule()` validates them, so anything it previews can also be stored. The walk gives up after a second rather than hold the event loop, so a sparse expression asked for a large count answers with fewer. ##### Every schedule names the job it last produced The schedule row now carries `lastJobId`, so a schedule can be joined to its most recent run without keeping a record of your own. It is nullable and unconstrained on purpose: the job it names is subject to retention and will eventually be deleted, so a foreign key would either block retention or take the schedule with it. ##### pg-boss runs on Bun Bun is now a supported runtime, exercised in CI on every commit: a conformance suite drives install, send, fetch, complete, workers, scheduling and maintenance through `bun test` against a real PostgreSQL. Bun's own client is supported as a driver alongside `pg`, so a Bun application can share one client and one pool with pg-boss: ```ts import { SQL } from 'bun' import PgBoss, { fromBunSql } from 'pg-boss' const boss = new PgBoss({ db: fromBunSql(new SQL(process.env.DATABASE_URL)) }) ``` `sql.listen()` is used where the runtime has it (Bun 1.4.0 and later), so a Bun deployment gets the same LISTEN/NOTIFY delivery a `pg` one does, and falls back to polling on an older runtime. The client stays yours — pg-boss never calls `end()` on it. You do not need the adapter to run on Bun: the bundled `pg` driver works under the runtime, and a connection string is the simpler choice. Two fixes underneath it reach further than Bun: - **json parameters are cast through `::text`** for drivers that infer parameter types from the statement and would otherwise reject a json argument ([#&#8203;880](https://github.com/timgit/pg-boss/issues/880), [#&#8203;897](https://github.com/timgit/pg-boss/pull/897)). - **array parameters are expanded** for drivers that cannot encode a JavaScript array, which also repairs the completion paths under `fromDrizzle()` on `bun-sql`. ##### The CLI knows which engine it is talking to A connection string does not say which engine answers it, and the engines do not accept the same schema — so `pg-boss migrate` against CockroachDB emitted table partitioning, advisory locks and covering indexes, and failed partway through. The CLI now takes the same backend profile the library constructor does: ```bash pg-boss migrate --backend cockroachdb --connection-string postgres://root@localhost:26257/mydb PGBOSS_BACKEND=yugabytedb pg-boss migrate ``` `--backend`, `PGBOSS_BACKEND` or `"backend"` in the config file, resolved through the library's own resolver, so `create`, `migrate`, `rollback`, `plans`, `doctor` and `reindex` all emit what that backend accepts and the CLI cannot disagree with a running instance. `reindex` now says so up front on an engine that has no REINDEX, instead of surfacing a raw catalog error. `pglite` is in-process and rejected here. The exported plan functions take the same profile, for a caller that generates SQL from code rather than from the CLI: ```js const sql = getMigrationPlans('pgboss', 39, { backend: 'cockroachdb' }) const ddl = getConstructionPlans('pgboss', { backend: 'cockroachdb', createSchema: false }) ``` `getConstructionPlans()`, `getMigrationPlans()` and `getRollbackPlans()` each accept `backend` in their options, resolved by the same resolver the constructor and the CLI use, and default to stock PostgreSQL as before. The profile is read capability by capability rather than as one distributed switch, so a plan drops only what that engine actually refuses: CockroachDB loses table partitioning, advisory locks, covering indexes and deferrable constraints, while YugabyteDB loses the first two and keeps the rest. Migration and rollback plans are built from the same backend-filtered migration set a live migration runs, so a statement an engine cannot execute — the column written in the transaction that added it, which `noAddColumnBackfill` drops — is left out of the exported SQL for the same reason and at the same place. A name that is not a profile throws where it is named, rather than reaching the script. `getConstructionPlans()` takes an options object at all for the first time, which also makes `createSchema: false` reachable from the export for a schema that already exists or is created by something else. `getIndexBloatPlans()` is unchanged: it reads catalog statistics rather than emitting DDL. ##### Also in this release - A new `noAddColumnBackfill` compatibility flag for engines that refuse to write a column in the transaction that added it. CockroachDB sets it, which is what lets it migrate at all — see [Upgrading](#upgrading). - `previewScheduleMaxCount` is exported, so a service putting `previewSchedule()` behind an API can validate `count` against the same ceiling rather than a literal of its own. #### Upgrading Schema 41 adds `schedule.kind` (defaulted and `CHECK`-constrained) and `schedule.last_job_id uuid`, backfills `schedule.timezone` and gives it a default — catalog-only changes, no table rewrite. **Every cron schedule can send twice during a rolling upgrade.** The internal key that collapses a schedule's occurrence to one job changes format, and the two formats do not collide with each other, so while instances straddle releases one occurrence can produce two jobs. Passes claim every `cronMonitorIntervalSeconds` (30 by default) against a 60-second window, so at least two passes land inside every occurrence's window and a rollout only has to put one of them on each release. Handlers that are not idempotent are worth stopping the schedulers for across the switch. The change itself fixes a real loss: the old key concatenated the queue name and the schedule key with `__`, and `_` is legal in both, so `('report_', 'daily')` and `('report', '_daily')` produced the same key and one of the two schedules silently lost its job every minute the occurrences coincided. **Schedules with no time zone become UTC.** Rows written before zones were validated could hold `timezone IS NULL`, which read as the local zone of whatever instance evaluated them. The migration backfills those to UTC and the column now defaults to it. A deployment relying on the old reading should set the zone it wants before upgrading. **Rule schedules should wait for the deployment to finish.** An instance still on an older release reads a rule as cron, cannot parse it, and reports an `invalid_schedule` warning until it is replaced, so add rule schedules once every instance is on 12.31.0. **CockroachDB can migrate again.** It refuses to write a column in the transaction that added it, which schema 40 does — so a CockroachDB deployment on schema 39 could not reach 40 in 12.30.0, and would not have reached 41 either. Both migrations now leave that statement out on a backend that declares `noAddColumnBackfill`, and both give the runtime the same answer without it: the monitor claim falls back to `monitor_on` when it is NULL, which is the value the skipped statement would have written, so the upgrade stampede that seed prevents is closed on every backend rather than only on the ones whose migration could write the column. Schema 41's label is left to the first cron pass instead, so a schedule holding a rule reads as `cron` from `getSchedules()` until a pass reaches it and corrects it — nothing is lost, and a deployment running passes closes that window in one interval. **Scripted migrations against a non-PostgreSQL engine need `--backend`.** A `pg-boss migrate` in a deploy script keeps assuming stock PostgreSQL unless the profile is named, so add `--backend cockroachdb` (or `PGBOSS_BACKEND`) wherever the CLI runs against one of the distributed engines. Rolling back to 40 drops both columns and leaves `timezone`'s default in place, which is harmless: a 12.30.0 instance names the column on every write. #### New Contributors - [@&#8203;jperelli](https://github.com/jperelli) made their first contribution in [#&#8203;892](https://github.com/timgit/pg-boss/pull/892) - [@&#8203;toruiwasa](https://github.com/toruiwasa) made their first contribution in [#&#8203;897](https://github.com/timgit/pg-boss/pull/897) **Full Changelog**: <https://github.com/timgit/pg-boss/compare/12.30.0...12.31.0> </details> <details> <summary>vitejs/vite (vite)</summary> ### [`v8.3.0`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#830-2026-09-10) [Compare Source](https://github.com/vitejs/vite/compare/v8.2.2...v8.3.0) ##### Features - **build:** avoid settling seen preload dependencies for performance ([#&#8203;23446](https://github.com/vitejs/vite/issues/23446)) ([e6f6b3e](https://github.com/vitejs/vite/commit/e6f6b3e3119256daa837b2dc399058c8aa45b470)) - **devtools:** enable dev server integration ([#&#8203;23333](https://github.com/vitejs/vite/issues/23333)) ([68aeb8a](https://github.com/vitejs/vite/commit/68aeb8a3b5a5a2ccd505288999bae1a5e6942ee1)) - accept Rolldown watch options in `server.watch` ([#&#8203;23133](https://github.com/vitejs/vite/issues/23133)) ([1b5cfe3](https://github.com/vitejs/vite/commit/1b5cfe3d3777d4ceb7f35fcee9d3c4279316a084)) - add closeServer and closePreviewServer hooks ([#&#8203;23110](https://github.com/vitejs/vite/issues/23110)) ([e17d2d5](https://github.com/vitejs/vite/commit/e17d2d565b0288f169c7995adb2b192f917548e7)) - add top-level `tsconfig` option ([#&#8203;23310](https://github.com/vitejs/vite/issues/23310)) ([93164c3](https://github.com/vitejs/vite/commit/93164c3530a7b4fc7bbedfb986d6afa9546cdef3)) - add warning for unsupported hooks in plugin returned from `applyToEnvironment` hook ([#&#8203;23191](https://github.com/vitejs/vite/issues/23191)) ([fdef04f](https://github.com/vitejs/vite/commit/fdef04f112aadfea40ad3c448d96a49a04c168bd)) - **cli:** support naming the CPU profile via --profile \[name] ([#&#8203;23042](https://github.com/vitejs/vite/issues/23042)) ([a500dee](https://github.com/vitejs/vite/commit/a500deeb6f52d93ca501a0fc612a5392b939f2f5)) - **config:** warn on named imports from JSON modules ([#&#8203;23378](https://github.com/vitejs/vite/issues/23378)) ([472385e](https://github.com/vitejs/vite/commit/472385e6ec4b21e3167c7abf9769883d1c9675f8)) - **css:** minify style tag ([#&#8203;23183](https://github.com/vitejs/vite/issues/23183)) ([8156684](https://github.com/vitejs/vite/commit/8156684572bdcf73e9d8568ed67971f0467fab60)) - searched params attached to workers are now preserved ([#&#8203;22280](https://github.com/vitejs/vite/issues/22280)) ([517b97f](https://github.com/vitejs/vite/commit/517b97f57ab9473e7417da856eb641d76870a56e)) - support subpath imports in dynamic import statements ([#&#8203;23185](https://github.com/vitejs/vite/issues/23185)) ([b78e2f1](https://github.com/vitejs/vite/commit/b78e2f1bc1cba404c4bd9faf518d26ec85e89fc7)) - use `import.meta.ROLLDOWN_FILE_URL_*` for assets in JS ([#&#8203;22888](https://github.com/vitejs/vite/issues/22888)) ([4366ac4](https://github.com/vitejs/vite/commit/4366ac468343252df6d5706361a6348afa66f9cc)) - use `import.meta.ROLLDOWN_FILE_URL_*` for other plugins ([#&#8203;22894](https://github.com/vitejs/vite/issues/22894)) ([e38f29e](https://github.com/vitejs/vite/commit/e38f29ee48bea5ea3178faec5b78708e86f38afb)) - **worker:** remove worker chunk if it's detected that it's not referenced ([#&#8203;22473](https://github.com/vitejs/vite/issues/22473)) ([924997a](https://github.com/vitejs/vite/commit/924997a4bdda9115faee9bdb622fcec4fc8357f0)) ##### Bug Fixes - handle CRLF line endings in code frame positions ([#&#8203;23219](https://github.com/vitejs/vite/issues/23219)) ([9913672](https://github.com/vitejs/vite/commit/9913672bee9c34a2df7fff4c2538783cd4f43b4e)) - only treat whole `node_modules` path segments as dependencies (fix [#&#8203;17467](https://github.com/vitejs/vite/issues/17467)) ([#&#8203;23437](https://github.com/vitejs/vite/issues/23437)) ([ef0dc17](https://github.com/vitejs/vite/commit/ef0dc17ada53d1169ae5a89cb8f6482831466755)) - **build:** keep hash placeholders as-is in `resolveFileUrl` hook ([#&#8203;23422](https://github.com/vitejs/vite/issues/23422)) ([e8d6a4d](https://github.com/vitejs/vite/commit/e8d6a4d3399c739772080d70c7f3c4d548a637c9)) - **bundled-dev:** mark payload delivered on client report ([#&#8203;23373](https://github.com/vitejs/vite/issues/23373)) ([a6d43bc](https://github.com/vitejs/vite/commit/a6d43bc9e3464faa4d49f090e75e1ab334ffb7b0)) - **deps:** update all non-major dependencies ([#&#8203;23445](https://github.com/vitejs/vite/issues/23445)) ([fc7c104](https://github.com/vitejs/vite/commit/fc7c104e74d35a97fa313d5dd6f1b5e7d5b26159)) - **html:** don't inline preload link targets (fix [#&#8203;13355](https://github.com/vitejs/vite/issues/13355)) ([#&#8203;23387](https://github.com/vitejs/vite/issues/23387)) ([12e709c](https://github.com/vitejs/vite/commit/12e709ca4df1059747db1cb7c5d1cd71aba79a24)) - resolve the actual package root in findNearestMainPackageData for nested package.json ([#&#8203;23356](https://github.com/vitejs/vite/issues/23356)) ([8492422](https://github.com/vitejs/vite/commit/8492422b8f110625a90c702f42f30784e8cf19dc)) - shortcuts extend error ([#&#8203;23447](https://github.com/vitejs/vite/issues/23447)) ([4ec58d1](https://github.com/vitejs/vite/commit/4ec58d159df4a1b4799356a1fda62db88ed14752)) - **config:** close bundles when generation fails ([#&#8203;23256](https://github.com/vitejs/vite/issues/23256)) ([6bacc95](https://github.com/vitejs/vite/commit/6bacc956df5a76cc5653b9de4493453b953439fd)) - **css:** keep newline-separated srcset candidates intact ([#&#8203;23265](https://github.com/vitejs/vite/issues/23265)) ([4f9d2f4](https://github.com/vitejs/vite/commit/4f9d2f4dadc83191200de7d2154c957a711e8c3d)) - **deps:** update all non-major dependencies ([#&#8203;23337](https://github.com/vitejs/vite/issues/23337)) ([d550815](https://github.com/vitejs/vite/commit/d55081581ddd4d55667fef38e85d02ab7f879f15)) - **deps:** update all non-major dependencies ([#&#8203;23404](https://github.com/vitejs/vite/issues/23404)) ([238ad81](https://github.com/vitejs/vite/commit/238ad811c7fb9e4730cbd317d0657867ed3447b3)) - **deps:** update rolldown-related dependencies ([#&#8203;23338](https://github.com/vitejs/vite/issues/23338)) ([76e8082](https://github.com/vitejs/vite/commit/76e8082c56a2872dc8017c5672bc36cba8dcf75d)) - **deps:** update rolldown-related dependencies ([#&#8203;23405](https://github.com/vitejs/vite/issues/23405)) ([b882566](https://github.com/vitejs/vite/commit/b88256607e3a051b7bcb0b338b3c4665926b55a8)) - **dev:** run closeBundle after buildEnd failure ([#&#8203;23165](https://github.com/vitejs/vite/issues/23165)) ([8cb872e](https://github.com/vitejs/vite/commit/8cb872e7fb65b03f6068923c6aa7fcf3e71baf21)) - **hmr:** handle `import.meta.hot.invalidate` in virtual module ([#&#8203;23171](https://github.com/vitejs/vite/issues/23171)) ([6162968](https://github.com/vitejs/vite/commit/616296895bd135386d35069a479a5f188c7de298)) - **utils:** handle dot in srcset density descriptor ([#&#8203;23346](https://github.com/vitejs/vite/issues/23346)) ([b50e1b4](https://github.com/vitejs/vite/commit/b50e1b4a3d66128a4076e19769b2e29657985516)) - **utils:** match timestamp query parameter with proper delimiters ([#&#8203;23364](https://github.com/vitejs/vite/issues/23364)) ([41f3c6f](https://github.com/vitejs/vite/commit/41f3c6fff88ade015669cac5c42db946e0b6f5c9)) ##### Performance Improvements - **proxy:** pre-compile context matchers at server creation ([#&#8203;23263](https://github.com/vitejs/vite/issues/23263)) ([8abf700](https://github.com/vitejs/vite/commit/8abf700eeb2411d8402d08f8e2696effafdbe774)) ##### Miscellaneous Chores - introducing `@e18e/eslint-plugin` ([#&#8203;23357](https://github.com/vitejs/vite/issues/23357)) ([f794133](https://github.com/vitejs/vite/commit/f79413353995a2344879014410a9128b1b9f8e9a)) - remove unnecessary comment ([#&#8203;23448](https://github.com/vitejs/vite/issues/23448)) ([b919a1a](https://github.com/vitejs/vite/commit/b919a1a8b5a7c694667f993d677973f42d349458)) - delete unused `PluginContainerOptions` ([#&#8203;23382](https://github.com/vitejs/vite/issues/23382)) ([ee64401](https://github.com/vitejs/vite/commit/ee644014aab61e546742b862a7d7b0d6c7d67a7b)) - use oxfmt `sortImports` ([#&#8203;23319](https://github.com/vitejs/vite/issues/23319)) ([97ad042](https://github.com/vitejs/vite/commit/97ad042170f4c71b518239723b733dd98e8e3e76)) ##### Code Refactoring - delete unused `esbuildPlugin` ([#&#8203;23381](https://github.com/vitejs/vite/issues/23381)) ([f40efef](https://github.com/vitejs/vite/commit/f40efefbb3630cdb7235286bc2b51673d9fbfc27)) - exclude postfix from `__VITE_ASSET__` ([#&#8203;22886](https://github.com/vitejs/vite/issues/22886)) ([a6c08e1](https://github.com/vitejs/vite/commit/a6c08e10a624bd89b78683ff1b0e8cfa1d89aa45)) - remove HmrUrl concept ([#&#8203;23172](https://github.com/vitejs/vite/issues/23172)) ([67a6807](https://github.com/vitejs/vite/commit/67a680767317f8e2cb28b6b0500192f993a567cf)) - use `urlId` of `import.meta.ROLLDOWN_FILE_URL` in wasm plugin ([#&#8203;22962](https://github.com/vitejs/vite/issues/22962)) ([92bd2a7](https://github.com/vitejs/vite/commit/92bd2a7f325ed102349cdc6c1ad4b5cd25e1d72f)) ##### Tests - add `renderBuiltUrl` change changes hash ([#&#8203;23118](https://github.com/vitejs/vite/issues/23118)) ([0291408](https://github.com/vitejs/vite/commit/0291408b8443129ce6f6d1d440be8facabe9683b)) ##### Beta Changelogs ##### [8.3.0-beta.1](https://github.com/vitejs/vite/compare/v8.3.0-beta.0...v8.3.0-beta.1) (2026-09-07) See [8.3.0-beta.1 changelog](https://github.com/vitejs/vite/blob/v8.3.0-beta.1/packages/vite/CHANGELOG.md) ##### [8.3.0-beta.0](https://github.com/vitejs/vite/compare/v8.2.2...v8.3.0-beta.0) (2026-09-02) See [8.3.0-beta.0 changelog](https://github.com/vitejs/vite/blob/v8.3.0-beta.0/packages/vite/CHANGELOG.md) </details> <details> <summary>colinhacks/zod (zod)</summary> ### [`v4.6.2`](https://github.com/colinhacks/zod/releases/tag/v4.6.2) [Compare Source](https://github.com/colinhacks/zod/compare/v4.6.1...v4.6.2) A patch on top of [4.6.1](https://github.com/colinhacks/zod/releases/tag/v4.6.1). - [`9446b5cc`](https://github.com/colinhacks/zod/commit/9446b5cc) fix: preserve undefined prefault outputs and object keys ([#&#8203;6587](https://github.com/colinhacks/zod/pull/6587)) — closes [#&#8203;6585](https://github.com/colinhacks/zod/issues/6585) - [`0c483c58`](https://github.com/colinhacks/zod/commit/0c483c58) docs: the [Zod 4.6 announcement post](https://zod.dev/blog/zod-4-6) ([#&#8203;6546](https://github.com/colinhacks/zod/pull/6546)) - [`a00c3f34`](https://github.com/colinhacks/zod/commit/a00c3f34) docs: use Trigger.dev's brand-kit lockups for the platinum card ### [`v4.6.1`](https://github.com/colinhacks/zod/releases/tag/v4.6.1) [Compare Source](https://github.com/colinhacks/zod/compare/v4.6.0...v4.6.1) A patch on top of [4.6.0](https://github.com/colinhacks/zod/releases/tag/v4.6.0). - [`b12aa523`](https://github.com/colinhacks/zod/commit/b12aa523) fix: preserve unique tags with defaulted discriminators ([#&#8203;6582](https://github.com/colinhacks/zod/pull/6582)) — closes [#&#8203;6577](https://github.com/colinhacks/zod/issues/6577) - [`dd9c36fa`](https://github.com/colinhacks/zod/commit/dd9c36fa) fix(v4): defer recursive object index inference ([#&#8203;6580](https://github.com/colinhacks/zod/pull/6580)) - [`3b154992`](https://github.com/colinhacks/zod/commit/3b154992) feat(lang): add Tajik (`tg`) locale ([#&#8203;6581](https://github.com/colinhacks/zod/pull/6581)) by [@&#8203;ismoil77](https://github.com/ismoil77) - [`2efa8b80`](https://github.com/colinhacks/zod/commit/2efa8b80) ci: give the npm wait a real budget and drop the back-publish path ([#&#8203;6583](https://github.com/colinhacks/zod/pull/6583)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Copenhagen) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI4NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

renovate added the

dependencies

label 2026-09-11 09:04:49 +00:00

renovate added 1 commit 2026-09-11 09:04:50 +00:00

chore(deps): Update production (non-major) 558ed21431

renovate scheduled this pull request to auto merge when all checks succeed 2026-09-11 09:04:52 +00:00

renovate merged commit 5f917547d9 into main 2026-09-11 09:25:49 +00:00

renovate referenced this pull request from a commit 2026-09-11 09:25:51 +00:00

chore(deps): Update production (non-major) (#141)

renovate deleted branch renovate/production-(non-major) 2026-09-11 09:25:55 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

dependencies

Dependency updates raised by Renovate (renovate.json5 labels)

  

major

Major version bump — always needs human review, never auto-merged

  

security-pin

Touches a pnpm.overrides CVE remediation pin, not an ordinary dependency

No labels

dependencies

major

security-pin

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

trails-cool/trails!141

No description provided.