chore(deps): sweep every pending dependency bump, and group the ones that cannot move alone

[msalvatti]

Applies fifteen bumps that Dependabot had opened as ten separate PRs, and closes the class that made two of them red.

Why they could not be merged one at a time

BullMQ and ioredis are one type graph. BullMQ's ConnectionOptions accepts an ioredis Redis, and that assignment only typechecks while a single copy of ioredis resolves in the tree. Bump either alone and the copies diverge:

error TS2322: Type 'Redis' is not assignable to type 'ConnectionOptions'

at all four sites that hand a client to a Queue, Worker, QueueEvents or FlowProducer. That is exactly how #33 (ioredis alone) and #39 (bullmq alone) failed — identical errors, identical lines. Applied together, the same two versions are green; I reproduced both directions locally before writing this.

Same shape as the CodeQL sub-actions in #38, so it gets the same treatment: a bullmq-stack group covering bullmq, bullmq-otel and ioredis across all update types, placed before the dev-dependencies catch-all so it wins the match.

ioredis keeps its exact pin rather than gaining a caret — the pin is what guarantees the single-copy resolution the type graph depends on, so it is not incidental and I did not "modernise" it.

What is in here

Peer stack	bullmq 5.79.1 → 5.81.2 · ioredis 5.10.1 → 5.11.1
NestJS	@nestjs/common · @nestjs/core · @nestjs/testing 11.1.27 → 11.1.28
Commit governance	@commitlint/cli 19.8.1 → 21.2.1 · @commitlint/config-conventional 19.8.1 → 21.2.0 (lockstep pair)
Lint/format	eslint + @eslint/js 9.39.4 → 9.39.5 · eslint-config-prettier 9.1.2 → 10.1.8 · typescript-eslint 8.62.0 → 8.65.0 · prettier 3.8.4 → 3.9.6
Test tooling	testcontainers 12.0.3 → 12.0.4 · ts-jest 29.4.11 → 29.4.12 · @types/node 24.13.2 → 24.13.3

Supersedes and closes #17, #19, #22, #23, #32, #33, #34, #37, #39.

Verification

Full gate, locally: typecheck · test:types · lint · 260 tests at 100% statements/branches/functions/lines · build · size (12 032 / 18 432 B brotli server, 406 / 2 500 shared) · check:exports (four quadrants green on both subpaths, node10 included) · dogfood smoke · 8 E2E tests against a real Redis.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​commitlint/​cli@​21.2.1
	typescript-eslint@​8.65.0
	@​types/​node@​24.13.3
	testcontainers@​12.0.4
	eslint-config-prettier@​10.1.8
	ioredis@​5.11.1
	@​eslint/​js@​9.39.5
	ts-jest@​29.4.12
	bullmq@​5.81.2
	@​nestjs/​common@​11.1.28
	@​nestjs/​core@​11.1.28
	@​commitlint/​config-conventional@​21.2.0
	@​nestjs/​testing@​11.1.28
	eslint@​9.39.5
	prettier@​3.9.6

View full report

[Copilot]

Pull request overview

This PR consolidates multiple pending dependency updates into a single change set, and adjusts Dependabot grouping so tightly-coupled packages (BullMQ + ioredis, plus bullmq-otel) update together.

Changes:

• Bumps the BullMQ/ioredis stack plus various dev tooling (ESLint/Prettier/typescript-eslint, commitlint, test tooling) in package.json and pnpm-lock.yaml.
• Adds a new Dependabot group (bullmq-stack) to ensure BullMQ-related packages and ioredis move in lockstep.
• Updates the lockfile to reflect the new resolved versions and transitive dependency graph.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
package.json	Updates dependency versions for the peer stack and dev tooling (notably BullMQ/ioredis + lint/test tooling).
pnpm-lock.yaml	Regenerates the lockfile to match the updated dependency set and new transitive graph.
.github/dependabot.yml	Introduces a dedicated Dependabot group for BullMQ/ioredis to keep coupled updates together.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

package.json:79

• The repository’s supply-chain contract expects an explicit empty runtime dependencies object. Removing the "dependencies": {} field makes it easier to accidentally introduce runtime deps later and contradicts the documented "zero direct deps" requirement referenced in repo docs (e.g. AGENTS.md). Please restore an explicit empty dependencies object.

  },
  "peerDependencies": {