chore(deps): wave 3 — redis client stack (sessions + rate limiting) #41

Merged

rbrooks merged 2 commits from deps/wave-3-redis-stack into main

2026-06-25 21:40:10 +00:00

rbrooks commented

2026-06-25 21:25:27 +00:00

Owner

Wave 3, cluster 1 of the Renovate dependency dashboard (#30) — the interdependent redis-client majors, upgraded together.

Changes

Package	From	To	Role
`redis` (node-redis)	^4.7.0	^6.0.1	session store client
`connect-redis`	^7.1.1	^9.0.0	express-session store
`express-rate-limit`	^7.3.1	^8.5.2	rate limiting
`rate-limit-redis`	^4.2.0	^5.0.0	redis-backed rate-limit store

ioredis (^5.x) is unchanged — it backs BullMQ and the rate-limit store's sendCommand, and isn't part of this major bump.

Code changes (2, both required by the majors)

connect-redis v9 dropped its default export for a named one (TS2613) → app.ts: import { RedisStore } from 'connect-redis'.
express-rate-limit v8 canonicalised the max option to limit → renamed all 7 limiters in middleware/rateLimit.ts. Behaviour identical.

node-redis v6's createClient({ url }).connect() and the rate-limit sendCommand wiring needed no changes.

Verification (dev server, Node 24 / npm 11)

API: tsc build clean ✅ · 148/148 vitest tests pass ✅
Sessions exercised end-to-end via /__test_login (connect-redis v9 → node-redis v6); rate-limit middleware runs on every route (express-rate-limit v8 → rate-limit-redis v5). npm audit: 0 vulns.

Remaining Wave 3 clusters: react-router v8, tiptap v3 (+ tiptap-markdown 0.9) — separate PRs to follow.

🤖 Generated with Claude Code

Wave 3, cluster 1 of the Renovate dependency dashboard (#30) — the interdependent redis-client majors, upgraded together. ## Changes | Package | From | To | Role | |---|---|---|---| | `redis` (node-redis) | ^4.7.0 | ^6.0.1 | session store client | | `connect-redis` | ^7.1.1 | ^9.0.0 | express-session store | | `express-rate-limit` | ^7.3.1 | ^8.5.2 | rate limiting | | `rate-limit-redis` | ^4.2.0 | ^5.0.0 | redis-backed rate-limit store | `ioredis` (^5.x) is **unchanged** — it backs BullMQ and the rate-limit store's `sendCommand`, and isn't part of this major bump. ## Code changes (2, both required by the majors) - **connect-redis v9** dropped its default export for a named one (TS2613) → [app.ts](api/src/app.ts): `import { RedisStore } from 'connect-redis'`. - **express-rate-limit v8** canonicalised the `max` option to `limit` → renamed all 7 limiters in [middleware/rateLimit.ts](api/src/middleware/rateLimit.ts). Behaviour identical. node-redis v6's `createClient({ url }).connect()` and the rate-limit `sendCommand` wiring needed no changes. ## Verification (dev server, Node 24 / npm 11) - **API:** `tsc` build clean ✅ · **148/148** vitest tests pass ✅ - Sessions exercised end-to-end via `/__test_login` (connect-redis v9 → node-redis v6); rate-limit middleware runs on every route (express-rate-limit v8 → rate-limit-redis v5). `npm audit`: 0 vulns. Remaining Wave 3 clusters: **react-router v8**, **tiptap v3** (+ tiptap-markdown 0.9) — separate PRs to follow. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

rbrooks added 2 commits

2026-06-25 21:25:28 +00:00

chore(deps): wave 3 redis stack updates

CI / API — typecheck & tests (push) Failing after 19s

Details

CI / App — typecheck, test & build (push) Successful in 1m20s

Details

1a88ce6baf

- redis (node-redis) v4 → v6, connect-redis v7 → v9 (session store)
- express-rate-limit v7 → v8, rate-limit-redis v4 → v5
- rename express-rate-limit `max` → `limit` (v8 canonical option)

ioredis (BullMQ + rate-limit-redis backend) stays at v5.
Lockfile refreshed on the dev server in a follow-up commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(deps): connect-redis v9 named import + refresh redis-stack lockfile

CI / App — typecheck, test & build (push) Successful in 2m3s

Details

CI / App — typecheck, test & build (pull_request) Successful in 1m59s

Details

CI / API — typecheck & tests (push) Successful in 2m55s

Details

CI / API — typecheck & tests (pull_request) Successful in 2m50s

Details

a940242dff

connect-redis v9 switched from a default export to a named `RedisStore`
export; update the import in app.ts accordingly.

Verified green on the dev server: API tsc build + 148 tests pass
(sessions via connect-redis v9 / node-redis v6, rate limiting via
express-rate-limit v8 / rate-limit-redis v5).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

rbrooks referenced this pull request

2026-06-25 21:28:03 +00:00

chore(deps): wave 3 — react-router v8 #42

rbrooks referenced this pull request

2026-06-25 21:36:51 +00:00

chore(deps): wave 3 — tiptap v3 (+ tiptap-markdown 0.9) #43

rbrooks merged commit caf4941e59 into main

2026-06-25 21:40:10 +00:00

rbrooks deleted branch deps/wave-3-redis-stack

2026-06-25 21:40:11 +00:00

rbrooks referenced this pull request from a commit

2026-06-25 21:40:12 +00:00