🚀 Release: beta → master

package.json

@@ -28,10 +28,10 @@
     "@fastify/swagger": "^9.7.0",
     "@fastify/swagger-ui": "^5.2.5",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/auto-instrumentations-node": "^0.71.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.213.0",
+    "@opentelemetry/auto-instrumentations-node": "^0.75.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.217.0",
     "@opentelemetry/resources": "^2.0.0",
-    "@opentelemetry/sdk-node": "^0.213.0",
+    "@opentelemetry/sdk-node": "^0.217.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@scalar/fastify-api-reference": "^1.48.2",
     "@supabase/supabase-js": "^2.99.0",
@@ -44,7 +44,7 @@
     "jsonwebtoken": "^9.0.3",
     "jwks-rsa": "^4.0.1",
     "prom-client": "^15.1.3",
-    "uuid": "^13.0.0",
+    "uuid": "^13.0.2",
     "zod": "^4.3.6"
   },
   "devDependencies": {
@@ -65,6 +65,7 @@
     "@rollup/rollup-linux-x64-gnu": "^4.0.0"
   },
   "overrides": {
-    "protobufjs": "7.5.5"
+    "protobufjs": "7.5.9",
+    "fast-uri": "3.1.2"
   }
 }

renovate.json

@@ -0,0 +1,84 @@
+{
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard",
+    ":semanticCommits",
+    ":separateMajorReleases"
+  ],
+  "schedule": [
+    "before 6am on monday"
+  ],
+  "timezone": "UTC",
+  "labels": ["dependencies"],
+  "assignees": [],
+  "reviewers": [],
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 0,
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security"],
+    "assignees": [],
+    "reviewers": []
+  },
+  "packageRules": [
+    {
+      "description": "Group OpenTelemetry packages together",
+      "matchPackagePatterns": ["^@opentelemetry/"],
+      "groupName": "OpenTelemetry",
+      "schedule": ["before 6am on monday"]
+    },
+    {
+      "description": "Group Fastify ecosystem packages",
+      "matchPackagePatterns": ["^@fastify/", "^fastify"],
+      "groupName": "Fastify ecosystem",
+      "schedule": ["before 6am on monday"]
+    },
+    {
+      "description": "Auto-merge security patches for production dependencies",
+      "matchUpdateTypes": ["patch"],
+      "matchDepTypes": ["dependencies"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "squash"
+    },
+    {
+      "description": "Security updates get high priority",
+      "matchDatasources": ["npm"],
+      "matchUpdateTypes": ["patch"],
+      "vulnerabilitySeverity": "high",
+      "labels": ["security", "high-priority"],
+      "prPriority": 10
+    },
+    {
+      "description": "Critical security updates get immediate attention",
+      "matchDatasources": ["npm"],
+      "vulnerabilitySeverity": "critical",
+      "labels": ["security", "critical"],
+      "prPriority": 20,
+      "schedule": ["at any time"]
+    },
+    {
+      "description": "Separate major updates for careful review",
+      "matchUpdateTypes": ["major"],
+      "labels": ["major-update"],
+      "automerge": false,
+      "schedule": ["before 6am on the first day of the month"]
+    },
+    {
+      "description": "Dev dependencies can be more aggressive",
+      "matchDepTypes": ["devDependencies"],
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "squash",
+      "matchUpdateTypes": ["patch", "minor"]
+    }
+  ],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 6am on the first day of the month"]
+  },
+  "stabilityDays": 3,
+  "prCreation": "not-pending",
+  "rangeStrategy": "bump"
+}

src/routes/debug.ts

@@ -1,4 +1,5 @@
 import type { FastifyInstance } from "fastify";
+import type { Redis } from "ioredis";
 import { distanceQueue } from "../workers/distance.queue.js";
 import { authenticate } from "../middleware/auth.js";
 import { env } from "../config/env.js";
@@ -54,7 +55,7 @@ export async function debugRoutes(app: FastifyInstance): Promise<void> {
         // Reuse the ioredis connection that BullMQ already owns.
         // waitUntilReady() resolves to the same RedisClient instance used by
         // the queue — no new TCP connection is opened.
-        const redisClient = await distanceQueue.waitUntilReady();
+        const redisClient = (await distanceQueue.waitUntilReady()) as unknown as Redis;
         const pong = await redisClient.ping();
 
         request.log.info({ redis: pong }, "debug/redis ping succeeded");

src/routes/health.ts

@@ -103,7 +103,7 @@ export async function healthRoutes(app: FastifyInstance): Promise<void> {
 
         const [redisResult, supabaseResult, bullmqResult] = await Promise.allSettled([
             (async () => {
-                const redisClient = await distanceQueue.waitUntilReady();
+                const redisClient = (await distanceQueue.waitUntilReady()) as unknown as import("ioredis").Redis;
                 await redisClient.ping();
             })(),
             (async () => {

src/routes/internal.ts

@@ -249,7 +249,7 @@ export async function internalRoutes(app: FastifyInstance): Promise<void> {
         const [redisResult, dbResult] = await Promise.allSettled([
           (async (): Promise<CheckResult> => {
             const t0 = Date.now();
-            const client = await distanceQueue.waitUntilReady();
+            const client = (await distanceQueue.waitUntilReady()) as unknown as import("ioredis").Redis;
             await client.ping();
             return { status: "ok", latencyMs: Date.now() - t0 };
           })(),

src/tracing.ts

@@ -37,10 +37,11 @@ const sdk = new NodeSDK({
     }),
     instrumentations: [
         getNodeAutoInstrumentations({
-            // Disable noisy fs instrumentation; keep HTTP + Fastify auto-tracing
+            // Disable noisy fs instrumentation; keep HTTP + auto-tracing
+            // Note: @opentelemetry/instrumentation-fastify was removed in v0.75.0
+            // HTTP instrumentation covers Fastify requests via the underlying http module
             "@opentelemetry/instrumentation-fs": { enabled: false },
             "@opentelemetry/instrumentation-http": { enabled: true },
-            "@opentelemetry/instrumentation-fastify": { enabled: true },
             "@opentelemetry/instrumentation-dns": { enabled: true },
             "@opentelemetry/instrumentation-undici": { enabled: true },
             "@opentelemetry/instrumentation-ioredis": { enabled: true },