chore(deps): bump pg-boss from 10.4.2 to 12.28.0

[dependabot]

Bumps pg-boss from 10.4.2 to 12.28.0.

Release notes

Sourced from pg-boss's releases.

12.28.0

Schema version: 38 (a migration runs on upgrade — see Upgrading).

Fixes key_strict_fifo queues, which could stop delivering work entirely, plus date, schedule, redrive and queue-config bugs.

Highlights

key_strict_fifo no longer blocks unrelated keys

One key with an active, retry or failed job could take down the whole queue: the head of the fetch batch belonged to the blocked key, the job_i8 unique index rejected the claim, and the batch came back empty (#849, #871). Fetch now picks one eligible FIFO head per singletonKey before applying priority and the batch limit.

Thanks to @​ziemekobel for the report, diagnosis and tests, and @​ken8203 for the query and index reshape that shipped.

startAfter accepts ISO 8601 date times without a Z

A string startAfter was treated as a date time only when its last character was Z. Every other ISO 8601 spelling fell through to the interval cast and failed with invalid input syntax for type interval — including +00:00, which denotes the same UTC instant the option is documented to take, along with numeric offsets (+05:30), zone-less date times and date-only strings.

A string beginning with an ISO 8601 calendar date (YYYY-MM-DD) is now read as a date time too, in both places that resolve the option: send()/sendAfter()/insert()/flows, and update()/upsert().

// the only spelling accepted before
await boss.send('email-reminder', data, { startAfter: '2027-01-01T08:00:00Z' })
// previously rejected, now accepted
await boss.send('email-reminder', data, { startAfter: '2027-01-01T13:30:00+05:30' })
await boss.send('email-reminder', data, { startAfter: '2027-01-01T08:00:00' })
await boss.send('email-reminder', data, { startAfter: '2027-01-01' }) // 2027-01-01 00:00 UTC

A date time carrying a zone designator resolves to that exact instant. One carrying none is pinned to UTC, so it does not depend on the database's time zone; a string naming a zone ('2027-01-01 08:00:00 America/New_York') is still resolved by the database, DST rules included. A string that begins with a calendar date but is not a valid date time ('2027-13-45') is now an error rather than a very long delay (#862, thanks @​Jaybhade).

One bad schedule no longer stops all scheduling

cron-parser validates tz lazily, so schedule() stored typos like 'America/New_Yrok'. The cron pass filtered every schedule through a single call, so that one row threw and scheduling stopped deployment-wide on every pass. schedule() now rejects an unusable time zone up front, and the cron pass evaluates each schedule independently — skipping a row it can't evaluate and emitting an invalid_schedule warning naming the queue, key, cron and timezone (once per broken schedule, not once per pass) (#864, thanks @​Jaybhade).

Redrive fixes

redrive() re-created a job with dead_letter = NULL, so a job that failed terminally a second time sat in failed forever instead of returning to the DLQ (#874, thanks @​Nazaire).

Re-created jobs now also pick up the destination queue's expiration and heartbeat config, and carry through priority, singletonKey and group, so a redriven job keeps its ordering weight and group concurrency limits. Flow jobs remain unrecoverable by redrive() and this is now documented.

updateQueue() can clear nullable options

Passing deadLetter: null wrote the literal string 'null' and tripped the foreign key. deadLetter, retryDelayMax and heartbeatSeconds are now cleared by passing null, and the UpdateQueueOptions type reflects it. Options omitted from the call are still left unchanged.

Also in this release

• detectSchemaDrift() compares INCLUDE payloads, so an index rebuilt without its covering columns is reported as drift (include joins keys and predicate in the mismatch's differs). Comparison is order-insensitive; backends without covering indexes are not flagged.
• expireInSeconds accepts exactly 24 hours (86,400) instead of rejecting it (#863).
• Docs site gained a sitemap and robots.txt (#865, thanks @​blue2cat) and a sponsors page.

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pg-boss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #240.