chore(deps): update all dependencies, including majors

[kibertoad]

Bumps every dependency across the workspace, the sns-sqs example and the kafka load-tests project to its latest version.

Major upgrades

Package	From	To	Scope
typescript	5.9	7.0	all packages
@lokalise/tsconfig	3 (1 in example)	5	all packages
@types/node	25	26	all packages
pnpm (packageManager)	11.1.2	11.18.0	root
@platformatic/kafka	1.31	2.8	kafka/load-tests
@platformatic/dynamic-buffer	0.3	0.4	kafka/load-tests
pino	9	10	example
zod	3	4	example
@message-queue-toolkit/core / schemas / sns / sqs	21 / 6 / 22 / 21	26 / 7 / 26 / 26	example

Minor/patch bumps across the board: @aws-sdk/client-* → 3.1101.0, @lokalise/node-core → 14.8.1, @biomejs/biome → 2.5.6, @lokalise/biome-config → 3.1.1, zod → 4.4.3, rimraf → 6.1.3, turbo → 2.10.8, redis-semaphore → 5.7.0, uuidv7 → 1.2.1, @supercharge/promise-pool → 3.3.0, pg → 8.22.0, @types/pg → 8.20.3.

Adjustments the upgrades required

@lokalise/tsconfig v5. Two breaking changes in its shared configs:

• build-app.json now sets "rootDir": "${configDir}/src". Sources live in lib/ here, so every tsconfig.build.json pins "rootDir": "lib". Without this the build fails with TS6059: File '.../lib/index.ts' is not under 'rootDir'.
• base.json no longer includes node in the default types, so every package tsconfig.json now asks for it explicitly (["node", "vitest/globals"]).

Lockfile dedupe. Bumping the AWS SDK dev dependencies left two @aws-sdk/client-s3 (3.1048.0 / 3.1101.0) and two @smithy/types (4.14.2 / 4.16.1) copies installed, which made the SNS/SQS payload-store test types mutually unassignable. pnpm dedupe collapses them to one version each.

Formatting. biome 2.5.6 reformats the it.each(...) blocks in three spec files. No behavior change.

Example (examples/sns-sqs). With the toolkit packages on zod 4, the example no longer compiles against the zod/v3 compatibility entrypoint — switched to zod v4 imports. Also stopped annotating the shared AWS client config as SNSClientConfig, since the SNS/SQS/STS config types are no longer mutually assignable and it is passed to all three clients.

Review follow-ups. packages/amqp declared engines.node: ">=18" while the sibling adapters declare >=22.0.0 and CI only exercises 22/24 — aligned to >=22.0.0. The SQS 2-consumer heartbeat test waited on consumer2Counter > 0 unconditionally, then asserted the counter is 0 when heartbeat is enabled; guarded it the way the SNS counterpart already is.

Held back

ioredis stays at ^5. redis-semaphore — a runtime dependency of @message-queue-toolkit/redis-message-deduplication-store — declares "ioredis": "^4.1.0 || ^5" and has no v6-compatible release yet, so moving the dev dependencies in sns/sqs/gcp-pubsub to v6 would install a version its own peer range rejects. Worth revisiting once redis-semaphore ships ioredis 6 support.

CI status

32 of 33 jobs are green, including every AWS suite against both fauxqs and LocalStack, and amqp / gcp-pubsub / redis-message-deduplication-store against their real containers.

general (24.x, @message-queue-toolkit/kafka) is red, and it is not caused by this PR. PermissionConsumer.reconnect.spec.ts fails on Node 24 while passing on Node 22, and it fails at a different assertion each run (report called 0 times, then close called 5 times instead of 6) — a race, not a deterministic break.

The dependency evidence:

• @platformatic/kafka is already 2.8.0 on main (chore(deps): bump @platformatic/kafka from 2.6.1 to 2.8.0 #528, merged 2026-07-29). The only change to kafka's runtime tree in this PR is a pnpm peer key suffix from the dedupe — 2.8.0 → 2.8.0(supports-color@7.2.0) — i.e. the same package, no version movement. Nothing else in that package's runtime dependencies changed.
• chore(deps): bump @platformatic/kafka from 2.6.1 to 2.8.0 #528 ran this exact library version on the same 22.x/24.x matrix and passed. Since then main has only gained actions/setup-node 6.4.0 → 7.0.0, and node-version: 24.x resolves the newest patch at run time — so the runtime, not the dependency set, is what moved.

The underlying defect is upstream. Consumer.#handleError assumes every error is one of its own error classes:

#handleError(error) {
    const kafkaError = error;
    if (kafkaError) {
        if (kafkaError.findBy('hasStaleMetadata', true)) {   // plain Error has no findBy

The test destroys the consumer stream mid-flight, the connection pool surfaces a plain Error, and this throws TypeError: kafkaError.findBy is not a function as an uncaught exception out of the library's retry callback chain. A spurious early error can also satisfy the test's waitAndRetry(() => errorReporterSpy.mock.calls.length > 0) before the reconnect loop has finished its 31s of backoff, which is what produces the varying assertion failures.

Deliberately not patched here: hardening the test's synchronization would not turn the job green on its own (vitest fails a run with unhandled errors regardless of assertions), and suppressing the uncaught error would mask a genuine library bug inside an unrelated dependency PR. Tracking it upstream instead.

Verification

pnpm install --frozen-lockfile, pnpm run build and pnpm run lint (biome + tsc over lib and tests) pass for all 12 packages locally. The sns-sqs example and kafka/load-tests both typecheck against their new dependencies.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change refreshes workspace dependencies and TypeScript settings across packages. It updates SNS-SQS example imports and shared configuration typing. It also reformats selected parameterized tests without changing their behavior.

Changes

Workspace toolchain alignment

Layer / File(s)	Summary
Dependency version refresh package.json, examples/sns-sqs/package.json, packages/*/package.json	Updates workspace, runtime, and development dependency versions.
TypeScript build configuration examples/sns-sqs/tsconfig.json, packages/*/tsconfig*.json	Adds Node.js types and sets package build rootDir values to lib.
SNS-SQS example compatibility examples/sns-sqs/lib/**/*	Updates TypeScript and Zod import paths, shared AWS configuration typing, and import ordering.
Parameterized test formatting packages/kafka/test/publisher/PermissionPublisher.spec.ts, packages/sns/test/consumers/SnsSqsPermissionConsumer.spec.ts, packages/sqs/test/consumers/SqsPermissionConsumer.spec.ts	Reformats parameterized tests while preserving setup, assertions, timing, and cleanup.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• kibertoad/message-queue-toolkit#350: Updates dependency and TypeScript import patterns in overlapping files.
• kibertoad/message-queue-toolkit#406: Updates dependency versions in overlapping SNS and SQS package manifests.
• kibertoad/message-queue-toolkit#438: Modifies the repository pnpm configuration in package.json.

Suggested labels: major

Suggested reviewers: carlosgamero

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: updating dependencies across the workspace, including major versions.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/update-dependencies-kc4bdx

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 19: Update the `engines.node` declaration in `packages/amqp/package.json`
to `>=22.0.0` so it matches the pnpm 11 requirement and CI-supported runtime
range.

In `@packages/sqs/test/consumers/SqsPermissionConsumer.spec.ts`:
- Around line 961-965: Update the waitAndRetry condition in the heartbeat
consumer test so it always waits for consumer1Counter > 0, but only requires
consumer2Counter > 0 when heartbeatEnabled is false. Preserve the existing
expectations for both counters.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: efae0e6c-3791-4e4a-9c6f-63dcda7185f1

📥 Commits

Reviewing files that changed from the base of the PR and between db1451e and 23cb12c.

⛔ Files ignored due to path filters (2)

• packages/kafka/load-tests/package-lock.json is excluded by !**/package-lock.json
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (51)

• examples/sns-sqs/lib/01-publish-message.spec.ts
• examples/sns-sqs/lib/02-configurable-init.spec.ts
• examples/sns-sqs/lib/common/Dependencies.ts
• examples/sns-sqs/lib/common/TestMessages.ts
• examples/sns-sqs/lib/common/TestPublisherManager.ts
• examples/sns-sqs/lib/common/UserConsumer.ts
• examples/sns-sqs/lib/common/handlers/UserCreatedHandler.ts
• examples/sns-sqs/lib/common/handlers/UserUpdatedHandler.ts
• examples/sns-sqs/package.json
• examples/sns-sqs/tsconfig.json
• package.json
• packages/amqp/package.json
• packages/amqp/tsconfig.build.json
• packages/amqp/tsconfig.json
• packages/core/package.json
• packages/core/tsconfig.build.json
• packages/core/tsconfig.json
• packages/gcp-pubsub/package.json
• packages/gcp-pubsub/tsconfig.build.json
• packages/gcp-pubsub/tsconfig.json
• packages/gcs-payload-store/package.json
• packages/gcs-payload-store/tsconfig.build.json
• packages/gcs-payload-store/tsconfig.json
• packages/kafka/load-tests/package.json
• packages/kafka/package.json
• packages/kafka/test/publisher/PermissionPublisher.spec.ts
• packages/kafka/tsconfig.build.json
• packages/kafka/tsconfig.json
• packages/metrics/package.json
• packages/metrics/tsconfig.build.json
• packages/metrics/tsconfig.json
• packages/outbox-core/package.json
• packages/outbox-core/tsconfig.build.json
• packages/outbox-core/tsconfig.json
• packages/redis-message-deduplication-store/package.json
• packages/redis-message-deduplication-store/tsconfig.build.json
• packages/redis-message-deduplication-store/tsconfig.json
• packages/s3-payload-store/package.json
• packages/s3-payload-store/tsconfig.build.json
• packages/s3-payload-store/tsconfig.json
• packages/schemas/package.json
• packages/schemas/tsconfig.build.json
• packages/schemas/tsconfig.json
• packages/sns/package.json
• packages/sns/test/consumers/SnsSqsPermissionConsumer.spec.ts
• packages/sns/tsconfig.build.json
• packages/sns/tsconfig.json
• packages/sqs/package.json
• packages/sqs/test/consumers/SqsPermissionConsumer.spec.ts
• packages/sqs/tsconfig.build.json
• packages/sqs/tsconfig.json