[dependabot]

Update the compatible Java and Ruby runtime and tooling dependencies, including the pgJDBC and Jackson security fixes, and update Knip. Keep the existing TypeScript, typescript-eslint, Vitest/coverage, JSON, Standard/RuboCop, Steep/RBS, and Spotless versions where the proposed upgrades break supported behavior or repository checks. Development Gemfile bounds hold back the incompatible Ruby tooling without changing public gem dependencies.

Preserve overlapping dependency license text in the shaded Java conformance adapter so the pgJDBC update builds without warnings. Pin four JavaScript tooling transitives to reviewed security patch releases, and document the audit exception for the local CLI workspace being mistaken for the unrelated npm cli package.

[brandur]

@dependabot rebase

[brandur]

@dependabot rebase

[bgentry]

@dependabot rebase

[bgentry]

🤖 Codex review: Changes requested. The dependency artifact review found no blocking supply-chain issue in the inspected surfaces, but compatibility is blocked by the regressions below. Do not merge this head.

Reviewed upgrade

• Head: c64a90567338936dd752e761bcee90141eab084c; merge base: 274c4b1f542d8c3d83fd5c299d5986d38feae60c.
• Cross-ecosystem group: actions/cache 5 → 6; modernc.org/sqlite 1.60.1 → 1.61.0 and Go transitives; Java runtime/test/build dependencies; 16 directly resolved JavaScript upgrades; Ruby gems and four lockfiles.
• Notable major changes include TypeScript 6.0.3 → 7.0.2, Vitest/coverage 4.1.11 → 5.0.5, JSON 2.19.9 → 3.1.0, JUnit 5.13.4 → 6.1.3, and Spotless 2.44.3 → 3.10.4.

Blocking compatibility findings

1. TypeScript 7 removes the compiler API River uses. The checksum-verified 7.0.2 npm artifact exports only version strings from its main entrypoint. Documentation snippets access ts.sys.readFile; API reports call ts.createProgram, and the CLI codemod uses the classic compiler API too. Running node js/scripts/check-readme-snippets.mjs with the exact verified package fails immediately: TypeError: Cannot read properties of undefined (reading 'readFile'). The upgraded typescript-eslint still declares a TypeScript peer range below 6.1. Keep a compatible compiler API dependency or explicitly migrate these consumers and build commands. Microsoft migration guidance.
2. JSON 3 changes Ruby's duplicate-key behavior and removes a test API. On Ruby 3.3.12, the exact verified JSON 2.19.9 gem allows River::UniqueArgs.encode('{"a":1,"a":2,"b":3}', true) and existing duplicate-key conformance fixture parsing; 3.1.0 raises JSON::ParserError: duplicate key "a". UniqueArgs and conformance fixture loading therefore need an explicit compatibility decision and equivalent coverage. Separately, job_spec calls the removed JSON.dump_default_options; the target gem raises NoMethodError. Pin a compatible JSON version or address both changes before merging.
3. The required Java lint gate fails on new shaded resource overlap. make lint/java exits 2: pgJDBC 42.7.14 introduces runtime checker-qual:3.55.1, which shares META-INF/LICENSE.txt with slf4j-api:2.0.17. The conformance Shade configuration does not merge that resource. Maven's reactor compiles/packages successfully, but River's warning wrapper rejects the Shade warnings. Merge the license resource intentionally so the normal warning-free build passes.

Security review

• Parallel ecosystem reviews inspected published artifacts/source pairs, graph churn, hooks, native loaders, network/process/environment access, canonical sources, and advisory context.
• Go: 20 old/new module identities downloaded with the public proxy/checksum database; recorded sums match, with no same-version rewrites or River source/replace/toolchain/workspace changes. Inspected SQLite's handwritten driver changes and libc/platform/tooling deltas; generated transpilation received focused review.
• Actions: resolved v5/v6 to caa296126883cff596d87d8935842f9db880ef25 / 55cc8345863c7cc4c66a329aec7e433d2d1c52a9; inspected the actual canonical source/bundle archives. Action source and node24 entrypoint contract are unchanged; bundled toolkit changes implement the ESM migration. No unexpected source endpoint or credential collection identified.
• Java: compared nine direct and 13 material transitive upgrade pairs using Maven Central binaries, sources, POMs and available checksums. pgJDBC 42.7.14 and Jackson 3.2.4 contain confirmed upstream security fixes, so this group includes security updates. pgJDBC notices, Jackson release notes.
• JavaScript: 273 artifact identities checked, 255 tarballs digest-verified, 104 artifact pairs compared, and all 141 newly added npm registry signatures verified. No same-version integrity rewrite. Ninety provenance statements had matching artifact digests; full Sigstore chain verification was not performed.
• Ruby: 111 gem artifacts match RubyGems SHA256 metadata; 72 also match lockfile checksums. Executable sources for the new JSON, SimpleCov, Steep, pg, and sqlite3 artifacts match canonical upstream tags.
• Eleven npm advisories affect five unchanged development/tooling dependencies; these are existing exposure, not newly introduced by this PR. The dependency audit must not be reported as clean.

Compatibility verification

• TEST_DATABASE_URL=<disposable local Postgres> make test — passed all Go workspace modules, including driver and legacy transaction coverage.
• make lint with isolated temporary/cache directories — passed, zero issues. The first attempt hit another local linter's lock; the isolated rerun passed.
• make tidy — passed without tracked changes; go mod verify — all ten workspace modules verified.
• node --check for all four cache v6 bundled entrypoints — passed.
• Java make test/java/tools — passed; make lint/java — failed as above.
• Exact-package TypeScript documentation-script reproduction and old/new JSON behavior reproductions — failed on the new versions as above.
• Full JavaScript/Ruby suites, Java database/package suites, race/platform matrices, and authenticated hosted-cache execution were not completed after these material failures. None is represented as passing.
• The PR remains conflicted. A fresh @dependabot rebase was requested; any new head requires a security delta review and refreshed tree-specific validation before approval.

Residual risk
Prisma CLI 7.10.1 drops npm source-build provenance while retaining registry integrity/signatures. This matches an intentional upstream publisher-token fallback, but lowers assurance: upstream report. Native binaries and large generated/minified packages were not independently rebuilt or exhaustively audited. Maven publisher signatures were collected without cryptographic verification; SQLite 1.61.0 has no successful upstream provenance document. These limits are retained rather than treated as proof of malicious behavior.

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review of the reduced group.

Upgrade

• Reviewed head: 758c8c782a2a9f2f42caf98591b7bf0a6782035c, against 012b72cf05b9629d87f0e8c1aaf9aca5d8276ca5.
• Retains eight Java dependency/plugin upgrades, eleven directly used Ruby gem upgrades, Knip 6.42.1, and four JavaScript transitive security patch releases. This includes pgJDBC 42.7.14 and Jackson 3.2.4 security fixes.
• Holds back TypeScript 7, typescript-eslint 8.72, Vitest/coverage 5, JSON 3, Standard/RuboCop, Steep/RBS, and Spotless 3. Each hold follows a reproduced compiler API, lint, Node 24 fake-timer, duplicate-key/test API, formatting/type-checking, or Java 25 formatter incompatibility.
• Root/driver JSON versions remain 2.19.9; the Rails bundle preserves its existing 2.21.2. Ruby bounds affect repository development bundles, with public gem dependencies unchanged.
• The Java conformance adapter merges both dependency license notices. No library runtime source or release metadata is changed.

Security review

• Reused exact-version/integrity and source-diff evidence from the independent Java, JavaScript, Ruby, and Go/Actions inspections. Rebuilt the final inventory and reviewed the changed pairs, restored baseline identities, lock metadata, and execution context.
• The final JavaScript artifact delta has no same-version integrity rewrites. Knip's exact 6.42.0 → 6.42.1 pair received a source/package review.
• Inspected the actual old/new published artifacts for fast-uri 3.1.8 → 3.1.9, ip-address 10.7.3 → 10.7.4, markdown-it 14.3.1 → 14.3.3, and undici 6.29.0 → 6.29.1. All eight tarballs match registry SHA512 values and their registry signatures verify with npm public keys. Available provenance statements name the canonical repositories and match artifact digests. The code changes address URI ambiguity and parser/stream resource exhaustion without unexpected lifecycle, publisher, dependency, or credential-access changes.
• These four overrides are scoped to the exact vulnerable versions. The new audit exception names only GHSA-6cpc-mj5c-m9rq: pnpm mistakes the local cli directory for npm's unrelated cli@0.3.0. The workspace is @riverqueue/cli, and there is no registry cli identity in the graph.
• Ruby's restored artifacts match the reviewed hashes, with no same-version checksum changes. Java's retained Spotless binary matches the previously inspected baseline artifact. Independent final integration inspection found only the intended fourteen manifest, lockfile, and configuration files.

Compatibility verification

• All 54 GitHub checks passed on this exact head, including Go race/driver/CLI checks, Java 21/25 and Postgres 14–18 checks, JavaScript Node 24/26 and Postgres matrices, package archives, Ruby 3.2–4.0/backend/Rails checks, and CodeQL.
• Go: normal make test and make lint passed after incorporating the current master test fix.
• Java: lint, maintenance tools, SQLite/Postgres suites, package verification, and local release staging passed. The local Java 21 runs covered 525 SQLite and 539 Postgres tests with no failures/skips. The final Spotless hold separately passed make lint/java and make check/java/package using checksum-verified Temurin 25.0.4. Both license notices were verified inside the shaded JAR.
• JavaScript: final Node 26 normal gates passed. Node 24 passed lint/types/format, 1,384 unit tests, 190 Postgres tests, API/docs and 64 snippets, audit/licenses, migration verification, and the exact CI package command covering nine packages and eight examples. The optional extended legacy check passed with its Temporal preload; CI runs that check directly on Node 26.
• Ruby: final Ruby 4.0 frozen bundles, four lint scopes, type checks, migration verification, builds, SQLite/Postgres suites, and coverage collation passed. The Rails JSON 2.21.2 preservation additionally passed all 66 Rails examples and read-only lint. Combined coverage is 100% of 2,690 lines and 1,248 branches.
• Final committed path/blob hashes match the validated inputs. Unaffected evidence was reused only where source/configuration identities remained unchanged.

Residual risk
No blocking issue identified in the dependency delta. The existing http-cache-semantics advisory exception remains documented for an unexercised registry-client path. Retained baseline JGit still has CVE-2025-4949 in its XML manifest/Amazon S3 features; those features are outside the inspected local Spotless configuration, and no ratchet is enabled. This is not a claim of zero known advisories. Native/generated upstream artifacts were not independently rebuilt or exhaustively audited; full Sigstore chains and Maven publisher signatures were not independently verified.