chore(deps): bump the backend-dependencies group across 1 directory with 9 updates (#39)

* chore(deps): bump the backend-dependencies group across 1 directory with 9 updates

Bumps the backend-dependencies group with 9 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [express](https://github.com/expressjs/express) | `4.22.2` | `5.2.1` |
| [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express) | `4.17.25` | `5.0.6` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.6.2` |
| [ioredis](https://github.com/redis/ioredis) | `5.11.1` | `6.0.0` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.21.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.43` | `26.2.0` |
| [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.20.0` | `8.21.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.0` | `4.23.11` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |



Updates `express` from 4.22.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](https://github.com/expressjs/express/compare/v4.22.2...v5.2.1)

Updates `@types/express` from 4.17.25 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `express-rate-limit` from 7.5.1 to 8.6.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](https://github.com/express-rate-limit/express-rate-limit/compare/v7.5.1...v8.6.2)

Updates `ioredis` from 5.11.1 to 6.0.0
- [Release notes](https://github.com/redis/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](https://github.com/redis/ioredis/compare/v5.11.1...v6.0.0)

Updates `ws` from 8.21.0 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.21.0...8.21.3)

Updates `@types/express` from 4.17.25 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `@types/node` from 20.19.43 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/pg` from 8.20.0 to 8.21.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

Updates `tsx` from 4.23.0 to 4.23.11
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.11)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: backend-dependencies
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: backend-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: backend-dependencies
- dependency-name: "@types/pg"
  dependency-version: 8.20.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-dependencies
- dependency-name: ioredis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-dependencies
- dependency-name: tsx
  dependency-version: 4.23.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: backend-dependencies
- dependency-name: ws
  dependency-version: 8.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(backend): Express 5 / TS 7 type migrations for dependency bump

- req.params values are string|string[] in Express 5 types: normalize
  array params before validation in exports.ts and spam.ts routes
- ioredis v6 zrange overloads require string stop: pass '0'
- workerPool error handler: narrow unknown err before use

Verified: tsc --noEmit clean, 309/309 backend tests pass.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: hermes-gadget <whatinthe3duk@gmail.com>
Co-authored-by: hermes-gadget <hermes-gadget@users.noreply.github.com>

backend/package.json

@@ -29,22 +29,22 @@
     "@michaelhart/meshcore-decoder": "^0.3.0",
     "compression": "^1.7.4",
     "cors": "^2.8.5",
-    "express": "^4.19.2",
-    "express-rate-limit": "^7.4.1",
-    "ioredis": "^5.4.1",
+    "express": "^5.2.1",
+    "express-rate-limit": "^8.6.2",
+    "ioredis": "^6.0.0",
     "mqtt": "^5.10.1",
     "pg": "^8.13.1",
     "prom-client": "^15.1.3",
-    "ws": "^8.18.0"
+    "ws": "^8.21.3"
   },
   "devDependencies": {
     "@types/compression": "^1.7.5",
     "@types/cors": "^2.8.17",
-    "@types/express": "^4.17.21",
-    "@types/node": "^20.17.6",
-    "@types/pg": "^8.11.10",
+    "@types/express": "^5.0.6",
+    "@types/node": "^26.2.0",
+    "@types/pg": "^8.21.0",
     "@types/ws": "^8.5.12",
-    "tsx": "^4.19.1",
-    "typescript": "^5.6.3"
+    "tsx": "^4.23.11",
+    "typescript": "^7.0.2"
   }
 }

backend/src/api/routes/exports.ts

@@ -91,10 +91,14 @@ export function registerExportRoutes(router: Router, deps: Deps): void {
   });
 
   router.get('/v1/exports/nodes.:format', deps.exportLimiter, async (req, res) => {
-    const format = parseEnum(req.params['format']?.toLowerCase(), {
-      name: 'format',
-      values: ['csv', 'geojson'] as const,
-    });
+    const rawFormat = req.params['format'];
+    const format = parseEnum(
+      (Array.isArray(rawFormat) ? rawFormat[0] : rawFormat)?.toLowerCase(),
+      {
+        name: 'format',
+        values: ['csv', 'geojson'] as const,
+      },
+    );
     if (!format) {
       res.status(404).json({ error: 'Supported formats are csv and geojson' });
       return;

backend/src/api/routes/spam.ts

@@ -90,7 +90,8 @@ export function registerSpamRoutes(router: Router, deps: SpamRouteDeps): void {
 
   // Single incident with sanitized timeline.
   router.get('/spam/messages/incidents/:id', expensiveLimiter, async (req, res) => {
-    const { id } = req.params;
+    const rawId = req.params.id;
+    const id = Array.isArray(rawId) ? rawId[0] : rawId;
     if (!id || !/^[0-9a-f]{16}$/.test(id)) {
       res.status(400).json({ error: 'invalid incident id' });
       return;
@@ -228,7 +229,8 @@ export function registerSpamRoutes(router: Router, deps: SpamRouteDeps): void {
 
   // Per-node observer detail (used as fallback)
   router.get('/spam/packet/:id/observers', expensiveLimiter, async (req, res) => {
-    const { id } = req.params;
+    const rawId = req.params.id;
+    const id = Array.isArray(rawId) ? rawId[0] : rawId;
     if (!id || !/^[0-9a-fA-F]{64}$/.test(id)) {
       res.status(400).json({ error: 'invalid node id' });
       return;

backend/src/health/status.ts

@@ -300,7 +300,7 @@ async function currentWorkers(precomputedStats?: ReturnType<typeof systemStats>)
       r.llen('meshcore:link_jobs'),
       r.hmget('meshcore:link:v3:counters', 'count', 'bytes', 'dead_count', 'dead_bytes'),
       r.zcard('meshcore:link:v3:leases'),
-      r.zrange('meshcore:link:v3:enqueued', 0, 0, 'WITHSCORES'),
+      r.zrange('meshcore:link:v3:enqueued', 0, '0', 'WITHSCORES'),
       r.hvals('meshcore:link:v3:attempts'),
     ]).then(([legacy, counters, leases, oldest, attempts]) => {
       const [count, bytes, deadCount, deadBytes] = counters;

backend/src/operations/operatorOperations.ts

@@ -493,7 +493,7 @@ async function queueSnapshot(descriptor: QueueDescriptor): Promise<Record<string
     .hmget(descriptor.counters, 'count', 'bytes', 'dead_count', 'dead_bytes')
     .llen(descriptor.ready)
     .zcard(descriptor.leases)
-    .zrange(descriptor.enqueued, 0, 0, 'WITHSCORES')
+    .zrange(descriptor.enqueued, 0, '0', 'WITHSCORES')
     .zrevrange(descriptor.dead, 0, 24, 'WITHSCORES')
     .exists(descriptor.heartbeat);
   if (descriptor.deferred) pipeline.llen(descriptor.deferred);

backend/src/path-beta/workerPool.ts

@@ -87,9 +87,10 @@ export class WorkerPool {
       this.dispatchNext(worker);
     });
 
-    worker.on('error', (err) => {
-      console.error('[worker-pool] worker crashed:', err.message);
-      this.retireWorker(worker, err);
+    worker.on('error', (err: unknown) => {
+      const error = err instanceof Error ? err : new Error(String(err));
+      console.error('[worker-pool] worker crashed:', error.message);
+      this.retireWorker(worker, error);
     });
 
     worker.on('exit', (code) => {