chore(deps): bump the server-deps group in /server with 4 updates

[dependabot]

Bumps the server-deps group in /server with 4 updates: node-cron, tsx, @types/multer and @types/node.

Updates node-cron from 4.5.0 to 4.6.0

Release notes

Sourced from node-cron's releases.

v4.6.0

4.6.0 (2026-07-04)

Added

• add cron.shutdown(timeout?) for graceful process teardown (#589) (35f1a61)
• add unref option for heartbeat timers (#588) (35cb140)
• day-of-month: Quartz-style W, L-n and ? modifiers (#570) (cbe379b)
• emit task:failed when a background daemon exits unexpectedly (7bd91d6)
• support cron expression nicknames (@​yearly, @​daily, etc.) (#579) (6a6e14e)

Fixed

• background task state transition on stop/destroy without fork (#584) (9dbc6de)
• clear jitter timeout on runner stop (#583) (28b8146)
• CommonJS type resolution (#608) (ee9d294)
• correct falied->failed typo in daemon task error log (#594) (66c6961)
• correct shutdown listener typing that broke the build (#595) (7aac3ad)
• correlate execute() by id, isolate event hooks, and stop counting manual runs toward maxExecutions (#607) (0f039a9)
• daemon serialized task state with wrong field name (#587) (688d465)
• expand inverted ranges with wrap-around instead of silently swapping (#602) (a10ae53)
• harden cron.shutdown() teardown (#598) (a0b0d1f)
• kill orphan child process on background task stop/destroy timeout (#582) (8179e10)
• make concurrent background start() await the daemon and time out coordinator lookups (#605) (446f03a)
• make lifecycle calls on a destroyed task safe no-ops (#600) (7fa9795)
• prevent double destroy on registry remove (#585) (8ae9f06)
• release-please: match existing v-prefixed tags (#575) (e43c152)
• runner promise bugs that could hang scheduling or crash process (#581) (0ae62be)
• unref the IPC channel so background tasks let the process exit (#599) (534e593)
• validate the cron expression when scheduling a task (#603) (196e6cd)
• validate() consistency and multi-asterisk expansion (#606) (8cf41c4)
• weekday 7-to-0 conversion corrupting ranges (#580) (c8a3943)

Changed

• replace chai and sinon with native vitest assertions (#590) (d29d07a)

Changelog

Sourced from node-cron's changelog.

4.6.0 (2026-07-04)

Added

• add cron.shutdown(timeout?) for graceful process teardown (#589) (35f1a61)
• add unref option for heartbeat timers (#588) (35cb140)
• day-of-month: Quartz-style W, L-n and ? modifiers (#570) (cbe379b)
• emit task:failed when a background daemon exits unexpectedly (7bd91d6)
• support cron expression nicknames (@​yearly, @​daily, etc.) (#579) (6a6e14e)

Fixed

• background task state transition on stop/destroy without fork (#584) (9dbc6de)
• clear jitter timeout on runner stop (#583) (28b8146)
• CommonJS type resolution (#608) (ee9d294)
• correct falied->failed typo in daemon task error log (#594) (66c6961)
• correct shutdown listener typing that broke the build (#595) (7aac3ad)
• correlate execute() by id, isolate event hooks, and stop counting manual runs toward maxExecutions (#607) (0f039a9)
• daemon serialized task state with wrong field name (#587) (688d465)
• expand inverted ranges with wrap-around instead of silently swapping (#602) (a10ae53)
• harden cron.shutdown() teardown (#598) (a0b0d1f)
• kill orphan child process on background task stop/destroy timeout (#582) (8179e10)
• make concurrent background start() await the daemon and time out coordinator lookups (#605) (446f03a)
• make lifecycle calls on a destroyed task safe no-ops (#600) (7fa9795)
• prevent double destroy on registry remove (#585) (8ae9f06)
• release-please: match existing v-prefixed tags (#575) (e43c152)
• runner promise bugs that could hang scheduling or crash process (#581) (0ae62be)
• unref the IPC channel so background tasks let the process exit (#599) (534e593)
• validate the cron expression when scheduling a task (#603) (196e6cd)
• validate() consistency and multi-asterisk expansion (#606) (8cf41c4)
• weekday 7-to-0 conversion corrupting ranges (#580) (c8a3943)

Changed

• replace chai and sinon with native vitest assertions (#590) (d29d07a)

Commits

• 0be2ca0 chore(main): release 4.6.0 (#576)
• 813ab08 docs: note bundlers must keep node-cron external for background tasks (#610)
• ee9d294 fix: CommonJS type resolution (#608)
• 0f039a9 fix: correlate execute() by id, isolate event hooks, and stop counting manual...
• 8cf41c4 fix: validate() consistency and multi-asterisk expansion (#606)
• 446f03a fix: make concurrent background start() await the daemon and time out coordin...
• 88647a6 docs: note DST fall-back behavior for sub-hourly schedules and the UTC workar...
• 196e6cd fix: validate the cron expression when scheduling a task (#603)
• 7bd91d6 feat: emit task:failed when a background daemon exits unexpectedly (#601)
• a10ae53 fix: expand inverted ranges with wrap-around instead of silently swapping (#602)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for node-cron since your current version.

Updates tsx from 4.22.4 to 4.23.0

Release notes

Sourced from tsx's releases.

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 1dfad37 docs: cite esbuild's extension-resolution model in node notes
• 257bbbb fix: avoid redundant filesystem probes during module resolution
• c178197 feat: add multi-scenario startup benchmark suite
• 51800ac docs: add Node internals knowledge base (notes/node)
• a305f36 fix: isolate hook state per async module.register() registration
• ca501a9 chore: upgrade skills-npm to v1.2.0
• 596cd1f test: cover __dirname, __filename, & require.cache in CJS TS file
• 75d9bf0 test: lock in lenient ESM for ambiguous and CJS-typed packages
• 1472f3e test: cover ESM-syntax dependency with omitted "type" field
• See full diff in compare view

Updates @types/multer from 2.1.0 to 2.2.0

Commits

• See full diff in compare view

Updates @types/node from 26.0.1 to 26.1.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, server. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
medcore	Ready	Preview, Comment	Jul 6, 2026 2:09am