Skip to content

fix(hocuspocus): sync bun lockfile for v4 dependencies#795

Merged
otomatty merged 3 commits into
developfrom
fix/hocuspocus-lockfile-sync
Apr 30, 2026
Merged

fix(hocuspocus): sync bun lockfile for v4 dependencies#795
otomatty merged 3 commits into
developfrom
fix/hocuspocus-lockfile-sync

Conversation

@otomatty
Copy link
Copy Markdown
Owner

@otomatty otomatty commented Apr 30, 2026

概要

server/hocuspocuspackage.json@hocuspocus/* が v4 に更新済みだった一方、bun.lock が v3 のままだったため、Railway の bun install --frozen-lockfile が失敗していました。hocuspocus サービスの lockfile を再生成し、依存関係を v4 に同期します。

変更点

  • server/hocuspocus/bun.lock@hocuspocus/server / @hocuspocus/extension-redis v4.0.0 に同期
  • v4 で変わった推移依存関係を lockfile に反映
  • bun install --frozen-lockfile が hocuspocus サービスで通ることを確認

変更の種類

  • 🐛 バグ修正 (Bug fix)
  • ✨ 新機能 (New feature)
  • 💥 破壊的変更 (Breaking change)
  • 📝 ドキュメント (Documentation)
  • 🎨 スタイル/リファクタリング (Style/Refactor)
  • 🧪 テスト (Tests)
  • 🔧 ビルド/CI (Build/CI)

テスト方法

  1. cd server/hocuspocus && bun install --frozen-lockfile
  2. cd server/hocuspocus && bun run test
  3. bun run lint
  4. bun run test:run

補足: bun run format:check は現在の develop 上の多数ファイルで既存の整形差分を検出して失敗します。今回の変更ファイルは bun.lock のみで、Prettier は bun.lock の parser を推定できないため個別チェック対象外です。

チェックリスト

  • テストがすべてパスする
  • Lint エラーがない
  • 必要に応じてドキュメントを更新した
  • コミットメッセージが Conventional Commits に従っている

スクリーンショット(UI 変更がある場合)

UI 変更なし。

関連 Issue

Related to #793

Made with Cursor


Open in Devin Review

Summary by CodeRabbit

  • Chores

    • Removed unused runtime and dev dependencies to streamline the project.
  • Refactor

    • Overhauled server startup and shutdown to improve reliability and fail-fast behavior.
    • Ensured the custom health/internal endpoint remains active while reducing manual connection handling for simpler maintenance.

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 30, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 51aa4167-0c61-449a-ae5b-a24fbe873fa0

📥 Commits

Reviewing files that changed from the base of the PR and between be59e02 and edd56f0.

📒 Files selected for processing (1)
  • server/hocuspocus/src/index.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • server/hocuspocus/src/index.ts

📝 Walkthrough

Walkthrough

Refactors server initialization to use @hocuspocus/server v4's Server instance (consolidating HTTP and WebSocket handling) and removes runtime deps ioredis and ws (and dev @types/ws). Startup now uses hocuspocusServer.listen(); shutdown uses hocuspocusServer.destroy().

Changes

Cohort / File(s) Summary
Dependency Cleanup
server/hocuspocus/package.json
Removes runtime dependencies ioredis and ws, and dev dependency @types/ws.
Server Architecture Refactor
server/hocuspocus/src/index.ts
Replaces manual HTTP + WebSocket wiring with @hocuspocus/server v4 Server instance. Uses hocuspocusServer.listen() on startup, clears other HTTP request listeners and installs health/internal handlers, and performs graceful shutdown via hocuspocusServer.destroy() before PG pool teardown and process exit.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant HocuspocusServer
    participant HTTPServer
    participant PostgresPool
    Client->>HocuspocusServer: Connects (HTTP upgrade / WS)
    HocuspocusServer->>HTTPServer: Accepts request / handles health routes
    HocuspocusServer->>Client: Upgrades to WebSocket (internal)
    Note right of HocuspocusServer: Runs application logic, persists to DB
    HocuspocusServer->>PostgresPool: Acquire / release connections
    alt Shutdown (SIGTERM/SIGINT)
        HocuspocusServer->>HocuspocusServer: destroy()
        HocuspocusServer->>PostgresPool: teardown()
        HocuspocusServer->>Client: Close connections
    end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰 I hopped in code and found a door,
v4 swept webs across the floor,
Packages trimmed, the server hums,
Signals sleep and shutdown comes,
I nibble logs and leap for more ✨

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Title check ⚠️ Warning The PR title mentions syncing bun lockfile for v4 dependencies, but the actual changes include migrating server bootstrapping code from Hocuspocus v3 to v4 style in src/index.ts with significant architectural changes beyond just lockfile synchronization. Consider a more comprehensive title that captures both the lockfile sync and the v3-to-v4 server bootstrapping migration, such as 'fix(hocuspocus): migrate to v4 and sync dependencies' or provide separate PRs for lockfile and code changes.
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/hocuspocus-lockfile-sync

Review rate limit: 4/5 reviews remaining, refill in 12 minutes.

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the Hocuspocus dependencies, specifically upgrading @hocuspocus/extension-redis and @hocuspocus/server to version 4.0.0. These updates result in the addition of crossws and the removal of async-lock and lodash.debounce from the dependency tree. Feedback was provided regarding a version mismatch for ioredis, where the root package and the extension resolve to different versions; aligning these versions is recommended to deduplicate the dependency and potentially resolve type casting issues in the codebase.

Comment thread server/hocuspocus/bun.lock Outdated
"@hocuspocus/extension-redis": "^4.0.0",
"@hocuspocus/server": "^4.0.0",
"aws-jwt-verify": "^5.1.1",
"ioredis": "^5.9.3",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

ioredis のバージョンが重複してインストールされています。

ルートの package.json では ^5.9.35.10.0 に解決)が指定されていますが、@hocuspocus/extension-redis v4.0.0 は ~5.6.15.6.1 に解決)を要求しているため、別個にインストールされています(323行目参照)。

server/hocuspocus/src/index.tsioredis を直接使用していないのであれば、ルートの package.json から ioredis を削除するか、バージョンを ~5.6.1 に合わせることで、依存関係を整理しインストール容量を削減できます。また、index.ts 内の as never キャストも、この型定義の不一致が解消されれば不要になる可能性があります。

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

指摘どおり、server/hocuspocus では ioredis を直接 import していなかったため direct dependency から削除しました。lockfile も再生成し、extension 側の ioredis だけに整理しています。

devin-ai-integration[bot]

This comment was marked as resolved.

@AkimasaSugai
Copy link
Copy Markdown

レビューコメントへの対応をコミットしました(be59e02)。最新の変更に対する再レビューをお願いします。

@coderabbitai review

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 30, 2026

@AkimasaSugai レビューコメントへの対応ありがとうございます。commit be59e02 を含む最新の変更を確認します。


🧠 Learnings used
Learnt from: CR
Repo: otomatty/zedi PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-04-26T12:37:45.354Z
Learning: PR review focus: security, performance impact, breaking API/type changes, error handling, logging appropriateness, and Japanese/English comment tone alignment

Learnt from: CR
Repo: otomatty/zedi PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-14T12:40:46.017Z
Learning: PR review focus areas: check for security and performance impacts, breaking changes in public APIs or types, proper error handling and logging, and ensure comments in Japanese/English match project tone.

Learnt from: CR
Repo: otomatty/zedi PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-04-26T12:37:45.354Z
Learning: PR title should follow Conventional Commits format and accurately describe changes (e.g., `feat(admin): AIモデル管理UI拡張 (`#218`)`)

Learnt from: CR
Repo: otomatty/zedi PR: 0
File: .cursor/rules/pr-and-branch-naming.mdc:0-0
Timestamp: 2026-03-08T07:34:11.938Z
Learning: PR titles must accurately represent the changes made. Use Conventional Commits format (e.g., `feat(admin): AIモデル管理UI拡張 (`#218`)`). For single-topic PRs, use the representative commit message directly. Match the language (Japanese or English) to the majority language of commits.

Learnt from: CR
Repo: otomatty/zedi PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-14T12:40:46.017Z
Learning: PR titles must follow Conventional Commits format (e.g., `feat(admin): AIモデル管理UI拡張 (`#218`)`) and accurately represent the changes. When using Cursor Cloud Agent, include instructions in the prompt to ensure PR titles follow Conventional Commits format.

Learnt from: CR
Repo: otomatty/zedi PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T12:40:46.017Z
Learning: Ensure Japanese and English comments and documentation align with the project's tone.

Learnt from: CR
Repo: otomatty/zedi PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-04-26T12:37:45.354Z
Learning: Handle PR review comments following the procedure in `.cursor/skills/handle-pr-review/SKILL.md`: validate against TSDoc/tests/types, then choose to fix/use alternative/decline with justification

Learnt from: otomatty
Repo: otomatty/zedi PR: 158
File: server/api/Dockerfile:0-0
Timestamp: 2026-03-01T21:44:49.751Z
Learning: In the zedi repository, for Bun-based Docker builds in server/api/Dockerfile, the monorepo's root bun.lock file is copied to server/api/ during CI/deployment steps before building the Docker image, and the Dockerfile uses `bun install --frozen-lockfile` for deterministic builds.

Learnt from: otomatty
Repo: otomatty/zedi PR: 622
File: package.json:37-37
Timestamp: 2026-04-19T07:03:12.964Z
Learning: In the otomatty/zedi repository, TypeScript type-checking for `server/mcp` (e.g., `bun run --cwd server/mcp typecheck`) requires packages like `open` that exist ONLY in `server/mcp/node_modules` and are NOT hoisted to root `node_modules`. Therefore, adding a `typecheck` step for `server/mcp` inside the root `test:run` script would break on clean checkouts without a prior `bun install` inside `server/mcp`. The CI `mcp-test` job handles this correctly by running `bun install --frozen-lockfile` inside `server/mcp` before typechecking.

Learnt from: otomatty
Repo: otomatty/zedi PR: 622
File: package.json:37-37
Timestamp: 2026-04-19T07:03:12.964Z
Learning: In the otomatty/zedi repository, `server/mcp` is NOT part of the root Bun workspace, but its runtime dependencies (`modelcontextprotocol/sdk`, `hono`, `hono/node-server`, `zod`, etc.) are recorded as transitive deps in the root `bun.lock` and are hoisted to root `node_modules` by `bun install`. Therefore, running `vitest run --config server/mcp/vitest.config.ts` from the repo root resolves modules correctly via Node's upward directory traversal—the same mechanism used by `server/hocuspocus` and `packages/claude-sidecar`. No separate `bun install` in `server/mcp` is needed for running tests from the root.
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai[bot]

This comment was marked as resolved.

Server.listen() in @hocuspocus/server v4 returns a Promise that can
reject when the port is already in use or the onListen hook throws.
Previously the result was discarded with `void`, so failures were
silently swallowed and the process kept running in a broken state.

Chain a `.catch` handler that logs the error and exits with status 1
so the supervisor (Railway) restarts the service and surfaces the
problem in logs.

Refs: PR #795 review by coderabbitai
Made-with: Cursor
@AkimasaSugai
Copy link
Copy Markdown

@coderabbitai 指摘いただいた起動失敗の握り潰し問題を edd56f0 で修正しました。再レビューをお願いします。

The unhandled listen() rejection issue has been addressed in edd56f0. PTAL.

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 30, 2026

@AkimasaSugai listen() の未処理 rejection 問題への対応(edd56f0)ありがとうございます。最新のコミットを確認します。


🧠 Learnings used
Learnt from: CR
Repo: otomatty/zedi PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-04-26T12:37:45.354Z
Learning: PR review focus: security, performance impact, breaking API/type changes, error handling, logging appropriateness, and Japanese/English comment tone alignment

Learnt from: CR
Repo: otomatty/zedi PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-14T12:40:46.017Z
Learning: PR review focus areas: check for security and performance impacts, breaking changes in public APIs or types, proper error handling and logging, and ensure comments in Japanese/English match project tone.

Learnt from: CR
Repo: otomatty/zedi PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-14T12:40:46.017Z
Learning: PR titles must follow Conventional Commits format (e.g., `feat(admin): AIモデル管理UI拡張 (`#218`)`) and accurately represent the changes. When using Cursor Cloud Agent, include instructions in the prompt to ensure PR titles follow Conventional Commits format.

Learnt from: otomatty
Repo: otomatty/zedi PR: 622
File: package.json:37-37
Timestamp: 2026-04-19T07:03:12.964Z
Learning: In the otomatty/zedi repository, TypeScript type-checking for `server/mcp` (e.g., `bun run --cwd server/mcp typecheck`) requires packages like `open` that exist ONLY in `server/mcp/node_modules` and are NOT hoisted to root `node_modules`. Therefore, adding a `typecheck` step for `server/mcp` inside the root `test:run` script would break on clean checkouts without a prior `bun install` inside `server/mcp`. The CI `mcp-test` job handles this correctly by running `bun install --frozen-lockfile` inside `server/mcp` before typechecking.

Learnt from: otomatty
Repo: otomatty/zedi PR: 158
File: server/api/Dockerfile:0-0
Timestamp: 2026-03-01T21:44:49.751Z
Learning: In the zedi repository, for Bun-based Docker builds in server/api/Dockerfile, the monorepo's root bun.lock file is copied to server/api/ during CI/deployment steps before building the Docker image, and the Dockerfile uses `bun install --frozen-lockfile` for deterministic builds.

Learnt from: otomatty
Repo: otomatty/zedi PR: 793
File: .github/workflows/dependabot-bun-lock.yml:50-59
Timestamp: 2026-04-28T02:13:19.536Z
Learning: In the zedi repository, the `dependabot-bun-lock.yml` workflow security hardening best practice is to apply these three changes together: (1) add `persist-credentials: false` to the `actions/checkout` step, (2) use `bun install --no-summary --ignore-scripts` to prevent lifecycle script execution, and (3) use `https://x-access-token:${{ secrets.GITHUB_TOKEN }}github.com/${{ github.repository }}.git` for the explicit push instead of relying on checkout-persisted credentials.

Learnt from: otomatty
Repo: otomatty/zedi PR: 622
File: package.json:37-37
Timestamp: 2026-04-19T07:03:12.964Z
Learning: In the otomatty/zedi repository, `server/mcp` is NOT part of the root Bun workspace, but its runtime dependencies (`modelcontextprotocol/sdk`, `hono`, `hono/node-server`, `zod`, etc.) are recorded as transitive deps in the root `bun.lock` and are hoisted to root `node_modules` by `bun install`. Therefore, running `vitest run --config server/mcp/vitest.config.ts` from the repo root resolves modules correctly via Node's upward directory traversal—the same mechanism used by `server/hocuspocus` and `packages/claude-sidecar`. No separate `bun install` in `server/mcp` is needed for running tests from the root.
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@otomatty otomatty self-assigned this Apr 30, 2026
@otomatty otomatty merged commit 346c98d into develop Apr 30, 2026
18 checks passed
@otomatty otomatty deleted the fix/hocuspocus-lockfile-sync branch April 30, 2026 10:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants