[Story]: Bring code-interpreter dependencies up to current

[stephane-segning]

Summary

A dependency-freshness audit of code-interpreter (root package.json, api/package.json — the Bun-based sandbox API, and service/package.json — the Lambda/worker service) found 29 of 45 direct dependencies behind current npm latest: 16 by a major version and 13 by a minor. This Story tracks bringing them up to date in risk-appropriate batches.

Intent

Source of truth: ADORSYS-GIS/ai-helm#1002 (org-wide JS/TS dependency freshness audit).

Stale majors compound: rollup is two majors behind its own plugin ecosystem, eslint is two majors behind (flat config + further breaking changes since the currently-pinned v8), and typescript/@types/node are multiple majors behind the toolchain the rest of the org already runs. Catching this now is cheaper than doing it as an emergency migration later when a security patch forces the issue.

Scope

Grouped by what must move together and by risk. All version numbers below are from the npm registry (registry.npmjs.org/<pkg>/latest), checked 2026-08-13.

Batch A — routine (patch/minor, low risk, no known breaking changes)

package	current	latest	delta
@aws-sdk/client-lambda-microvms	3.1079.0	3.1109.0	minor
@aws-sdk/client-s3	3.1079.0	3.1109.0	minor
@opentelemetry/api	1.9.1	1.9.1	current (no action)
@opentelemetry/core	2.8.0	2.10.0	minor
@opentelemetry/exporter-trace-otlp-proto	0.219.0	0.221.0	minor
@opentelemetry/resources	2.8.0	2.10.0	minor
@opentelemetry/sdk-trace-base	2.8.0	2.10.0	minor
@rollup/plugin-typescript	^12.1.1	12.3.0	minor
@types/semver	^7.5.8	7.8.0	minor
@typescript-eslint/eslint-plugin	^8.0.1	8.67.0	minor
@typescript-eslint/parser	^8.0.1	8.67.0	minor
axios	^1.8.4	1.19.0	minor
eslint-plugin-import	^2.29.1	2.32.0	minor
winston	^3.14.2	3.19.0	minor

• Bump the AWS SDK pair (@aws-sdk/client-lambda-microvms + @aws-sdk/client-s3) together — same release train, service/package.json.
• Bump the OpenTelemetry family (core, resources, sdk-trace-base, exporter-trace-otlp-proto) together in both api/package.json and service/package.json — they're cross-version-pinned by the OTel SDK contract.
• Bump @typescript-eslint/eslint-plugin + @typescript-eslint/parser together (they must stay on the same minor).
• Bump @rollup/plugin-typescript, @types/semver, axios, eslint-plugin-import, winston independently.

Batch B — needs a real look (major version behind)

package	current	latest	delta
@rollup/plugin-alias	^5.1.1	6.0.0	MAJOR
@rollup/plugin-commonjs	^28.0.1	29.0.3	MAJOR
@rollup/plugin-node-resolve	^15.3.0	16.0.3	MAJOR
rollup	^2.79.2	4.62.4	MAJOR (2 majors behind)
@types/express	^4.17.21 / ^5.0.0	5.0.6	MAJOR
express	^4.19.2 / ^4.22.2	5.2.1	MAJOR
express-rate-limit	^7.4.1	8.6.2	MAJOR
rate-limit-redis	^4.2.0	6.0.1	MAJOR (2 majors behind)
ioredis	^5.4.1	6.0.0	MAJOR
bullmq	^5.13.1	6.1.0	MAJOR
nanoid	^3.3.7	6.0.1	MAJOR (3 majors behind, ESM-only since v4)
prettier	2.4.1 (root, unpinned range)	3.9.6	MAJOR
eslint	^8.57.0	10.8.1	MAJOR (2 majors behind)
eslint-import-resolver-typescript	^3.6.3	4.4.5	MAJOR
@types/node	^22.5.5	26.2.0	MAJOR
typescript	^5.5.4 / ^5.7.3	7.0.2	MAJOR (2 majors behind)

• Rollup toolchain — rollup + @rollup/plugin-alias + @rollup/plugin-commonjs + @rollup/plugin-node-resolve (+ Batch A's @rollup/plugin-typescript) must move together; rollup 2→4 changes the plugin API (this.emitFile, output hooks) so every @rollup/plugin-* needs to be on a version that supports Rollup 4 first. Re-verify service/package.json's rollup -c build after the bump.
• Express stack — express 4→5 (removed implicit body-parser wiring, changed route-matching semantics for */:param) + @types/express (already split ^4/^5 across the two workspaces — unify on 5.x) + express-rate-limit (needs an Express-5-compatible major) + rate-limit-redis. Test the sandbox API's routing and rate-limit middleware end-to-end after this bump — this is the riskiest single change in this Story.
• Redis client stack — ioredis 5→6, plus re-check ioredis-mock/@types/ioredis-mock (currently current at 8.13.1/8.2.8) and bullmq (which itself depends on ioredis) still resolve cleanly together.
• nanoid 3→6 (multiple majors, ESM-only) — also drop @types/nanoid entirely (see Risk assessment: it's deprecated upstream, nanoid ships its own types).
• prettier 2→3 — reformat-on-upgrade; expect a large diff-only commit from prettier --write . after the bump, land it separately from behavior changes.
• eslint 8→10 — flat config is mandatory since v9; requires migrating .eslintrc* to eslint.config.js and re-verifying eslint-import-resolver-typescript + eslint-plugin-import compatibility.
• @types/node — bump only to match whatever Node major the Lambda runtime (service/package.json, serverless deploy) actually targets; do not blindly jump to 26 without confirming the deployed Lambda runtime supports it.
• typescript 5→7 — TypeScript 7 is the native (Go-ported) compiler; validate ts-node, rollup, and the bun build toolchain all still work under it before committing to the jump. This may warrant its own follow-up spike rather than landing in the same PR as the rest of Batch B.

Out of scope

• No behavior changes beyond what the dependency majors force.
• No change to the AWS Lambda runtime version itself (only @types/node alignment, if any).
• No migration off ts-node / rollup to a different build tool — that's a separate decision.

Risk assessment

• Highest risk: Express 4→5 (route-matching + middleware semantics changed) and TypeScript 5→7 (different compiler entirely). Both need dedicated manual testing, not just a green bun test.
• Deprecated package found: @types/nanoid (^3.0.0) is deprecated upstream — "This is a stub types definition. nanoid provides its own type definitions, so you do not need this installed." Remove it as part of the nanoid bump regardless of which nanoid major is chosen.
• Stale/low-activity package found: rollup-plugin-sourcemaps (pinned ^0.6.3) last published 2020-10-07 — five years with no release. It's a devDependency (not a runtime risk), but flag it as a candidate for replacement (rollup's built-in sourcemap support may cover this now) during the Rollup toolchain bump rather than carrying it forward unexamined.
• Batches A and B can land as separate PRs; Batch A is safe to automate, Batch B needs human review per bullet above.

Verification

• bun install completes with no peer-dependency errors after each batch.
• cd api && bun run build && bun test passes.
• cd service && bun run build (rollup) and bun test pass.
• eslint . (post flat-config migration) passes with no new errors.
• Manual smoke test of the sandbox API's rate-limiting middleware after the Express major bump.

# commands to run for verification once the bumps land
bun install
(cd api && bun run build && bun test)
(cd service && bun run build && bun test)

AI Usage Declaration

• Drafting this story
• Suggesting implementation
• Versions were pulled programmatically from the npm registry (registry.npmjs.org/<pkg>/latest), not fabricated or estimated.
• No code was generated or changed as part of filing this Story — it is audit + planning only.

Reviewer Focus

Please double-check the Express-5 and TypeScript-7 risk calls above, and confirm the Lambda runtime's actual Node major before approving the @types/node line in Batch B.