Replace pnpm-lock.yaml with package-lock.json. Both overrides move to
package.json#overrides, including the request -> @cypress/request alias.
allowBuilds for es5-ext becomes package.json#allowScripts.
The deploy script chained "pnpm register", which would have failed once pnpm
was gone; it now calls npm run register.
- alias legacy request transitive to maintained @cypress/request fork
- pin undici to 7.28.0 for GHSA batch affecting < 7.28.0
- drop form-data/qs/tough-cookie overrides now satisfied upstream
- bump @vercel/functions to 3.7.5 and google-play-scraper to 10.1.3
- bump actions/checkout and actions/setup-node to v7
The existing top-level "overrides" field was npm syntax and ignored by pnpm.
Move overrides to pnpm-workspace.yaml where pnpm 11 reads them. Also bump
form-data to ^2.5.5 (was ^2.5.4) and tough-cookie to ^4.1.4 (was ^4.1.3).
This forces the patched versions throughout the tree, replacing form-data@2.3.3
and tough-cookie@2.5.0 that came in via app-store-scraper -> request.
- pin form-data/qs/tough-cookie via package.json overrides; clears 3 of 4
Dependabot alerts (request SSRF risk-accepted, no upstream fix)
- add GitHub Actions CI (lint + syntax check) on push/PR
- add /settings and /setdayswarning to setMyCommands
- new npm run describe sets bot profile description via Bot API
- README: drop stale preview warning, add Operations section
Java repo renamed legacy-store-scraper-bot → java-store-scraper-bot for symmetry with go-store-scraper-bot. Status (deprecated/maintained) belongs in README banners, not URLs.
GitHub repo rename: js-store-scraper-bot becomes the canonical store-scraper-bot. The Java reference impl is renamed to legacy-store-scraper-bot in parallel.
Updates: package.json name + description, README header + reference link, wrangler.toml worker name (file slated for removal in cleanup phase but kept consistent in the interim).
Operator runs `npm run migrate` (reads admin + group docs from Atlas)
followed by `npm run migrate:bulk` (uploads via wrangler kv bulk put).
Cache collections are skipped by default since they auto-rebuild from
upstream APIs; --include-cache flag migrates them with TTL preserved.
- mongodb is added as a devDependency only — never enters the Worker
bundle, the Worker still talks to KV exclusively.
- scripts/.atlas-export.json is gitignored (contains exported state).
- README documents the one-time runbook.
Drops the mongodb dependency entirely; all four logical collections
(admin singleton, group, apple_app, google_app) now live in a single KV
namespace bound as STORE_KV with prefixed keys. Cache TTL is delegated
to KV via expirationTtl (clamped to the 60s minimum). Document shape,
field names, and Java parity at the doc level are preserved.
- Adds src/repository/kv.js helper (getJson/putJson/del with TTL clamp)
- Rewrites all four *-repository.js modules on top of KV
- Removes src/repository/mongodb.js and the MONGODB_URI env requirement
- Adds an early STORE_KV-binding guard in src/index.js
- Bumps to 0.3.0
tiennm99
dependabot[bot]