Bump @tootallnate/once from 2.0.0 to 2.0.1

[dependabot]

Bumps @tootallnate/once from 2.0.0 to 2.0.1.

Release notes

Sourced from @​tootallnate/once's releases.

v2.0.1

Patch Changes

• a1e5e2d: Fix promise hang when AbortSignal is aborted

Changelog

Sourced from @​tootallnate/once's changelog.

2.0.1

Patch Changes

• a1e5e2d: Fix promise hang when AbortSignal is aborted

Commits

• bcbb21d ci: fix OIDC publishing — Node 24, npm latest, provenance
• dc24387 Version Packages (2.x) (#12)
• b8a6f80 CI: test all Node versions on Linux only
• dabcc0f ci: drop EOL Node.js 14.x/16.x, add 22.x
• b464efc Update CI: modern Node versions, fix macOS ARM64 compat
• a1e5e2d Fix promise hang when AbortSignal is aborted
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tootallnate/once since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[atlas-commons-bot]

Atlas Commons PR review

Requirement	Status
DCO sign-off	pass
Required checks	fail
Summary filled	fail
Checklist	pass
Linked issue	warn

Overall: fail

• All commits include DCO sign-off.
• Required checks failed.
• Summary section is empty or still has placeholder text.
• All checklist items ticked or none present.
• No linked issue (advisory).

View PR #15 · Atlas-Commons/StreamBooru

[atlas-commons-bot]

Atlas Commons code review (LLM)

Summary

This PR bumps @tootallnate/once from 2.0.0 to 2.0.1 via a single package-lock.json change. The package is an indirect dev dependency:

electron-builder → builder-util → http-proxy-agent → @tootallnate/once

The upstream fix (commit a1e5e2d) addresses a bug where a promise could hang indefinitely when an AbortSignal was aborted, instead of rejecting with AbortError and cleaning up listeners. There are no application code changes and no direct dependency on @tootallnate/once in package.json.

Potential issues

1. Minimal runtime impact in StreamBooru today. The only consumer in this tree is http-proxy-agent, which calls once(socket, 'connect') without passing a signal. The abort-handling fix therefore does not change current build-time behavior, though it is still worth taking as a hygiene update for the transitive chain.

// http-proxy-agent/dist/agent.js (current usage — no AbortSignal)
yield (0, once_1.default)(socket, 'connect');

2. Required checks are reported failing. The commit includes a valid DCO sign-off (Signed-off-by: dependabot[bot]), and local runs of npm run test:tags and npm run test:server pass on this lockfile. If CI is still red, treat it as an environment or flake issue rather than a problem introduced by this diff; re-run workflows before merging.

3. Lockfile-only updates can drift locally. Without merging, developers who run npm install may briefly resolve 2.0.0 until this PR lands. Low severity, but merging promptly keeps lockfile state consistent across the team.

Suggestions

1. Re-run CI and merge when green. This is a semver patch with a targeted correctness fix and no API changes. Risk to StreamBooru is low.

2. Optional sanity check for the dependency chain. If you want extra confidence beyond smoke tests, run npm run pack (or a full npm run dist) once on the PR branch. I verified npm run pack succeeds with @tootallnate/once@2.0.1.

3. No follow-up code changes needed. Application abort usage (e.g. in scripts/test-server-smoke.js) goes through native fetch + AbortController, not @tootallnate/once. No repo changes are required to benefit from this bump.

Overall assessment

This is a straightforward, low-risk Dependabot patch that updates a transitive dev dependency to a version with a real bug fix. I did not find correctness, security, or maintainability concerns in the diff itself. The change is appropriate to merge once required CI checks pass; the primary action item is confirming CI status rather than revising the PR.

---

Advisory review only — not a merge approval.

View PR #15 · Atlas-Commons/StreamBooru