chore(deps): bump @o3co/auth.utils from 0.0.3 to 0.0.4

[dependabot]

Bumps @o3co/auth.utils from 0.0.3 to 0.0.4.

Release notes

Sourced from @​o3co/auth.utils's releases.

v0.0.4

What's Changed

• chore: add badges to README by @​y1o1 in o3co/auth.utils#5
• fix: gracefulShutdown awaits async cleanup after server.close drain (v0.0.4) by @​y1o1 in o3co/auth.utils#7

Full Changelog: o3co/auth.utils@v0.0.3...v0.0.4

Changelog

Sourced from @​o3co/auth.utils's changelog.

[0.0.4] — Unreleased

Changed

• gracefulShutdown(server, cleanup) now awaits an async cleanup callback after server.close() drains in-flight requests. The cleanup parameter type is widened from () => void to () => void | Promise<void> (backward-compatible at the call site — any function that previously satisfied () => void still satisfies the new union). Cleanup errors are caught with console.error("gracefulShutdown: cleanup error", err) and do not abort process.exit(0).

  Previously, cleanup ran synchronously before server.close(), which meant any returned Promise was dropped on the floor — the process exited before async resource releases (Redis disconnects, database pools, file handles) could complete. The new shape is:

  1. SIGTERM/SIGINT triggers the handler.
  2. server.close() is registered with an async callback that fires once all sockets are closed; in parallel, server.closeIdleConnections() runs synchronously to release idle keep-alive sockets so the close callback can fire promptly.
  3. Inside the close callback, await cleanup?.() runs (caught + logged on rejection), then process.exit(0).

  server.closeIdleConnections() deliberately leaves connections that are mid-request alone — those drain naturally through server.close, preserving the graceful-shutdown contract for in-flight requests. (Note: starting with Node.js 19.0.0, server.close reaps idle keep-alive connections on its own; the explicit closeIdleConnections() call is harmless on 19+ and necessary on 18.x.)

  This is a behavior change. Operators relying on the old fire-and-forget ordering — where cleanup started before server.close() and ran concurrently with request draining — will now experience strictly sequential, awaited cleanup after the request drain. In practice, the new ordering is what most operators expected the old code to do, so the migration impact is typically zero.

Added

• server.closeIdleConnections() is invoked synchronously after server.close() registers its callback so the close callback can fire promptly on Node 18.x without waiting for keep-alive timeouts. Active in-flight requests are not affected — only idle keep-alive connections are released. Requires Node.js >= 18.2.0; package.json now declares engines.node >= 18.19.0 which already satisfies this.
• engines.node >= 18.19.0 declared in package.json to match the

... (truncated)

Commits

• 2a5241c fix: gracefulShutdown awaits async cleanup after server.close drain (v0.0.4) ...
• bf8dabb Merge pull request #5 from o3co/chore/badges
• cb428ee chore: add CI, npm, codecov, license badges to README
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)