chore(deps): bump elysia-rate-limit from 3.0.0 to 5.1.0 in /backend

[dependabot]

Bumps elysia-rate-limit from 3.0.0 to 5.1.0.

Release notes

Sourced from elysia-rate-limit's releases.

v5.1.0

Minor Changes

• 554318e: Update published ESM entry points to use .mjs modules and .d.mts type declarations for clearer module resolution in consumers and tooling.

v5.0.0

Major Changes

• 556666b: migrate plugin to support elysia 2.0

v4.6.2

Patch Changes

• f088ef4: Fix cases where user ableto bypass rate limit if duration were set to 0 or NaN
• cb2811f: Support dynamic duration as a function
• a54821d: Add fail-closed error handling to dynamic duration and max configuration functions to prevent unhandled promise rejections and bypasses.
• 2ce04e3: Ensure Retry-After header correctly aligns with RateLimit-Reset rather than dynamically recalculating the duration of the rejected request.
• 3a9a100: Ensure unique plugin seeds for dynamic max and duration configurations to prevent Elysia from incorrectly deduplicating distinct rate limiter instances.
• 50e695b: Implement high-water mark logic for dynamic duration to prevent attackers from spoofing shorter window expirations by intentionally opening shorter windows.

v4.6.1

Patch Changes

• a35af16: extend rate limiting to 404 routes

v4.6.0

Minor Changes

• dc24ad4: performance improvements

v4.5.1

Patch Changes

• b8acb32: Fix unintended eager body parsing caused by destructuring body and using rest spread in lifecycle handler signatures. Elysia's static analyzer (sucrose) inspects function parameters to infer context dependencies, which caused the request body to be parsed for all routes — breaking routes that need raw body access (e.g. Stripe webhook signature verification). Context properties are now accessed at runtime via a helper function, invisible to sucrose's static analysis.

v4.5.0

Minor Changes

• b7a1cb7: Allow for the max request/per interval to be dynamic

v4.4.2

Patch Changes

• 2b99760: fix undeclared variable completeRequest

v4.4.1

Patch Changes

• 8d5fd0d: add cookie to request callbacks

... (truncated)

Changelog

Sourced from elysia-rate-limit's changelog.

5.1.0

Minor Changes

• 554318e: Update published ESM entry points to use .mjs modules and .d.mts type declarations for clearer module resolution in consumers and tooling.

5.0.0

Major Changes

• 556666b: migrate plugin to support elysia 2.0

4.6.2

Patch Changes

• f088ef4: Fix cases where user ableto bypass rate limit if duration were set to 0 or NaN
• cb2811f: Support dynamic duration as a function
• a54821d: Add fail-closed error handling to dynamic duration and max configuration functions to prevent unhandled promise rejections and bypasses.
• 2ce04e3: Ensure Retry-After header correctly aligns with RateLimit-Reset rather than dynamically recalculating the duration of the rejected request.
• 3a9a100: Ensure unique plugin seeds for dynamic max and duration configurations to prevent Elysia from incorrectly deduplicating distinct rate limiter instances.
• 50e695b: Implement high-water mark logic for dynamic duration to prevent attackers from spoofing shorter window expirations by intentionally opening shorter windows.

4.6.1

Patch Changes

• a35af16: extend rate limiting to 404 routes

4.6.0

Minor Changes

• dc24ad4: performance improvements

4.5.1

Patch Changes

• b8acb32: Fix unintended eager body parsing caused by destructuring body and using rest spread in lifecycle handler signatures. Elysia's static analyzer (sucrose) inspects function parameters to infer context dependencies, which caused the request body to be parsed for all routes — breaking routes that need raw body access (e.g. Stripe webhook signature verification). Context properties are now accessed at runtime via a helper function, invisible to sucrose's static analysis.

4.5.0

Minor Changes

• b7a1cb7: Allow for the max request/per interval to be dynamic

4.4.2

Patch Changes

... (truncated)

Commits

• f56f4f8 Version Packages (#87)
• 554318e Update package entry points to .mjs and .d.mts (#86)
• 5d84ac8 fix: npm to be main publish actor instead of bun
• de4de4c Version Packages (#84)
• 1d772bd ci: publish npm with oidc
• 556666b Migration to Elysia 2.0 (#83)
• 6accc12 Version Packages (#80)
• fcdc2c8 ci: run tests on build
• 3a9a100 fix : Ensure unique plugin seeds for dynamic max and duration configurations ...
• f088ef4 fix: Rate Limit Bypass
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for elysia-rate-limit since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

User dependabot[bot] does not have write permissions

github run

[essinghigh]

elysia-rate-limit@5.1.0 is incompatible with current ver. v5 plugin calls plugin.beforeHandle(...) during .use(), which throws:

TypeError: plugin.beforeHandle is not a function
  at registerRateLimitPlugin (node_modules/elysia-rate-limit/dist/index.mjs:187)
  at /root/github/terrence/backend/src/app.ts:431

This requires a major upgrade to elysia & a rework of the rate-limit calls in src/app.ts before I can merge.

[essinghigh]

Didn't even notice Elysia v2 is still beta. Holding off until GA.