Bump node-cron from 4.2.1 to 4.6.0

[dependabot]

Bumps node-cron from 4.2.1 to 4.6.0.

Release notes

Sourced from node-cron's releases.

v4.6.0

4.6.0 (2026-07-04)

Added

• add cron.shutdown(timeout?) for graceful process teardown (#589) (35f1a61)
• add unref option for heartbeat timers (#588) (35cb140)
• day-of-month: Quartz-style W, L-n and ? modifiers (#570) (cbe379b)
• emit task:failed when a background daemon exits unexpectedly (7bd91d6)
• support cron expression nicknames (@​yearly, @​daily, etc.) (#579) (6a6e14e)

Fixed

• background task state transition on stop/destroy without fork (#584) (9dbc6de)
• clear jitter timeout on runner stop (#583) (28b8146)
• CommonJS type resolution (#608) (ee9d294)
• correct falied->failed typo in daemon task error log (#594) (66c6961)
• correct shutdown listener typing that broke the build (#595) (7aac3ad)
• correlate execute() by id, isolate event hooks, and stop counting manual runs toward maxExecutions (#607) (0f039a9)
• daemon serialized task state with wrong field name (#587) (688d465)
• expand inverted ranges with wrap-around instead of silently swapping (#602) (a10ae53)
• harden cron.shutdown() teardown (#598) (a0b0d1f)
• kill orphan child process on background task stop/destroy timeout (#582) (8179e10)
• make concurrent background start() await the daemon and time out coordinator lookups (#605) (446f03a)
• make lifecycle calls on a destroyed task safe no-ops (#600) (7fa9795)
• prevent double destroy on registry remove (#585) (8ae9f06)
• release-please: match existing v-prefixed tags (#575) (e43c152)
• runner promise bugs that could hang scheduling or crash process (#581) (0ae62be)
• unref the IPC channel so background tasks let the process exit (#599) (534e593)
• validate the cron expression when scheduling a task (#603) (196e6cd)
• validate() consistency and multi-asterisk expansion (#606) (8cf41c4)
• weekday 7-to-0 conversion corrupting ranges (#580) (c8a3943)

Changed

• replace chai and sinon with native vitest assertions (#590) (d29d07a)

v4.5.0

Added

• lastRun() introspection getter on ScheduledTask: returns { date, result } after a successful execution, { date, error } after a failed one, or null before the first run.
• Extended day-of-week tokens: <weekday>#<nth> (nth weekday of the month, e.g. 1#1 for the first Monday) and <weekday>L (last weekday of the month, e.g. 5L for the last Friday).

Performance

• Cache Intl.DateTimeFormat instances per timezone instead of rebuilding on every call.
• Parse the cron expression once per TimeMatcher instead of re-parsing in MatcherWalker.
• Compute the GMT offset lazily (only when formatting ISO strings, not during the next-run search).
• Replace crypto.randomBytes with crypto.randomUUID for internal ID generation.

... (truncated)

Changelog

Sourced from node-cron's changelog.

4.6.0 (2026-07-04)

Added

• add cron.shutdown(timeout?) for graceful process teardown (#589) (35f1a61)
• add unref option for heartbeat timers (#588) (35cb140)
• day-of-month: Quartz-style W, L-n and ? modifiers (#570) (cbe379b)
• emit task:failed when a background daemon exits unexpectedly (7bd91d6)
• support cron expression nicknames (@​yearly, @​daily, etc.) (#579) (6a6e14e)

Fixed

• background task state transition on stop/destroy without fork (#584) (9dbc6de)
• clear jitter timeout on runner stop (#583) (28b8146)
• CommonJS type resolution (#608) (ee9d294)
• correct falied->failed typo in daemon task error log (#594) (66c6961)
• correct shutdown listener typing that broke the build (#595) (7aac3ad)
• correlate execute() by id, isolate event hooks, and stop counting manual runs toward maxExecutions (#607) (0f039a9)
• daemon serialized task state with wrong field name (#587) (688d465)
• expand inverted ranges with wrap-around instead of silently swapping (#602) (a10ae53)
• harden cron.shutdown() teardown (#598) (a0b0d1f)
• kill orphan child process on background task stop/destroy timeout (#582) (8179e10)
• make concurrent background start() await the daemon and time out coordinator lookups (#605) (446f03a)
• make lifecycle calls on a destroyed task safe no-ops (#600) (7fa9795)
• prevent double destroy on registry remove (#585) (8ae9f06)
• release-please: match existing v-prefixed tags (#575) (e43c152)
• runner promise bugs that could hang scheduling or crash process (#581) (0ae62be)
• unref the IPC channel so background tasks let the process exit (#599) (534e593)
• validate the cron expression when scheduling a task (#603) (196e6cd)
• validate() consistency and multi-asterisk expansion (#606) (8cf41c4)
• weekday 7-to-0 conversion corrupting ranges (#580) (c8a3943)

Changed

• replace chai and sinon with native vitest assertions (#590) (d29d07a)

[4.5.0] - 2026-06-21

Added

• lastRun() introspection getter on ScheduledTask: returns { date, result } after a successful execution, { date, error } after a failed one, or null before the first run. (#557)
• Extended day-of-week tokens: <weekday>#<nth> (nth weekday of the month, e.g. 1#1 for the first Monday) and <weekday>L (last weekday of the month, e.g. 5L for the last Friday). (#560)

Performance

... (truncated)

Commits

• 0be2ca0 chore(main): release 4.6.0 (#576)
• 813ab08 docs: note bundlers must keep node-cron external for background tasks (#610)
• ee9d294 fix: CommonJS type resolution (#608)
• 0f039a9 fix: correlate execute() by id, isolate event hooks, and stop counting manual...
• 8cf41c4 fix: validate() consistency and multi-asterisk expansion (#606)
• 446f03a fix: make concurrent background start() await the daemon and time out coordin...
• 88647a6 docs: note DST fall-back behavior for sub-hourly schedules and the UTC workar...
• 196e6cd fix: validate the cron expression when scheduling a task (#603)
• 7bd91d6 feat: emit task:failed when a background daemon exits unexpectedly (#601)
• a10ae53 fix: expand inverted ranges with wrap-around instead of silently swapping (#602)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for node-cron since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)