chore(deps): update dependency pm2 to v7.0.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pm2 (source)	7.0.0 → 7.0.3

---

Release Notes

Unitech/pm2 (pm2)

v7.0.3

Compare Source

Bug Fixes

• Fix daemon failing to boot on Node.js < 14.18 — embedded vizion used node:-scheme requires; switched to bare specifiers

v7.0.2

Compare Source

Bug Fixes

• Fix pm2 serve returning 403 Forbidden on Windows — traversal guard used hardcoded / separator #​6109
• Fix pm2 ls table misalignment when a username exceeds the user column width — cli-tableau's truncate() miscounts ANSI bytes, leaking bold into the watching column
• Fix long status lines (e.g. Applying action … on app […]) wrapping on narrow terminals — Common.printOut now ANSI-aware crops single-line TTY output to terminal width (piped output unaffected)

Features

• pm2 ls host-metrics line now shown by defaultpm2 update)
• pm2 ls adaptive layout: picks the widest layout that fits the terminal — full → condensed → new ultra-compact mini (id · name · status · cpu · mem) — and caps the name column so long names can't overflow the table
• pm2 ls host-metrics line only lists network interfaces carrying traffic (hides idle utun/awdl/bridge/anpi/unused en*)
• pm2 ls host-metrics line: replaced mem free with ram usage (%), added GPU memory/temperature when reported, per-interface network errors/drops shown when non-zero

Core Refactor

• Drop old vizion module, refactor to support only git and drop 3 submodules
• Replace the bundled pm2-sysmonit module and systeminformation with lib/tools/SysMetrics.js (Linux/macOS); pm2 slist/getSystemData and the Docker metrics path now read this collector. Covered by test/programmatic/sysmetrics.mocha.js

Security

• Bump js-yaml 4.1.1 → 4.3.0 — fixes quadratic-complexity DoS in merge-key handling (GHSA-h67p-54hq-rp68) #​6122
• Bump ws 8.20.0 → 8.21.0 — fixes uninitialized-memory disclosure and tiny-fragment DoS (GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p) #​6116
• Bump @pm2/js-api 0.8.0 → 0.8.1, pulling in patched ws@8.21.0 (its transitive ws was pinned to the vulnerable 7.x). Production deps are now advisory-free (npm audit --omit=dev clean)

v7.0.1

Compare Source

Bug Fixes

• Fix Python (and other non-Node) interpreter regression on Ubuntu: bun runtime detection used a naive includes('bun') substring check that matched any path containing the letters "bun" — most notably /home/ubuntu/.... Affected paths were routed through ProcessContainerForkBun.js and crashed with SyntaxError: unterminated string literal when Python tried to parse the JS container. Anchored the match to the end of the interpreter path (=== 'bun' or /bun$/) in both lib/God/ForkMode.js and lib/Common.js #​5990
• Display max_memory_restart in pm2 describe output when set #​5925
• Add missing port option to StartOptions TypeScript declaration #​6045
• Fix incorrect file permissions on openrc.tpl template (0755 → 0644) #​5957
• Fix Windows cmd.exe regression: revert bin/pm2* launchers to #!/usr/bin/env node shebang (was polyglot #!/bin/sh). Polyglot worked on Linux/macOS but broke npm's pm2.cmd shim on Windows — cmd.exe can't interpret /bin/sh shebang and failed with '"/bin/sh"' is not recognized as an internal or external command. PowerShell's auto-generated pm2.ps1 shim happened to call node directly so it kept working, masking the regression. Bun-only Linux/macOS users (no Node installed) need to symlink node to bun (sudo ln -s $(which bun) /usr/local/bin/node) — same workaround used in the project's bun test Dockerfile. Documented in README #​6108

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 11:59 AM, only on Tuesday (* 8-11 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bito-code-review]

Code Review Agent Run #f13cca

Actionable Suggestions - 0

Review Details

• Files reviewed - 5 · Commit Range: 198efda..198efda

  • implementations/node-sdk+web-sdk/package.json
  • implementations/node-sdk/package.json
  • implementations/react-web-sdk/package.json
  • implementations/web-sdk/package.json
  • implementations/web-sdk_react/package.json
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Impact Analysis by Bito

Cross-Repository Impact Analysis

What Changed	Impact of Change	Suggested Review Actions
pm2 process manager upgraded from v7.0.0 to v7.0.3 across 5 package.json files	- No cross-repo consumers found for pm2: searchCode for 'pm2' across the organization returned zero hits. This library is used only within this monorepo for process management.	- Verify pm2 v7.0.3 is compatible with your Node.js runtime versions - Test any pm2 ecosystem/cluster scripts still work correctly after upgrade

Code Paths Analyzed

Impact:
Minor patch version upgrade of pm2 (7.0.0 → 7.0.3). This is a dev dependency used for process management. No API contract changes; likely bug fixes or security patches in pm2.

Flow:
package.json dependency declarations → npm install → pm2 available for process management scripts

Direct Changes (Diff Files):
• implementations/node-sdk+web-sdk/package.json [line 9-10] — pm2: 7.0.0 → 7.0.3
• implementations/node-sdk/package.json [line 23-24] — pm2: 7.0.0 → 7.0.3
• implementations/react-web-sdk/package.json [line 37-38] — pm2: 7.0.0 → 7.0.3
• implementations/web-sdk/package.json [line 51-52] — pm2: 7.0.0 → 7.0.3
• implementations/web-sdk_react/package.json [line 65-66] — pm2: 7.0.0 → 7.0.3

Repository Impact:
• All implementations in the monorepo (node-sdk, web-sdk variants): pm2 is upgraded across all 5 implementation packages

Cross-Repository Dependencies:
• None.

Database/Caching Impact:
• None

API Contract Violations:
• None.

Infrastructure Dependencies:
• pm2 is a dev/production process manager - any ecosystem.config.js or pm2 startup scripts may be affected

Additional Insights:
• Dependency version delta: Small patch bump (7.0.0 → 7.0.3) typically contains bug fixes; unlikely to break functionality

Testing Recommendations

Frontend Impact:
• None.

Service Integration:
• Verify that any pm2 ecosystem.config.js files or startup scripts still work correctly after the version upgrade

Data Serialization:
• None.

Privacy Compliance:
• None.

Backward Compatibility:
• pm2 minor/patch upgrades are generally backward compatible; test that existing pm2 commands (start, stop, restart, logs) work as expected

OAuth Functionality:
• None

Reliability Testing:
• None

Additional Insights:
• Review pm2 v7.0.3 release notes to understand what changed (likely bug fixes, may include security patches)
• Ensure Node.js version compatibility with pm2 7.0.3
• Run 'pm2 update' after npm install to ensure daemon uses new version

_{Analysis based on known dependency patterns and edges. Actual impact may vary.}

[bito-code-review]

✅ Review Settings Overridden

Status: Overridden Successfully

Guidelines:

• Accepted:

  • General : Review Posture, Repo Truth And Boundaries, Domain Invariants

  • Language : typescript= TypeScript Review Evidence

Note: Extra guidelines beyond 3 general purpose guidelines and 1 language specific guideline per language are not processed. Guidelines are fetched from the source branch.