chore(deps)(deps): bump elysia-rate-limit from 4.6.1 to 4.6.2 in /apps/api

[dependabot]

Bumps elysia-rate-limit from 4.6.1 to 4.6.2.

Release notes

Sourced from elysia-rate-limit's releases.

v4.6.2

Patch Changes

• f088ef4: Fix cases where user ableto bypass rate limit if duration were set to 0 or NaN
• cb2811f: Support dynamic duration as a function
• a54821d: Add fail-closed error handling to dynamic duration and max configuration functions to prevent unhandled promise rejections and bypasses.
• 2ce04e3: Ensure Retry-After header correctly aligns with RateLimit-Reset rather than dynamically recalculating the duration of the rejected request.
• 3a9a100: Ensure unique plugin seeds for dynamic max and duration configurations to prevent Elysia from incorrectly deduplicating distinct rate limiter instances.
• 50e695b: Implement high-water mark logic for dynamic duration to prevent attackers from spoofing shorter window expirations by intentionally opening shorter windows.

Changelog

Sourced from elysia-rate-limit's changelog.

4.6.2

Patch Changes

• f088ef4: Fix cases where user ableto bypass rate limit if duration were set to 0 or NaN
• cb2811f: Support dynamic duration as a function
• a54821d: Add fail-closed error handling to dynamic duration and max configuration functions to prevent unhandled promise rejections and bypasses.
• 2ce04e3: Ensure Retry-After header correctly aligns with RateLimit-Reset rather than dynamically recalculating the duration of the rejected request.
• 3a9a100: Ensure unique plugin seeds for dynamic max and duration configurations to prevent Elysia from incorrectly deduplicating distinct rate limiter instances.
• 50e695b: Implement high-water mark logic for dynamic duration to prevent attackers from spoofing shorter window expirations by intentionally opening shorter windows.

Commits

• 6accc12 Version Packages (#80)
• fcdc2c8 ci: run tests on build
• 3a9a100 fix : Ensure unique plugin seeds for dynamic max and duration configurations ...
• f088ef4 fix: Rate Limit Bypass
• 50e695b fix : Implement high-water mark logic for dynamic duration to prevent attacke...
• a54821d fix : Add fail-closed error handling to dynamic duration and max configuratio...
• 2ce04e3 fix : Ensure Retry-After header correctly aligns with RateLimit-Reset rather ...
• cb2811f feat: support dynamic duration as a function (#79)
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	boring-stack-landing-page	39c6c50	Commit Preview URL Branch Preview URL	May 26 2026, 06:12 PM

[agjs]

@dependabot rebase

[agjs]

@dependabot rebase

[agjs]

@dependabot rebase

[agjs]

Superseded by 8fa532f — all 25 open dep bumps applied + tested in a single commit on main.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.