[RedStar071]

🔗 Linked issue

Related to #357

❓ Type of change

• 🐞 Bug fix

📚 Description

wolfstar-project/plugins#276 makes Message#webhookId, applicationId, nonce and position null when a message has none, as in discord.js. The release that carries it, @wolfstar/plugin-gateway 0.16.2, is still staged on npm waiting for approval, so this pins the next snapshot published from that merge, 0.16.2-next-20261102131414. It goes back to ^0.16.2 once the release is approved.

plugin-cache goes to ^0.8.1, the range the snapshot asks for, so the bot and the gateway share one copy of the cache. plugin-broker 0.7.0 pins plugin-cache to exactly 0.8.0 and keeps its own copy until it is bumped too; the broker is off by default.

🤖 AI disclosure: Wolfstar Agent Kit modified this description. My AI open-source policy.

Confidence Score: 5/5

No merge-blocking issues were identified; the focused message and cache checks passed with the updated dependencies.

_{Reviews (1) · Last reviewed commit: "fix(deps): take the plugin-gateway snaps..." · Reviewed by Greptile}

[coldtea-pr-lens]

Note

Every file here is a lockfile or a package manifest, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wolfstar/​plugin-gateway@​0.16.0 ⏵ 0.16.2-next-20261102131414	+1
	@​wolfstar/​plugin-cache@​0.8.1

View full report

[pullfrog]

✅ No new issues found.

Reviewed changes — the single commit that moves the bot onto the plugin-gateway snapshot that reads message ids as null.

• @wolfstar/plugin-gateway pinned to the snapshot — projects/bot/package.json moves from ^0.16.0 to the exact 0.16.2-next-20261102131414. The exact pin is right for a next build, since a range would not match a prerelease. The integrity hash in the lockfile matches npm, and the peer dependencies are unchanged from 0.16.0.
• @wolfstar/plugin-cache raised to ^0.8.1 — this is the range the snapshot depends on, so the bot and the gateway resolve one copy of the cache. The 0.8.1 integrity hash matches npm.
• Lockfile regeneration — the lockfile has the new gateway and cache entries. It also has two unrelated changes from re-resolving: cac 7.0.0 is deduped to 7.1.0, and @smithy/core gets a deprecated note.

The bot's isWebhookMessage guard in lib/common/guards.ts checks typeof message.webhookId === 'string', so it handles null correctly. The PR description already says the pin is temporary and should go back to ^0.16.2 once the release is approved. Nobody will be reminded of that, so you may want to track it in #357.

  ^{｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}