From 8e5c7850cf4d3860941dcf6c470f28b188cb5d38 Mon Sep 17 00:00:00 2001
From: Tobias Herber <22559657+herber@users.noreply.github.com>
Date: Thu, 23 Apr 2026 09:24:15 +0200
Subject: [PATCH] Sanitize queue job ids

---
 bun.lock                             | 1 +
 packages/api-mux/package.json        | 4 ++--
 packages/cron/package.json           | 2 +-
 packages/event/package.json          | 2 +-
 packages/id/package.json             | 4 ++--
 packages/queue/CHANGELOG.md          | 6 ++++++
 packages/queue/package.json          | 4 ++--
 packages/queue/src/drivers/bullmq.ts | 6 ++++--
 packages/rpc-client/package.json     | 4 ++--
 packages/telemetry/package.json      | 2 +-
 10 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/bun.lock b/bun.lock
index 6681c38..150d1fa 100644
--- a/bun.lock
+++ b/bun.lock
@@ -1,5 +1,6 @@
 {
   "lockfileVersion": 1,
+  "configVersion": 0,
   "workspaces": {
     "": {
       "name": "@lowerdeck/root",
diff --git a/packages/api-mux/package.json b/packages/api-mux/package.json
index 3588aa5..b3bfc83 100644
--- a/packages/api-mux/package.json
+++ b/packages/api-mux/package.json
@@ -36,6 +36,6 @@
     "vitest": "^3.2.4"
   },
   "dependencies": {
-    "@lowerdeck/error": "^1.2.2"
+    "@lowerdeck/error": "^1.2.3"
   }
-}
\ No newline at end of file
+}
diff --git a/packages/cron/package.json b/packages/cron/package.json
index ae87a30..92bc4e6 100644
--- a/packages/cron/package.json
+++ b/packages/cron/package.json
@@ -32,7 +32,7 @@
   "dependencies": {
     "@lowerdeck/execution-context": "^1.1.1",
     "@lowerdeck/id": "^1.0.8",
-    "@lowerdeck/queue": "^1.0.9",
+    "@lowerdeck/queue": "^1.0.11",
     "@lowerdeck/redis": "^1.0.6",
     "@lowerdeck/sentry": "^1.0.2",
     "bullmq": "^5.34.3"
diff --git a/packages/event/package.json b/packages/event/package.json
index 8bbf0d9..889c29d 100644
--- a/packages/event/package.json
+++ b/packages/event/package.json
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@lowerdeck/memo": "^1.0.4",
-    "@lowerdeck/redis": "^1.0.5",
+    "@lowerdeck/redis": "^1.0.6",
     "@lowerdeck/sentry": "^1.0.2",
     "p-queue": "^9.1.0"
   },
diff --git a/packages/id/package.json b/packages/id/package.json
index dd4dd9a..8b8f7d0 100644
--- a/packages/id/package.json
+++ b/packages/id/package.json
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@lowerdeck/hash": "^1.0.4",
-    "@lowerdeck/error": "^1.2.2",
+    "@lowerdeck/error": "^1.2.3",
     "nanoid": "^5.0.7",
     "short-uuid": "^5.2.0",
     "snowflake-uuid": "^1.0.0"
@@ -42,4 +42,4 @@
     "typescript": "^5.8.3",
     "vitest": "^3.1.2"
   }
-}
\ No newline at end of file
+}
diff --git a/packages/queue/CHANGELOG.md b/packages/queue/CHANGELOG.md
index c59d4d8..f101323 100644
--- a/packages/queue/CHANGELOG.md
+++ b/packages/queue/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @lowerdeck/queue
 
+## 1.0.11
+
+### Patch Changes
+
+- Sanitize job ids
+
 ## 1.0.9
 
 ### Patch Changes
diff --git a/packages/queue/package.json b/packages/queue/package.json
index 36a22d7..e774284 100644
--- a/packages/queue/package.json
+++ b/packages/queue/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lowerdeck/queue",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "publishConfig": {
     "access": "public"
   },
@@ -46,4 +46,4 @@
     "microbundle": "^0.15.1",
     "vitest": "^3.1.2"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/queue/src/drivers/bullmq.ts b/packages/queue/src/drivers/bullmq.ts
index c144618..2580449 100644
--- a/packages/queue/src/drivers/bullmq.ts
+++ b/packages/queue/src/drivers/bullmq.ts
@@ -112,6 +112,8 @@ let getSerializedExecutionContext = (
   });
 };
 
+let sanitizeJobId = (jobId?: string) => jobId?.replace(/:/g, '_');
+
 export interface BullMqQueueOptions {
   delay?: number;
   id?: string;
@@ -184,7 +186,7 @@ export let createBullMqQueue = <JobData>(
                   },
                   opts: {
                     delay: payload.opts?.delay ?? queueAddOpts?.delay,
-                    jobId: payload.opts?.id ?? queueAddOpts?.id,
+                    jobId: sanitizeJobId(payload.opts?.id ?? queueAddOpts?.id),
                     deduplication: payload.opts?.deduplication ?? queueAddOpts?.deduplication
                   }
                 }) as any
@@ -217,7 +219,7 @@ export let createBullMqQueue = <JobData>(
               } as any,
               {
                 delay: queueAddOpts?.delay,
-                jobId: queueAddOpts?.id,
+                jobId: sanitizeJobId(queueAddOpts?.id),
                 deduplication: queueAddOpts?.deduplication
               }
             )
diff --git a/packages/rpc-client/package.json b/packages/rpc-client/package.json
index f82d39b..4225e3f 100644
--- a/packages/rpc-client/package.json
+++ b/packages/rpc-client/package.json
@@ -38,10 +38,10 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@lowerdeck/canonicalize": "^1.0.4",
-    "@lowerdeck/error": "^1.2.2",
+    "@lowerdeck/error": "^1.2.3",
     "@lowerdeck/id": "^1.0.8",
     "@lowerdeck/memo": "^1.0.4",
     "@lowerdeck/proxy": "^1.0.4",
     "@lowerdeck/serialize": "^1.0.4"
   }
-}
\ No newline at end of file
+}
diff --git a/packages/telemetry/package.json b/packages/telemetry/package.json
index c4af9af..bd938af 100644
--- a/packages/telemetry/package.json
+++ b/packages/telemetry/package.json
@@ -30,7 +30,7 @@
     "build": "rm -rf ./dist && microbundle"
   },
   "dependencies": {
-    "@lowerdeck/execution-context": "^1.1.0",
+    "@lowerdeck/execution-context": "^1.1.1",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/context-async-hooks": "^2.5.0",
     "@opentelemetry/core": "^2.5.0",