fix ci warnings

packages/hydrooj/package.json

@@ -23,7 +23,7 @@
         "@hydrooj/utils": "workspace:^",
         "@simplewebauthn/server": "13.1.2",
         "@undefined-moe/require-resolve-hook": "^1.1.0",
-        "@zip.js/zip.js": "^2.7.64",
+        "@zip.js/zip.js": "^2.7.68",
         "adm-zip": "0.5.16",
         "cac": "^6.7.14",
         "cordis": "4.0.0-beta.5",
@@ -38,7 +38,7 @@
         "lru-cache": "^11.1.0",
         "mime-types": "^3.0.1",
         "moment-timezone": "^0.6.0",
-        "mongodb": "^6.17.0",
+        "mongodb": "^6.18.0",
         "mongodb-uri": "^0.9.7",
         "nanoid": "^5.1.5",
         "nodemailer": "^7.0.5",
@@ -49,7 +49,7 @@
         "schemastery": "^3.16.1",
         "semver": "^7.7.2",
         "shorty.js": "^1.0.1",
-        "superagent": "^10.2.2",
+        "superagent": "^10.2.3",
         "tar": "6.2.1",
         "thirty-two": "^1.0.2",
         "ua-parser-js": "^2.0.4"

packages/hydrooj/src/service/server.ts

@@ -195,7 +195,7 @@ export async function apply(ctx: Context) {
                 if (overrideLimit) maxOperations = overrideLimit;
                 // deprecated: remove boolean support in future
                 if (typeof defaultKey === 'boolean') defaultKey = defaultKey ? '{{user}}' : '{{ip}}';
-                const id = defaultKey.replace('{{ip}}', this.request.ip).replace('{{user}}', this.user._id);
+                const id = defaultKey.replace('{{ip}}', this.request.ip).replace('{{user}}', this.user?._id?.toString() || '0');
                 await opcount.inc(op, id, periodSecs, maxOperations);
             },
             renderTitle(str: string) {