build(deps): update dependencies across root, server, and client

Update dependency versions across root, server, and client package files and refresh the lockfile.
Upgrade @fastify/static to the patched major release and verify production static-serving compatibility.

client/package.json

@@ -57,16 +57,16 @@
     "@embedpdf/plugin-tiling": "2.14.4",
     "@embedpdf/plugin-viewport": "2.14.4",
     "@embedpdf/plugin-zoom": "2.14.4",
-    "@fontsource-variable/fraunces": "^5.2.9",
+    "@fontsource-variable/fraunces": "^5.3.0",
-    "@fontsource-variable/inter": "^5.2.8",
+    "@fontsource-variable/inter": "^5.3.0",
     "@lucide/vue": "1.24.0",
     "@tailwindcss/vite": "^4.3.3",
     "@tanstack/vue-table": "^8.21.3",
-    "@tanstack/vue-virtual": "^3.13.32",
+    "@tanstack/vue-virtual": "^3.13.34",
-    "@tiptap/extension-link": "^3.28.0",
+    "@tiptap/extension-link": "^3.29.0",
-    "@tiptap/pm": "^3.28.0",
+    "@tiptap/pm": "^3.29.0",
-    "@tiptap/starter-kit": "^3.28.0",
+    "@tiptap/starter-kit": "^3.29.0",
-    "@tiptap/vue-3": "^3.28.0",
+    "@tiptap/vue-3": "^3.29.0",
     "@types/howler": "^2.2.13",
     "@vueuse/core": "^14.3.0",
     "canvas-confetti": "^1.9.4",
@@ -74,7 +74,7 @@
     "clsx": "^2.1.1",
     "cronstrue": "^3.24.0",
     "dompurify": "^3.4.12",
-    "driver.js": "^1.7.0",
+    "driver.js": "^1.8.0",
     "echarts": "^6.1.0",
     "howler": "^2.2.4",
     "pinia": "^3.0.4",
@@ -86,7 +86,7 @@
     "vue": "^3.5.40",
     "vue-draggable-plus": "^0.6.1",
     "vue-echarts": "8.1.0-beta.2",
-    "vue-i18n": "^11.4.6",
+    "vue-i18n": "^11.4.8",
     "vue-router": "^5.2.0",
     "vue-sonner": "^2.0.9",
     "vue-virtual-scroller": "^3.0.4"
@@ -98,13 +98,13 @@
     "@types/jsdom": "^28.0.3",
     "@types/node": "^26.1.1",
     "@vite-pwa/assets-generator": "^1.0.2",
-    "@vitejs/plugin-vue": "^6.0.7",
+    "@vitejs/plugin-vue": "^6.0.8",
     "@vitest/coverage-v8": "^4.1.10",
-    "@vitest/eslint-plugin": "^1.6.22",
+    "@vitest/eslint-plugin": "^1.6.24",
     "@vue/eslint-config-typescript": "^14.9.0",
     "@vue/test-utils": "^2.4.11",
     "@vue/tsconfig": "^0.9.1",
-    "eslint": "^10.6.0",
+    "eslint": "^10.8.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-oxlint": "~1.73.0",
     "eslint-plugin-vue": "~10.9.2",
@@ -115,10 +115,10 @@
     "prettier": "3.9.5",
     "tw-animate-css": "^1.4.0",
     "typescript": "~6.0.3",
-    "vite": "^8.1.4",
+    "vite": "^8.1.5",
-    "vite-plugin-vue-devtools": "^8.1.5",
+    "vite-plugin-vue-devtools": "^8.2.1",
     "vitest": "^4.1.10",
-    "vue-tsc": "^3.3.7"
+    "vue-tsc": "^3.3.8"
   },
   "engines": {
     "node": "^20.19.0 || >=22.12.0"

package.json

@@ -60,12 +60,12 @@
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/github": "^12.0.9",
     "@semantic-release/release-notes-generator": "^14.1.1",
-    "concurrently": "^10.0.3",
+    "concurrently": "^10.0.4",
     "conventional-changelog-conventionalcommits": "^9.3.1",
     "husky": "^9.1.7",
-    "lint-staged": "^17.0.8",
+    "lint-staged": "^17.2.0",
-    "prettier": "^3.9.5",
+    "prettier": "^3.9.6",
-    "semantic-release": "^25.0.5"
+    "semantic-release": "^25.0.8"
   },
   "lint-staged": {
     "*.{md,json,yml,yaml}": [
@@ -84,12 +84,14 @@
     "overrides": {
       "@xhmikosr/decompress": "^11.1.3",
       "@esbuild-kit/core-utils>esbuild": "^0.25.12",
-      "brace-expansion@>=5.0.0 <5.0.7": "^5.0.7",
+      "@nestjs/swagger>js-yaml": "^5.2.2",
+      "brace-expansion@>=5.0.0 <5.0.8": "^5.0.8",
       "engine.io": "^6.6.7",
       "esbuild": "^0.28.1",
-      "fastify": "^5.8.5",
+      "fastify": "^5.10.0",
       "fast-uri": "^3.1.4",
       "fast-xml-builder": "^1.1.7",
+      "find-my-way": "^9.7.0",
       "form-data": "^4.0.6",
       "piscina": "^4.9.3",
       "qs": "^6.15.2",

server/package.json

@@ -56,7 +56,7 @@
     "@fastify/formbody": "^8.0.2",
     "@fastify/helmet": "^13.1.0",
     "@fastify/multipart": "^10.1.0",
-    "@fastify/static": "^9.3.0",
+    "@fastify/static": "^10.1.2",
     "@nestjs/common": "^11.1.28",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "^11.1.28",
@@ -65,7 +65,7 @@
     "@nestjs/platform-fastify": "^11.1.28",
     "@nestjs/platform-socket.io": "^11.1.28",
     "@nestjs/schedule": "^6.1.3",
-    "@nestjs/swagger": "^11.4.5",
+    "@nestjs/swagger": "^11.4.6",
     "@nestjs/terminus": "^11.1.1",
     "@nestjs/throttler": "^6.5.0",
     "@nestjs/websockets": "^11.1.28",
@@ -81,9 +81,9 @@
     "fast-xml-parser": "^5.10.1",
     "fastest-levenshtein": "^1.0.16",
     "fastify": "^5.10.0",
-    "jose": "^6.2.3",
+    "jose": "^6.2.4",
     "ms": "^2.1.3",
-    "mysql2": "^3.23.0",
+    "mysql2": "^3.23.1",
     "nestjs-pino": "^4.6.1",
     "node-unrar-js": "^2.0.2",
     "nodemailer": "^9.0.3",
@@ -106,36 +106,36 @@
     "@eslint/js": "^10.0.1",
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
     "@ffprobe-installer/ffprobe": "^2.1.2",
-    "@nestjs/cli": "^11.0.23",
+    "@nestjs/cli": "^11.0.24",
     "@nestjs/schematics": "^11.1.0",
     "@nestjs/testing": "^11.1.28",
     "@swc/cli": "^0.8.1",
-    "@swc/core": "^1.15.43",
+    "@swc/core": "^1.15.46",
     "@types/bcrypt": "^6.0.0",
     "@types/express": "^5.0.6",
     "@types/node": "^26.1.1",
     "@types/nodemailer": "^8.0.1",
     "@types/opentype.js": "^1.3.10",
     "@types/passport-jwt": "^4.0.1",
-    "@types/pg": "^8.18.0",
+    "@types/pg": "^8.20.0",
-    "@types/supertest": "^7.2.0",
+    "@types/supertest": "^7.2.1",
     "@types/unzipper": "^0.10.11",
     "@vitest/coverage-v8": "^4.1.10",
     "drizzle-kit": "^0.31.10",
-    "eslint": "^10.6.0",
+    "eslint": "^10.8.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.6",
-    "globals": "^17.7.0",
+    "globals": "^17.8.0",
     "pino-pretty": "^13.1.3",
-    "prettier": "^3.9.5",
+    "prettier": "^3.9.6",
     "source-map-support": "^0.5.21",
     "supertest": "^7.2.2",
     "ts-loader": "^9.6.2",
     "ts-node": "^10.9.2",
     "tsconfig-paths": "^4.2.0",
-    "tsx": "^4.23.0",
+    "tsx": "^4.23.1",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.63.0",
+    "typescript-eslint": "^8.65.0",
     "vitest": "^4.1.10"
   }
 }

server/src/common/fastify-static-compatibility.test.ts

@@ -0,0 +1,67 @@
+import Fastify, { type FastifyInstance } from 'fastify';
+import fastifyStatic from '@fastify/static';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdir, mkdtemp, rm, writeFile } from 'fs/promises';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+describe('@fastify/static production compatibility', () => {
+  let app: FastifyInstance | undefined;
+  let testRoot: string;
+  let publicRoot: string;
+
+  beforeEach(async () => {
+    testRoot = await mkdtemp(join(tmpdir(), 'bookorbit-fastify-static-'));
+    publicRoot = join(testRoot, 'public');
+    await mkdir(join(publicRoot, 'assets'), { recursive: true });
+    await mkdir(join(publicRoot, 'deep'), { recursive: true });
+    await writeFile(join(publicRoot, 'index.html'), '<main>BookOrbit</main>');
+    await writeFile(join(publicRoot, 'assets', 'app.js'), 'globalThis.bookOrbit = true;');
+    await writeFile(join(publicRoot, 'deep', 'secret.txt'), 'protected');
+    await writeFile(join(testRoot, 'outside.txt'), 'outside root');
+  });
+
+  afterEach(async () => {
+    if (app !== undefined) {
+      await app.close();
+    }
+    await rm(testRoot, { recursive: true, force: true });
+  });
+
+  it('serves built assets and supports the SPA fallback', async () => {
+    app = Fastify();
+    await app.register(fastifyStatic, {
+      root: publicRoot,
+      prefix: '/',
+    });
+    app.setNotFoundHandler((_request, reply) => reply.sendFile('index.html'));
+    await app.ready();
+
+    const assetResponse = await app.inject({ method: 'GET', url: '/assets/app.js' });
+    const fallbackResponse = await app.inject({ method: 'GET', url: '/library/books/1' });
+
+    expect(assetResponse.statusCode).toBe(200);
+    expect(assetResponse.body).toBe('globalThis.bookOrbit = true;');
+    expect(fallbackResponse.statusCode).toBe(200);
+    expect(fallbackResponse.body).toBe('<main>BookOrbit</main>');
+  });
+
+  it.each(['/foo/../deep/secret.txt', '/foo/%2E%2E/deep/secret.txt', '/assets/../../outside.txt'])(
+    'rejects non-canonical static path %s',
+    async (url) => {
+      app = Fastify();
+      app.get('/deep/*', async (_request, reply) => reply.code(403).send());
+      await app.register(fastifyStatic, {
+        root: publicRoot,
+        prefix: '/',
+      });
+      await app.ready();
+
+      const response = await app.inject({ method: 'GET', url });
+
+      expect(response.statusCode).not.toBe(200);
+      expect(response.body).not.toContain('protected');
+      expect(response.body).not.toContain('outside root');
+    },
+  );
+});