chore: update dependencies and biome rules

CATALOG_EXPORT.md

@@ -27,7 +27,7 @@ This source change alone does not configure or deploy the production service.
 ## Exported content
 
 | Source                                                                   | Repository destination                              |
-| --- | --- |
+| ------------------------------------------------------------------------ | --------------------------------------------------- |
 | Configured Nitro bundles, including furniture, figures, effects and pets | `Gamedata/bundled`                                  |
 | Configured furni icons                                                   | `Gamedata/icons`                                    |
 | Existing badge/catalog images                                            | `Gamedata/c_images`                                 |

biome.json

@@ -25,6 +25,10 @@
 			},
 			"style": {
 				"noDescendingSpecificity": "off"
+			},
+			"correctness": {
+				"noComponentHookFactories": "off",
+				"usePlaywrightValidDescribeCallback": "off"
 			}
 		}
 	},

deployment/proxy/compose.loopback.yml

@@ -6,4 +6,10 @@ services:
       HOSTNAME: 127.0.0.1
       PORT: "3002"
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "fetch('http://127.0.0.1:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))",
+        ]

docker-compose.yml

@@ -61,7 +61,13 @@ x-cms: &cms
   pids_limit: 512
 
   healthcheck:
-    test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"]
+    test:
+      [
+        "CMD",
+        "node",
+        "-e",
+        "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))",
+      ]
     interval: 15s
     timeout: 5s
     retries: 3

docs/cms-upgrade-2026-09.md

@@ -3,7 +3,7 @@
 ## Operator changes
 
 | Area             | Behavior and location                                                                                                                                                                                                                                                    |
-| --- | --- |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | Release          | Deployment checks HTTP health, release identity and Chromium pages before marking the running image verified. Registry publication reuses that verified digest on the shared runner; independent hosts build and verify their own image.                                 |
 | Shared HK        | Dialogs scroll within the available viewport. Table column preferences persist per page in the current browser session; filters already remain in the URL. No favorites added.                                                                                           |
 | Catalog Studio   | Dedicated detail drawer and five separate completeness states: SQL, offers, furnidata, icon and Nitro. Sprite/type conflicts are consistently excluded from import and linked to audit. Missing source files are never represented as available.                         |
@@ -37,7 +37,6 @@
 ## Verification
 
 Local verification on 2026-09-09:
-
 - Production build succeeded with fixture configuration and an intentionally unavailable database. Build-time fallback logs are expected in this check.
 - Full Vitest run: 254 files passed, 4 skipped; 1,466 tests passed, 6 skipped. Coverage thresholds passed (19.89% lines); this does not imply exhaustive coverage.
 - Global Biome rules/import checks passed across 1,328 files; modified source/locales were formatted separately to avoid unrelated Windows line-ending changes.

docs/performance-budgets.md

@@ -14,12 +14,11 @@ For each configured App Router route, resolve its exact app path using `app-path
 
 The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every client chunk that route's client-reference manifest lists. This includes layout, page and boundary/loading entries.
 
-The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk *path* still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
+The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk _path_ still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
 
 > The build runs webpack (`next build --webpack`), so the `clientModules` path is the live one. An earlier revision only read `entryJSFiles`, and after the switch to webpack every route reported `unavailable` while the command still exited 0 — the budgets were silently not being measured. When a bundler switch changes the manifest layout again, re-check this section rather than trusting a clean exit.
 
 The definition follows the data exposed by the installed Next 16.3.8 build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
-
 - Raw bytes are filesystem byte lengths of unique JavaScript assets in that envelope.
 - Gzip bytes are the **sum of independent gzip level 9 compressions** of those files using the recorded Node/zlib runtime. They are not gzip of concatenated source, nor observed CDN transfer sizes.
 - Deployment query strings and `/_next/` prefixes are normalized before deduplication. Shared files count once per route; each route is measured independently, with no misleading cross-route total.
@@ -35,7 +34,7 @@ Baselines were last recalibrated against a local webpack production build (Next
 The image build compiles the app, then runs `scripts/performance-report.mjs` in the same `RUN` layer (`Dockerfile:48-53`). In `mode: enforce` a failing route therefore fails the image build, which blocks both the PR `preflight` job and the `deploy` job. Recalibrate the table and `scripts/performance-budgets.json` **together** in the same commit whenever the envelope legitimately grows (new route dependency, Next upgrade).
 
 | Route                 | Baseline raw bytes | Baseline gzip bytes | Raw limit | Gzip limit |
-| --- | ---: | ---: | ---: | ---: |
+| --------------------- | -----------------: | ------------------: | --------: | ---------: |
 | `/me`                 |             621460 |              195411 |    716800 |     225280 |
 | `/news`               |             616712 |              193199 |    716800 |     225280 |
 | `/events`             |             617121 |              193450 |    716800 |     225280 |
@@ -46,4 +45,3 @@ The image build compiles the app, then runs `scripts/performance-report.mjs` in
 Configured limits are positive integer bytes; `null` explicitly means observe-only. `scripts/performance-budgets.json` runs `mode: enforce`: an `over-budget` route prints `Performance budgets enforced: <route> (over-budget)` and exits non-zero. Missing production `BUILD_ID`, unsupported manifests, missing routes or missing referenced assets produce `unavailable` with a reason and **no partial/zero total**; under `enforce` an `unavailable` route also fails the command, so a bundler change that breaks measurement cannot pass quietly. Malformed budget configuration or an unwritable output directory always fails the command. Set `mode` back to `informational` only while recalibrating, never as a permanent state.
 
 Synthetic tests cover shared-chunk deduplication, exact byte/gzip calculations, route bootstrap selection, missing data, safe parsing and CLI exit behavior in both modes. Run `pnpm exec vitest run --coverage.enabled=false scripts/performance-report.test.mjs`.
-

package.json

@@ -55,10 +55,10 @@
 		"@dnd-kit/core": "6.3.1",
 		"@dnd-kit/sortable": "10.0.0",
 		"@dnd-kit/utilities": "3.2.2",
-		"@formatjs/icu-messageformat-parser": "3.5.21",
+		"@formatjs/icu-messageformat-parser": "3.5.22",
 		"@hookform/resolvers": "6.0.0",
-		"@tanstack/react-query": "5.104.4",
+		"@tanstack/react-query": "5.104.5",
-		"@tanstack/react-virtual": "3.14.21",
+		"@tanstack/react-virtual": "3.14.22",
 		"class-variance-authority": "0.7.1",
 		"clsx": "2.1.1",
 		"cmdk": "1.1.1",
@@ -70,9 +70,9 @@
 		"jpeg-js": "0.4.4",
 		"jsonc-parser": "3.3.1",
 		"jszip": "3.10.2",
-		"lucide-react": "1.59.0",
+		"lucide-react": "1.61.0",
 		"lzma-wasm": "1.0.7",
-		"motion": "14.4.0",
+		"motion": "14.6.0",
 		"music-metadata": "12.2.3",
 		"mysql2": "3.24.6",
 		"next": "16.4.2",
@@ -94,7 +94,7 @@
 	"devDependencies": {
 		"@axe-core/playwright": "4.14.0",
 		"@babel/parser": "8.0.7",
-		"@biomejs/biome": "2.5.15",
+		"@biomejs/biome": "2.6.2",
 		"@playwright/test": "1.64.1",
 		"@tailwindcss/forms": "0.5.11",
 		"@tailwindcss/postcss": "4.3.3",
@@ -112,7 +112,7 @@
 		"testcontainers": "12.2.1",
 		"tsx": "4.23.15",
 		"typescript": "7.0.2",
-		"vite": "8.3.4",
+		"vite": "8.3.5",
 		"vitest": "5.0.5"
 	}
 }

pnpm-workspace.yaml

@@ -1,9 +1,9 @@
 packages:
-  - '.'
+  - "."
 
 allowBuilds:
-  '@parcel/watcher': true
+  "@parcel/watcher": true
-  '@swc/core': true
+  "@swc/core": true
   cpu-features: true
   esbuild: true
   msw: true
@@ -13,12 +13,12 @@ allowBuilds:
 minimumReleaseAge: 60
 
 overrides:
-  glob: '^11.0.0'
+  glob: "^11.0.0"
-  '@esbuild-kit/core-utils': 'npm:tsx@^4.23.15'
+  "@esbuild-kit/core-utils": "npm:tsx@^4.23.15"
-  '@esbuild-kit/esm-loader': 'npm:tsx@^4.23.15'
+  "@esbuild-kit/esm-loader": "npm:tsx@^4.23.15"
-  source-map-js: '1.2.2'
+  source-map-js: "1.2.2"
   # GHSA advisory: postcss-selector-parser <7.1.6. Pulled in only by
   # @tailwindcss/typography (build-time prose selectors), which pins 6.0.10
   # exactly and has no upstream bump. The API subset it uses is unchanged in
   # v7, so force the patched major.
-  postcss-selector-parser: '^7.1.6'
+  postcss-selector-parser: "^7.1.6"

scripts/README.md

@@ -5,7 +5,7 @@ This directory contains utility scripts for managing the EpicNext-Cms project.
 ## Scripts Overview
 
 | Script                     | Description                                                       |
-| :--- | :--- |
+| :------------------------- | :---------------------------------------------------------------- |
 | `dashboard.sh`             | Main interactive menu to run all other scripts.                   |
 | `deploy.sh`                | Safely redeploys the application by freeing the port first.       |
 | `logs.sh`                  | View logs for cms and mariadb services.                           |
@@ -28,6 +28,7 @@ This directory contains utility scripts for managing the EpicNext-Cms project.
 | `catalog-sync.sh`          | Interactive catalog update against a clone source (see below).    |
 
 ## Usage
+
 Run any script directly, or use the dashboard:
 ```bash
 ./scripts/dashboard.sh
@@ -69,7 +70,7 @@ menu, so it is usable from cron.
 Every step the engine exposes is available as a flag:
 
 | Flag                                           | What it does                                                               |
-| :--- | :--- |
+| :--------------------------------------------- | :------------------------------------------------------------------------- |
 | `--sources=<a,b>`                              | Compare against these sources (id or display name)                         |
 | `--icons`                                      | Re-download missing furniture icons                                        |
 | `--nitros`                                     | Re-download missing bundles (stored as `.hab`)                             |
@@ -94,7 +95,6 @@ catalog page plus the offer, exactly like the app's own import. It skips
 anything already present, so it is safe to re-run.
 
 Safety notes:
-
 - **An audit writes nothing** — no repair flag means read-only.
 - `--dry-run` together with `--import-new` lists what would be imported and
   imports nothing; use it first on a source before importing thousands of items.
@@ -106,7 +106,7 @@ Safety notes:
 - `--apply-sql` is the only flag that changes the catalog; `--apply` authorises
   the two heavyweight child scripts (`align-db-ids`, `migrate-nitro-to-hab`).
   Both only report without it.
-- The engine is the same one the admin *Catalog audit* page streams
+- The engine is the same one the admin _Catalog audit_ page streams
   (`runCatalogAudit`), so a terminal run and an in-admin run agree.
 - `--json` prints one machine-readable report; `--fail-on-errors` exits `3` when
   error-severity issues remain, which is what a scheduled check should use.

src/app/admin/devops/antiddos/page.tsx

@@ -87,7 +87,7 @@ export default async function AdminAntiDdosPage() {
 					const ip = key.replace("antiddos:block:", "");
 					return {
 						ip,
-						ttlMs: ttlMs > 0 ? ttlMs : 0,
+						ttlMs: Math.max(ttlMs, 0),
 						count: violationCounts.get(ip) ?? 0,
 						source: "gate" as const,
 					};

src/app/admin/radio/history/page.tsx

@@ -63,7 +63,7 @@ export default async function AdminRadioHistoryPage() {
 
 	const liveCount = history.filter((h) => !h.endedAt).length;
 	const peakListeners = history.reduce(
-		(max, h) => (h.listenersCount > max ? h.listenersCount : max),
+		(max, h) => Math.max(h.listenersCount, max),
 		0,
 	);
 	const uniqueDjs = new Set(history.map((h) => String(h.userId))).size;