chore: update dependencies and biome rules

.gitea/workflows/renovate.yaml

@@ -29,16 +29,16 @@ jobs:
           LOG_LEVEL: ${{ github.event.inputs.debug == 'true' && 'debug' || 'info' }}
         shell: bash
         run: |
-              docker run --rm \
+          docker run --rm \
-                --memory=6g \
+            --memory=6g \
-                --memory-swap=6g \
+            --memory-swap=6g \
-                -e RENOVATE_PLATFORM=gitea \
+            -e RENOVATE_PLATFORM=gitea \
-                -e RENOVATE_ENDPOINT=https://gitlab.epicnabbo.nl/ \
+            -e RENOVATE_ENDPOINT=https://gitlab.epicnabbo.nl/ \
-                -e RENOVATE_TOKEN \
+            -e RENOVATE_TOKEN \
-                -e RENOVATE_REPOSITORIES='["remco/EpicNext-Cms"]' \
+            -e RENOVATE_REPOSITORIES='["remco/EpicNext-Cms"]' \
-                -e RENOVATE_AUTODISCOVER=false \
+            -e RENOVATE_AUTODISCOVER=false \
-                -e RENOVATE_BINARY_SOURCE=install \
+            -e RENOVATE_BINARY_SOURCE=install \
-                -e LOG_LEVEL \
+            -e LOG_LEVEL \
-                -e RENOVATE_ONBOARDING=true \
+            -e RENOVATE_ONBOARDING=true \
-                -e RENOVATE_REQUIRE_CONFIG=required \
+            -e RENOVATE_REQUIRE_CONFIG=required \
-                "renovate/renovate:${RENOVATE_VERSION}"
+            "renovate/renovate:${RENOVATE_VERSION}"

CATALOG_EXPORT.md

@@ -26,15 +26,15 @@ This source change alone does not configure or deploy the production service.
 
 ## Exported content
 
-| Source | Repository destination |
+| Source                                                                   | Repository destination                              |
-| --- | --- |
+| ------------------------------------------------------------------------ | --------------------------------------------------- |
-| Configured Nitro bundles, including furniture, figures, effects and pets | `Gamedata/bundled` |
+| Configured Nitro bundles, including furniture, figures, effects and pets | `Gamedata/bundled`                                  |
-| Configured furni icons | `Gamedata/icons` |
+| Configured furni icons                                                   | `Gamedata/icons`                                    |
-| Existing badge/catalog images | `Gamedata/c_images` |
+| Existing badge/catalog images                                            | `Gamedata/c_images`                                 |
-| FurnitureData and supported public game-data JSON files | `Gamedata/config` |
+| FurnitureData and supported public game-data JSON files                  | `Gamedata/config`                                   |
-| Existing localized FurnitureData files | `catalogue version 2 ( Final (Dev)/langs furnidata` |
+| Existing localized FurnitureData files                                   | `catalogue version 2 ( Final (Dev)/langs furnidata` |
-| `items_base`, `catalog_pages`, `catalog_items` | `catalogue version 2 ( Final (Dev)/sqls` |
+| `items_base`, `catalog_pages`, `catalog_items`                           | `catalogue version 2 ( Final (Dev)/sqls`            |
-| `catalog_pages_bc`, `catalog_items_bc`, when present | Same SQL directory |
+| `catalog_pages_bc`, `catalog_items_bc`, when present                     | Same SQL directory                                  |
 
 SQL is read in one consistent, read-only InnoDB transaction. Dumps contain table
 definitions and deterministic upserts with hexadecimal UTF-8 string literals.

biome.json

@@ -25,6 +25,10 @@
 			},
 			"style": {
 				"noDescendingSpecificity": "off"
+			},
+			"correctness": {
+				"noComponentHookFactories": "off",
+				"usePlaywrightValidDescribeCallback": "off"
 			}
 		}
 	},

deployment/proxy/compose.loopback.yml

@@ -6,4 +6,10 @@ services:
       HOSTNAME: 127.0.0.1
       PORT: "3002"
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "fetch('http://127.0.0.1:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))",
+        ]

docker-compose.yml

@@ -61,7 +61,13 @@ x-cms: &cms
   pids_limit: 512
 
   healthcheck:
-    test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"]
+    test:
+      [
+        "CMD",
+        "node",
+        "-e",
+        "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))",
+      ]
     interval: 15s
     timeout: 5s
     retries: 3
@@ -94,4 +100,4 @@ services:
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 30s
+      start_period: 30s

docs/cms-upgrade-2026-09.md

@@ -2,20 +2,20 @@
 
 ## Operator changes
 
-| Area | Behavior and location |
+| Area             | Behavior and location                                                                                                                                                                                                                                                    |
-| --- | --- |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Release | Deployment checks HTTP health, release identity and Chromium pages before marking the running image verified. Registry publication reuses that verified digest on the shared runner; independent hosts build and verify their own image. |
+| Release          | Deployment checks HTTP health, release identity and Chromium pages before marking the running image verified. Registry publication reuses that verified digest on the shared runner; independent hosts build and verify their own image.                                 |
-| Shared HK | Dialogs scroll within the available viewport. Table column preferences persist per page in the current browser session; filters already remain in the URL. No favorites added. |
+| Shared HK        | Dialogs scroll within the available viewport. Table column preferences persist per page in the current browser session; filters already remain in the URL. No favorites added.                                                                                           |
-| Catalog Studio | Dedicated detail drawer and five separate completeness states: SQL, offers, furnidata, icon and Nitro. Sprite/type conflicts are consistently excluded from import and linked to audit. Missing source files are never represented as available. |
+| Catalog Studio   | Dedicated detail drawer and five separate completeness states: SQL, offers, furnidata, icon and Nitro. Sprite/type conflicts are consistently excluded from import and linked to audit. Missing source files are never represented as available.                         |
-| Operations | Command center includes permission-filtered error groups, personal import failures, open support tickets and news drafts. A failed source is shown separately from an empty source. |
+| Operations       | Command center includes permission-filtered error groups, personal import failures, open support tickets and news drafts. A failed source is shown separately from an empty source.                                                                                      |
-| Error center | Retained occurrence counts, first/last times, identified users, release counts, self-assignment and recognized local links. Assignment requires edit permission and is audited. |
+| Error center     | Retained occurrence counts, first/last times, identified users, release counts, self-assignment and recognized local links. Assignment requires edit permission and is audited.                                                                                          |
-| News | Private server-backed autosave, recover/discard/retry, prior saved revisions restored as a draft, and concurrent-edit detection. New status/search filters and pagination make older drafts reachable. |
+| News             | Private server-backed autosave, recover/discard/retry, prior saved revisions restored as a draft, and concurrent-edit detection. New status/search filters and pagination make older drafts reachable.                                                                   |
-| Jobs | Cancellation finishes the current item and stops pending items. Completed work stays completed. Uncertain interrupted mutations are excluded from retry. Live lease checks stop known stale worker writes. |
+| Jobs             | Cancellation finishes the current item and stops pending items. Completed work stays completed. Uncertain interrupted mutations are excluded from retry. Live lease checks stop known stale worker writes.                                                               |
-| Installation | `/admin/devops/installation` shows release, DB latency, Redis, emulator, storage permissions, migration history and worker heartbeat. Renderer defaults are recognized. Registry access is explicitly unverified from the web process. |
+| Installation     | `/admin/devops/installation` shows release, DB latency, Redis, emulator, storage permissions, migration history and worker heartbeat. Renderer defaults are recognized. Registry access is explicitly unverified from the web process.                                   |
-| Public dashboard | Current/next published event, clearer unread-message action, useful empty/error states and mobile layout refinements. |
+| Public dashboard | Current/next published event, clearer unread-message action, useful empty/error states and mobile layout refinements.                                                                                                                                                    |
-| Audit | Exact actor/action and UTC date filters, readable recorded before/after values and permission-protected CSV of the filtered page, capped at 100 rows. |
+| Audit            | Exact actor/action and UTC date filters, readable recorded before/after values and permission-protected CSV of the filtered page, capped at 100 rows.                                                                                                                    |
-| Performance | Active import polling remains 5 seconds; idle polling is 30 seconds and pauses in hidden tabs. History returns at most 30 owned jobs and initially renders 50 items per job. Health probes are deduplicated within a render; diagnostics report observed probe duration. |
+| Performance      | Active import polling remains 5 seconds; idle polling is 30 seconds and pauses in hidden tabs. History returns at most 30 owned jobs and initially renders 50 items per job. Health probes are deduplicated within a render; diagnostics report observed probe duration. |
-| Text | New messages are translated in English, Italian and Dutch. Other locales have explicit English fallback strings. Existing translation debt is not reported as resolved. |
+| Text             | New messages are translated in English, Italian and Dutch. Other locales have explicit English fallback strings. Existing translation debt is not reported as resolved.                                                                                                  |
 
 ## Deployment requirements
 
@@ -37,7 +37,6 @@
 ## Verification
 
 Local verification on 2026-09-09:
-
 - Production build succeeded with fixture configuration and an intentionally unavailable database. Build-time fallback logs are expected in this check.
 - Full Vitest run: 254 files passed, 4 skipped; 1,466 tests passed, 6 skipped. Coverage thresholds passed (19.89% lines); this does not imply exhaustive coverage.
 - Global Biome rules/import checks passed across 1,328 files; modified source/locales were formatted separately to avoid unrelated Windows line-ending changes.

docs/performance-budgets.md

@@ -14,12 +14,11 @@ For each configured App Router route, resolve its exact app path using `app-path
 
 The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every client chunk that route's client-reference manifest lists. This includes layout, page and boundary/loading entries.
 
-The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk *path* still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
+The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk _path_ still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
 
 > The build runs webpack (`next build --webpack`), so the `clientModules` path is the live one. An earlier revision only read `entryJSFiles`, and after the switch to webpack every route reported `unavailable` while the command still exited 0 — the budgets were silently not being measured. When a bundler switch changes the manifest layout again, re-check this section rather than trusting a clean exit.
 
 The definition follows the data exposed by the installed Next 16.3.8 build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
-
 - Raw bytes are filesystem byte lengths of unique JavaScript assets in that envelope.
 - Gzip bytes are the **sum of independent gzip level 9 compressions** of those files using the recorded Node/zlib runtime. They are not gzip of concatenated source, nor observed CDN transfer sizes.
 - Deployment query strings and `/_next/` prefixes are normalized before deduplication. Shared files count once per route; each route is measured independently, with no misleading cross-route total.
@@ -34,16 +33,15 @@ Baselines were last recalibrated against a local webpack production build (Next
 
 The image build compiles the app, then runs `scripts/performance-report.mjs` in the same `RUN` layer (`Dockerfile:48-53`). In `mode: enforce` a failing route therefore fails the image build, which blocks both the PR `preflight` job and the `deploy` job. Recalibrate the table and `scripts/performance-budgets.json` **together** in the same commit whenever the envelope legitimately grows (new route dependency, Next upgrade).
 
-| Route | Baseline raw bytes | Baseline gzip bytes | Raw limit | Gzip limit |
+| Route                 | Baseline raw bytes | Baseline gzip bytes | Raw limit | Gzip limit |
-| --- | ---: | ---: | ---: | ---: |
+| --------------------- | -----------------: | ------------------: | --------: | ---------: |
-| `/me` | 621460 | 195411 | 716800 | 225280 |
+| `/me`                 |             621460 |              195411 |    716800 |     225280 |
-| `/news` | 616712 | 193199 | 716800 | 225280 |
+| `/news`               |             616712 |              193199 |    716800 |     225280 |
-| `/events` | 617121 | 193450 | 716800 | 225280 |
+| `/events`             |             617121 |              193450 |    716800 |     225280 |
-| `/search` | 618536 | 194216 | 716800 | 225280 |
+| `/search`             |             618536 |              194216 |    716800 |     225280 |
-| `/admin/catalog` | 1049094 | 330369 | 1208320 | 389120 |
+| `/admin/catalog`      |            1049094 |              330369 |   1208320 |     389120 |
-| `/admin/studio/furni` | 1397566 | 447765 | 1607680 | 522240 |
+| `/admin/studio/furni` |            1397566 |              447765 |   1607680 |     522240 |
 
 Configured limits are positive integer bytes; `null` explicitly means observe-only. `scripts/performance-budgets.json` runs `mode: enforce`: an `over-budget` route prints `Performance budgets enforced: <route> (over-budget)` and exits non-zero. Missing production `BUILD_ID`, unsupported manifests, missing routes or missing referenced assets produce `unavailable` with a reason and **no partial/zero total**; under `enforce` an `unavailable` route also fails the command, so a bundler change that breaks measurement cannot pass quietly. Malformed budget configuration or an unwritable output directory always fails the command. Set `mode` back to `informational` only while recalibrating, never as a permanent state.
 
 Synthetic tests cover shared-chunk deduplication, exact byte/gzip calculations, route bootstrap selection, missing data, safe parsing and CLI exit behavior in both modes. Run `pnpm exec vitest run --coverage.enabled=false scripts/performance-report.test.mjs`.
-

drizzle/drafts/README.md

@@ -1 +1 @@
-Draft SQL from `pnpm db:generate` (drizzle-kit). Never apply these automatically — copy reviewed statements into drizzle/migrations/ as numbered CMS migrations, then `pnpm db:migrate`.
+Draft SQL from `pnpm db:generate` (drizzle-kit). Never apply these automatically — copy reviewed statements into drizzle/migrations/ as numbered CMS migrations, then `pnpm db:migrate`.

package.json

@@ -55,10 +55,10 @@
 		"@dnd-kit/core": "6.3.1",
 		"@dnd-kit/sortable": "10.0.0",
 		"@dnd-kit/utilities": "3.2.2",
-		"@formatjs/icu-messageformat-parser": "3.5.21",
+		"@formatjs/icu-messageformat-parser": "3.5.22",
 		"@hookform/resolvers": "6.0.0",
-		"@tanstack/react-query": "5.104.4",
+		"@tanstack/react-query": "5.104.5",
-		"@tanstack/react-virtual": "3.14.21",
+		"@tanstack/react-virtual": "3.14.22",
 		"class-variance-authority": "0.7.1",
 		"clsx": "2.1.1",
 		"cmdk": "1.1.1",
@@ -70,9 +70,9 @@
 		"jpeg-js": "0.4.4",
 		"jsonc-parser": "3.3.1",
 		"jszip": "3.10.2",
-		"lucide-react": "1.59.0",
+		"lucide-react": "1.61.0",
 		"lzma-wasm": "1.0.7",
-		"motion": "14.4.0",
+		"motion": "14.6.0",
 		"music-metadata": "12.2.3",
 		"mysql2": "3.24.6",
 		"next": "16.4.2",
@@ -94,7 +94,7 @@
 	"devDependencies": {
 		"@axe-core/playwright": "4.14.0",
 		"@babel/parser": "8.0.7",
-		"@biomejs/biome": "2.5.15",
+		"@biomejs/biome": "2.6.2",
 		"@playwright/test": "1.64.1",
 		"@tailwindcss/forms": "0.5.11",
 		"@tailwindcss/postcss": "4.3.3",
@@ -112,7 +112,7 @@
 		"testcontainers": "12.2.1",
 		"tsx": "4.23.15",
 		"typescript": "7.0.2",
-		"vite": "8.3.4",
+		"vite": "8.3.5",
 		"vitest": "5.0.5"
 	}
 }

pnpm-workspace.yaml

@@ -1,9 +1,9 @@
 packages:
-  - '.'
+  - "."
 
 allowBuilds:
-  '@parcel/watcher': true
+  "@parcel/watcher": true
-  '@swc/core': true
+  "@swc/core": true
   cpu-features: true
   esbuild: true
   msw: true
@@ -13,12 +13,12 @@ allowBuilds:
 minimumReleaseAge: 60
 
 overrides:
-  glob: '^11.0.0'
+  glob: "^11.0.0"
-  '@esbuild-kit/core-utils': 'npm:tsx@^4.23.15'
+  "@esbuild-kit/core-utils": "npm:tsx@^4.23.15"
-  '@esbuild-kit/esm-loader': 'npm:tsx@^4.23.15'
+  "@esbuild-kit/esm-loader": "npm:tsx@^4.23.15"
-  source-map-js: '1.2.2'
+  source-map-js: "1.2.2"
   # GHSA advisory: postcss-selector-parser <7.1.6. Pulled in only by
   # @tailwindcss/typography (build-time prose selectors), which pins 6.0.10
   # exactly and has no upstream bump. The API subset it uses is unchanged in
   # v7, so force the patched major.
-  postcss-selector-parser: '^7.1.6'
+  postcss-selector-parser: "^7.1.6"

src/app/admin/devops/antiddos/page.tsx

@@ -87,7 +87,7 @@ export default async function AdminAntiDdosPage() {
 					const ip = key.replace("antiddos:block:", "");
 					return {
 						ip,
-						ttlMs: ttlMs > 0 ? ttlMs : 0,
+						ttlMs: Math.max(ttlMs, 0),
 						count: violationCounts.get(ip) ?? 0,
 						source: "gate" as const,
 					};

src/app/admin/radio/history/page.tsx

@@ -63,7 +63,7 @@ export default async function AdminRadioHistoryPage() {
 
 	const liveCount = history.filter((h) => !h.endedAt).length;
 	const peakListeners = history.reduce(
-		(max, h) => (h.listenersCount > max ? h.listenersCount : max),
+		(max, h) => Math.max(h.listenersCount, max),
 		0,
 	);
 	const uniqueDjs = new Set(history.map((h) => String(h.userId))).size;

src/app/globals.css

@@ -2092,9 +2092,9 @@ body:has([data-admin]) {
 
 /* Admin forms / boxes follow admin tokens in both light and dark. */
 body:has([data-admin])
-input:not([type="checkbox"]):not([type="radio"]):not([type="range"]):not(
+	input:not([type="checkbox"]):not([type="radio"]):not([type="range"]):not(
-	[type="file"]
+		[type="file"]
-):not([type="color"]),
+	):not([type="color"]),
 body:has([data-admin]) select,
 body:has([data-admin]) textarea {
 	background-color: var(--admin-surface-elevated);