chore: update packages

package.json

@@ -28,85 +28,85 @@
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
     "@fastify/cookie": "^11.0.2",
-    "@fastify/cors": "^11.1.0",
+    "@fastify/cors": "^11.2.0",
-    "@fastify/multipart": "^9.3.0",
+    "@fastify/multipart": "^9.4.0",
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/sensible": "^6.0.4",
-    "@fastify/static": "^8.3.0",
+    "@fastify/static": "^9.0.0",
-    "@fastify/swagger": "^9.6.1",
+    "@fastify/swagger": "^9.7.0",
-    "@mantine/charts": "^8.3.9",
+    "@mantine/charts": "^8.3.18",
-    "@mantine/code-highlight": "^8.3.9",
+    "@mantine/code-highlight": "^8.3.18",
-    "@mantine/core": "^8.3.9",
+    "@mantine/core": "^8.3.18",
-    "@mantine/dates": "^8.3.9",
+    "@mantine/dates": "^8.3.18",
-    "@mantine/dropzone": "^8.3.9",
+    "@mantine/dropzone": "^8.3.18",
-    "@mantine/form": "^8.3.9",
+    "@mantine/form": "^8.3.18",
-    "@mantine/hooks": "^8.3.9",
+    "@mantine/hooks": "^8.3.18",
-    "@mantine/modals": "^8.3.9",
+    "@mantine/modals": "^8.3.18",
-    "@mantine/notifications": "^8.3.9",
+    "@mantine/notifications": "^8.3.18",
     "@prisma/adapter-pg": "6.13.0",
     "@prisma/client": "6.13.0",
     "@prisma/engines": "6.13.0",
     "@prisma/internals": "6.13.0",
     "@prisma/migrate": "6.13.0",
-    "@simplewebauthn/browser": "^13.2.2",
+    "@simplewebauthn/browser": "^13.3.0",
-    "@simplewebauthn/server": "^13.2.2",
+    "@simplewebauthn/server": "^13.3.0",
     "@smithy/node-http-handler": "^4.1.1",
-    "@tabler/icons-react": "^3.35.0",
+    "@tabler/icons-react": "^3.40.0",
     "archiver": "^7.0.1",
     "argon2": "^0.44.0",
-    "asciinema-player": "^3.12.1",
+    "asciinema-player": "^3.15.1",
     "bytes": "^3.1.2",
     "clsx": "^2.1.1",
     "colorette": "^2.0.20",
-    "commander": "^14.0.2",
+    "commander": "^14.0.3",
     "cookie": "^1.1.1",
     "cross-env": "^10.1.0",
-    "dayjs": "^1.11.19",
+    "dayjs": "^1.11.20",
     "detect-browser": "^5.3.0",
-    "dotenv": "^17.2.3",
+    "dotenv": "^17.3.1",
     "fast-glob": "^3.3.3",
-    "fastify": "^5.6.2",
+    "fastify": "^5.8.4",
     "fastify-plugin": "^5.1.0",
     "fastify-type-provider-zod": "^6.1.0",
     "fluent-ffmpeg": "^2.1.3",
     "he": "^1.2.0",
     "highlight.js": "^11.11.1",
     "iron-session": "^8.0.4",
-    "isomorphic-dompurify": "^2.33.0",
+    "isomorphic-dompurify": "^3.7.1",
-    "katex": "^0.16.27",
+    "katex": "^0.16.42",
-    "mantine-datatable": "^8.3.9",
+    "mantine-datatable": "^8.3.13",
     "ms": "^2.1.3",
-    "multer": "2.0.2",
+    "multer": "2.1.1",
-    "otplib": "^12.0.1",
+    "otplib": "^13.4.0",
     "prisma": "6.13.0",
     "qrcode": "^1.5.4",
-    "react": "^19.2.1",
+    "react": "^19.2.4",
-    "react-dom": "^19.2.1",
+    "react-dom": "^19.2.4",
     "react-markdown": "^10.1.0",
-    "react-router-dom": "^7.10.1",
+    "react-router-dom": "^7.13.2",
     "react-window": "1.8.11",
     "remark-gfm": "^4.0.1",
     "sharp": "^0.34.5",
-    "swr": "^2.3.7",
+    "swr": "^2.4.1",
-    "typescript-eslint": "^8.48.1",
+    "typescript-eslint": "^8.57.2",
-    "vite": "^7.2.7",
+    "vite": "^8.0.2",
     "zod": "^4.3.6",
-    "zustand": "^5.0.9"
+    "zustand": "^5.0.12"
   },
   "devDependencies": {
     "@types/archiver": "^7.0.0",
     "@types/bytes": "^3.1.5",
     "@types/fluent-ffmpeg": "^2.1.28",
     "@types/he": "^1.2.3",
-    "@types/katex": "^0.16.7",
+    "@types/katex": "^0.16.8",
     "@types/ms": "^2.1.0",
-    "@types/multer": "^2.0.0",
+    "@types/multer": "^2.1.0",
     "@types/node": "^24.10.1",
     "@types/qrcode": "^1.5.6",
-    "@types/react": "^19.2.7",
+    "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@types/react-window": "^1.8.8",
-    "@vitejs/plugin-react": "^5.1.1",
+    "@vitejs/plugin-react": "^6.0.1",
     "eslint": "^9.39.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-jsx-a11y": "^6.10.2",
@@ -115,11 +115,11 @@
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-react-refresh": "^0.4.24",
     "eslint-plugin-unused-imports": "^4.3.0",
-    "postcss": "^8.5.6",
+    "postcss": "^8.5.8",
     "postcss-preset-mantine": "^1.18.0",
     "postcss-simple-vars": "^7.0.1",
-    "prettier": "^3.7.4",
+    "prettier": "^3.8.1",
-    "sass": "^1.94.2",
+    "sass": "^1.98.0",
     "tsc-alias": "^1.8.16",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",

src/lib/totp.ts

@@ -1,12 +1,17 @@
-import { authenticator } from 'otplib';
+import { generateSecret, generateURI, verifySync } from 'otplib';
 import { toDataURL } from 'qrcode';
 
 export function generateKey() {
-  return authenticator.generateSecret(16);
+  return generateSecret({
+    length: 16,
+  });
 }
 
 export function verifyTotpCode(code: string, secret: string) {
-  return authenticator.check(code, secret);
+  return verifySync({
+    secret,
+    token: code,
+  });
 }
 
 export function totpQrcode({
@@ -18,7 +23,11 @@ export function totpQrcode({
   username: string;
   secret: string;
 }) {
-  return toDataURL(authenticator.keyuri(username, issuer ?? 'Zipline', secret), {
+  return toDataURL(
-    width: 180,
+    generateURI({
-  });
+      secret,
+      issuer: issuer ?? 'Zipline',
+      label: username,
+    }),
+  );
 }

tsconfig.json

@@ -8,8 +8,8 @@
     "forceConsistentCasingInFileNames": true,
     "noEmit": true,
     "esModuleInterop": true,
-    "module": "esnext",
+    "module": "preserve",
-    "moduleResolution": "node",
+    "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
     "jsx": "preserve",

vite.config.ts

@@ -1,28 +1,9 @@
-// @ts-ignore
 import react from '@vitejs/plugin-react';
 import path from 'path';
 import { defineConfig } from 'vite';
 
-// https://vite.dev/config/
 export default defineConfig(({ mode }) => {
-  if (mode === 'development')
+  const isSSR = mode.startsWith('ssr');
-    return {
-      plugins: [react()],
-      root: './src/client',
-      build: {
-        outDir: '../../build/client',
-      },
-      server: {
-        middlewareMode: true,
-        // not safe in production, but fine in dev
-        allowedHosts: true,
-      },
-      resolve: {
-        alias: {
-          '@': path.resolve(__dirname, './src'),
-        },
-      },
-    };
 
   return {
     plugins: [react()],
@@ -36,15 +17,19 @@ export default defineConfig(({ mode }) => {
           'ssr-view': path.resolve(__dirname, 'src/client/ssr-view/index.html'),
           'ssr-view-url': path.resolve(__dirname, 'src/client/ssr-view-url/index.html'),
         },
-        ...(mode.startsWith('ssr') && {
+        output: {
-          output: {
+          format: isSSR ? 'cjs' : 'esm',
-            entryFileNames: mode + '.js',
+          entryFileNames: isSSR ? `${mode}.js` : '[name]-[hash].js',
-            format: 'cjs',
+        },
-          },
-          plugins: [],
-        }),
       },
+      target: 'esnext',
     },
+
+    server: {
+      host: true,
+      middlewareMode: true,
+    },
+
     resolve: {
       alias: {
         '@': path.resolve(__dirname, './src'),