maxibase 1.2.1 → 1.4.0

package/docker/compose.yaml

@@ -9,7 +9,7 @@ services:
       - ./volumes/files/private:/app/${NUXT_FILES_PRIVATE_FOLDER:-files/private}
       - ./volumes/backups:/app/backups
     ports:
-      - ${SERVER_PORT:-3000}:3000
+      - ${SERVER_HOST:-0.0.0.0}:${SERVER_PORT:-3000}:3000
     networks:
       - shared-network
 

package/layers/base/app/components/files/FilesUpload.vue

@@ -9,6 +9,7 @@ const props = defineProps({
     type: Boolean,
     default: true,
   },
+  maxAge: Number,
   imageFormat: {
     type: Object as PropType<{
       maxHeight?: number
@@ -57,9 +58,15 @@ async function uploadFile(event: Event) {
       files = files.filter((file) => !tooLarge.includes(file))
     }
     if (files.length) {
-      let response = await uploadFiles(files, props.path, props.isPrivate, (p) => {
-        progress.value = p
-      })
+      let response = await uploadFiles(
+        files,
+        props.path,
+        props.isPrivate,
+        (p) => {
+          progress.value = p
+        },
+        props.maxAge,
+      )
       emits('uploaded', response)
       appStore.notify('saved', 'success')
     }

package/layers/base/app/pages/admin/logs.vue

@@ -70,8 +70,8 @@ function formatDay(utcTimestamp: string) {
 }
 
 function originUrl(origin: string | null) {
-  const url = origin?.replace(/ .*/, '')
-  return url?.startsWith('/') || url?.startsWith('http') ? url : null
+  const url = origin?.replace(/^client /, '').replace(/ .*/, '')
+  return url && /^\/(?![/\\])/.test(url) ? url : null
 }
 
 function toggleExpanded(id: number, isOpen: boolean) {

package/layers/base/app/utils/files.ts

@@ -3,6 +3,7 @@ export async function uploadFiles(
   path: string,
   isPrivate: boolean,
   onProgress?: (progress: number) => void,
+  maxAge?: number, // seconds the browser and CDN may cache the file, 0 disables caching
 ) {
   let totalSize = files.reduce((sum, f) => sum + f.size, 0)
 
@@ -13,6 +14,7 @@ export async function uploadFiles(
     files.forEach((file) => formData.append('file', file))
     formData.append('path', path)
     formData.append('isPrivate', String(isPrivate))
+    if (maxAge !== undefined) formData.append('maxAge', String(maxAge))
     urls = await postFiles(formData)
   } else {
     let uploadedSize = 0
@@ -22,6 +24,7 @@ export async function uploadFiles(
         formData.append('file', file)
         formData.append('path', path)
         formData.append('isPrivate', String(isPrivate))
+        if (maxAge !== undefined) formData.append('maxAge', String(maxAge))
         urls.push(...(await postFiles(formData)))
         uploadedSize += file.size
         const progress = (uploadedSize / totalSize) * 100
@@ -32,7 +35,7 @@ export async function uploadFiles(
           const progress = (uploadedSize / totalSize) * 100
           onProgress?.(Math.round(progress))
         }
-        const url = await uploadInChunks(file, path, isPrivate, onChunkProgress)
+        const url = await uploadInChunks(file, path, isPrivate, onChunkProgress, maxAge)
         if (url) urls.push(url)
       }
     }
@@ -51,6 +54,7 @@ export async function uploadInChunks(
   path: string,
   isPrivate: boolean,
   onProgress?: (progress: number) => void,
+  maxAge?: number,
 ) {
   let uploadId
   let parts: any[] = []
@@ -70,6 +74,7 @@ export async function uploadInChunks(
     formData.append('filename', file.name)
     formData.append('path', path)
     formData.append('isPrivate', String(isPrivate))
+    if (maxAge !== undefined) formData.append('maxAge', String(maxAge))
 
     result = await $fetch('/api/files/chunk', { method: 'POST', body: formData })
     if (i + 1 < totalChunks) {

package/layers/base/nuxt.config.ts

@@ -93,7 +93,9 @@ export default defineNuxtConfig({
     },
     storage: {
       auth: {
-        driver: 'memory',
+        driver: 'lru-cache',
+        max: 10_000,
+        ttl: 10 * 60 * 1000,
       },
     },
     serverAssets: [

package/layers/base/server/api/files/[...path].get.ts

@@ -6,8 +6,6 @@ const querySchema = z.object({
     .transform((v) => v === 'true')
     .optional(),
   maxAge: z.coerce.number().int().min(0).optional(),
-  // only-if-cached is left out, fetch throws on it outside same-origin mode
-  serverCache: z.enum(['default', 'no-store', 'reload', 'no-cache', 'force-cache']).optional(),
   // S3 refuses to presign a URL for longer than 7 days
   expireIn: z.coerce.number().int().positive().max(604800).optional(),
   redirect: z
@@ -21,19 +19,12 @@ export default defineEventHandler(async (event) => {
   const {
     isPrivate = false,
     maxAge,
-    serverCache,
     expireIn,
     redirect,
   } = await getValidatedQuery(event, querySchema.parse)
 
-  let cache = `public, max-age=${maxAge || 31536000}`
-  if (maxAge === 0) {
-    cache = 'no-store, no-cache'
-  } else if (isPrivate) {
-    cache = `private, max-age=${maxAge || 3600}`
-  }
-  setHeader(event, 'Cache-Control', cache)
-  return getFile(event, decodePath(path), isPrivate, serverCache, expireIn, redirect)
+  setHeader(event, 'Cache-Control', getCacheControl(isPrivate, maxAge))
+  return getFile(event, decodePath(path), isPrivate, expireIn, redirect)
 })
 
 // h3 decodes the path but keeps %25 encoded, so a % in a name needs this second pass

package/layers/base/server/api/files/chunk.post.ts

@@ -37,6 +37,7 @@ export default defineEventHandler(async (event) => {
   const path = get('path') || 'files'
   const isPrivate = get('isPrivate') !== 'false'
   const parts = parseParts(get('parts'))
+  const maxAge = parseMaxAge(get('maxAge'))
   const chunkPart = body.find((p) => p.name === 'chunk')
 
   if (!Number.isInteger(chunkIndex) || !Number.isInteger(totalChunks) || !filename || !chunkPart) {
@@ -53,5 +54,6 @@ export default defineEventHandler(async (event) => {
     path,
     isPrivate,
     parts,
+    maxAge,
   })
 })

package/layers/base/server/api/files/copy.post.ts

@@ -5,18 +5,10 @@ const bodySchema = z.object({
   dest: z.string().min(1),
   isPrivate: z.boolean().optional(),
   deleteSrc: z.boolean().optional(),
-  isFolder: z.boolean().optional(),
 })
 
 export default defineEventHandler(async (event) => {
-  const {
-    src,
-    dest,
-    isPrivate,
-    deleteSrc,
-    isFolder = !src.includes('.'),
-  } = await readValidatedBody(event, bodySchema.parse)
-  if (isFolder) await copyFiles(event, src, dest, isPrivate, deleteSrc)
-  else await copyFile(event, src, dest, isPrivate, deleteSrc)
+  const { src, dest, isPrivate, deleteSrc } = await readValidatedBody(event, bodySchema.parse)
+  await copyFiles(event, src, dest, isPrivate, deleteSrc)
   return { success: true }
 })

package/layers/base/server/api/files/index.get.ts

@@ -1,10 +1,7 @@
 import { z } from 'zod'
 
 const querySchema = z.object({
-  path: z
-    .string()
-    .min(1)
-    .refine((p) => !p.includes('.')),
+  path: z.string().min(1),
   isPrivate: z
     .enum(['true', 'false'])
     .transform((v) => v === 'true')

package/layers/base/server/api/files/index.post.ts

@@ -8,8 +8,16 @@ export default defineEventHandler(async (event) => {
   const isPrivatePart = body.find((p) => p.name === 'isPrivate')
   const isPrivate = isPrivatePart ? isPrivatePart.data.toString() === 'true' : true
   const path = pathPart?.data.toString().trim()
+  const maxAge = parseMaxAge(
+    body
+      .find((p) => p.name === 'maxAge')
+      ?.data.toString()
+      .trim(),
+  )
 
   return await Promise.all(
-    body.filter((p) => p.name === 'file').map((file) => uploadFile(event, file, path, isPrivate)),
+    body
+      .filter((p) => p.name === 'file')
+      .map((file) => uploadFile(event, file, path, isPrivate, maxAge)),
   )
 })

package/layers/base/server/api/log.post.ts

@@ -16,5 +16,5 @@ const bodySchema = z.object({
 
 export default defineEventHandler(async (event) => {
   const { summary, data, origin, type } = await readValidatedBody(event, bodySchema.parse)
-  await log(summary, data, origin, type, event)
+  await log(summary, data, origin ? `client ${origin}` : 'client', type, event)
 })

package/layers/base/server/utils/files.ts

@@ -32,6 +32,7 @@ import { pipeline } from 'stream/promises'
 import type { Readable } from 'stream'
 import type { H3Event, MultiPartData } from 'h3'
 import { createHash } from 'crypto'
+import mime from 'mime'
 
 const MB = 1024 * 1024
 
@@ -53,10 +54,10 @@ export async function uploadFile(
   file: MultiPartData,
   path = 'files',
   isPrivate = true,
+  maxAge?: number, // only stored on S3 objects, local files get their headers from nginx
 ) {
   await checkFileAccess(event, path)
-  path = getSecurePath(path, isPrivate)
-  path = appendFilename(path, file.filename)
+  path = getUploadPath(path, isPrivate, file.filename)
 
   let url
   if (useS3()) {
@@ -65,7 +66,7 @@ export async function uploadFile(
       s3Key,
       file.data,
       file.type || 'application/octet-stream',
-      undefined,
+      getCacheControl(isPrivate, maxAge),
       isPrivate,
     )
   } else {
@@ -85,17 +86,17 @@ export async function uploadStream(
   file: { stream: Readable; filename?: string; type?: string },
   path = 'files',
   isPrivate = true,
+  maxAge?: number,
 ) {
   await checkFileAccess(event, path)
-  path = getSecurePath(path, isPrivate)
-  path = appendFilename(path, file.filename)
+  path = getUploadPath(path, isPrivate, file.filename)
 
   if (useS3()) {
     return uploadStreamToS3(
       getS3Key(path),
       file.stream,
       file.type || 'application/octet-stream',
-      undefined,
+      getCacheControl(isPrivate, maxAge),
       isPrivate,
     )
   }
@@ -133,6 +134,7 @@ export async function uploadChunk(
     path,
     isPrivate,
     parts,
+    maxAge,
   }: {
     uploadId?: string
     chunkIndex: number
@@ -143,6 +145,7 @@ export async function uploadChunk(
     path: string
     isPrivate: boolean
     parts: CompletedPart[]
+    maxAge?: number // only read on the first chunk, when the S3 upload starts
   },
 ) {
   if (chunkIndex < 0 || chunkIndex >= totalChunks || totalChunks < 1) {
@@ -155,12 +158,16 @@ export async function uploadChunk(
   }
 
   await checkFileAccess(event, path)
-  path = getSecurePath(path, isPrivate)
-  path = appendFilename(path, filename)
+  path = getUploadPath(path, isPrivate, filename)
 
   if (useS3()) {
     if (!uploadId) {
-      uploadId = (await initMultipartUploadToS3(getS3Key(path), type, isPrivate))!
+      uploadId = (await initMultipartUploadToS3(
+        getS3Key(path),
+        type,
+        isPrivate,
+        getCacheControl(isPrivate, maxAge),
+      ))!
       parts = []
     }
 
@@ -305,7 +312,6 @@ export async function getFile(
   event: H3Event,
   path: string,
   isPrivate = false,
-  cache: RequestCache = 'no-cache',
   expireIn?: number,
   redirect?: boolean,
 ) {
@@ -324,13 +330,14 @@ export async function getFile(
       return sendRedirect(event, url, 302)
     }
 
-    const response = await fetch(url, { cache, headers: range ? { range } : undefined })
+    const response = await fetch(url, { headers: range ? { range } : undefined })
 
     if (response.status === 416) {
       const contentRange = response.headers.get('content-range')
       if (contentRange) setHeader(event, 'Content-Range', contentRange)
       throw createError({ statusCode: 416, message: 'Range not satisfiable' })
     }
+    if (response.status === 404) throw createError({ statusCode: 404, message: 'File not found' })
     if (!response.ok) throw createError({ statusCode: 502, message: 'Failed to fetch file' })
 
     const passthrough = {
@@ -354,6 +361,7 @@ export async function getFile(
     throw createError({ statusCode: 404, message: 'File not found' })
   }
 
+  setHeader(event, 'Content-Type', mime.getType(fullPath) || 'application/octet-stream')
   setHeader(event, 'Accept-Ranges', 'bytes')
 
   const parsedRange = parseRangeHeader(range, stats.size)
@@ -417,27 +425,26 @@ export async function listFolder(
   path = getSecurePath(path, isPrivate)
 
   if (useS3()) return await listFromS3(path, isPrivate)
+  return listLocal(path, isPrivate)
+}
+
+async function listLocal(path: string, isPrivate: boolean): Promise<ListedFile[]> {
   const localPath = join(process.cwd(), path)
-  const filesStats = await readdir(localPath).catch(() => [])
-  return (
-    await Promise.all(
-      filesStats.map(async (name) => {
-        const localeFilePath = join(localPath, name)
-        const stats = await stat(localeFilePath)
-        const rootedPath = join(path, name)
-        const filePath = removeRoot(rootedPath, isPrivate)
-        return stats.isDirectory()
-          ? await listFolder(event, filePath, isPrivate)
-          : {
-              name,
-              size: stats.size,
-              updatedAt: stats.mtime,
-              path: filePath,
-              url: getFileURL(rootedPath, isPrivate),
-            }
-      }),
-    )
-  ).flat()
+  const stats = await stat(localPath).catch(() => null)
+  if (stats?.isFile()) {
+    return [
+      {
+        name: basename(path),
+        size: stats.size,
+        updatedAt: stats.mtime,
+        path: removeRoot(path, isPrivate),
+        url: getFileURL(path, isPrivate),
+      },
+    ]
+  }
+  if (!stats?.isDirectory()) return []
+  const names = await readdir(localPath)
+  return (await Promise.all(names.map((name) => listLocal(join(path, name), isPrivate)))).flat()
 }
 
 export async function copyFile(
@@ -478,6 +485,7 @@ export async function copyFiles(
   deleteSrc = false,
 ) {
   const files = await listFolder(event, src, isPrivate)
+  if (!files.length) throw createError({ statusCode: 404, message: 'File not found' })
   const normalizedSrc = removeRoot(getSecurePath(src, isPrivate), isPrivate)
   const normalizedDest = removeRoot(getSecurePath(dest, isPrivate), isPrivate)
   return Promise.all(
@@ -514,11 +522,13 @@ function invalidPath() {
   return createError({ statusCode: 400, message: 'Invalid path' })
 }
 
-function appendFilename(path: string, filename?: string) {
+function getUploadPath(path: string, isPrivate: boolean, filename?: string) {
+  const isFolder = path.endsWith('/')
+  path = getSecurePath(path, isPrivate)
   if (!filename) return path
   if (filename.includes('..')) throw invalidPath()
   filename = cleanFilename(filename)
-  if (/[^/]\.[^.]+$/.test(path) || basename(path) === filename) return path
+  if (!isFolder && (/[^/]\.[^.]+$/.test(path) || basename(path) === filename)) return path
   return join(path, filename)
 }
 
@@ -563,56 +573,60 @@ export const useS3 = () => {
   return s3Client
 }
 
+export function getCacheControl(isPrivate: boolean, maxAge?: number) {
+  if (maxAge === 0) return 'no-store, no-cache'
+  if (isPrivate) return `private, max-age=${maxAge || 3600}`
+  return `public, max-age=${maxAge || 31536000}`
+}
+
+export function parseMaxAge(value?: string) {
+  if (!value) return undefined
+  const maxAge = Number(value)
+  if (!Number.isInteger(maxAge) || maxAge < 0) {
+    throw createError({ statusCode: 400, message: 'Invalid maxAge' })
+  }
+  return maxAge
+}
+
 export async function uploadToS3(
   key: string,
   body: Buffer,
   contentType: string,
-  cache = 'public, max-age=31536000',
+  cache?: string,
   isPrivate = true,
 ) {
   const client = useS3()
   if (!client) return null
 
   const config = useRuntimeConfig()
+  cache ||= getCacheControl(isPrivate)
 
-  if (isPrivate) {
-    await client.send(
-      new PutObjectCommand({
-        Bucket: config.s3.privateBucket,
-        Key: key,
-        Body: body,
-        ContentType: contentType,
-        CacheControl: cache || 'public, max-age=31536000',
-      }),
-    )
-
-    return getS3SignedUrl(key)
-  }
   await client.send(
     new PutObjectCommand({
-      Bucket: config.s3.publicBucket,
+      Bucket: isPrivate ? config.s3.privateBucket : config.s3.publicBucket,
       Key: key,
       Body: body,
       ContentType: contentType,
-      CacheControl: cache || 'public, max-age=31536000',
-      ACL: 'public-read',
+      CacheControl: cache,
+      ACL: isPrivate ? undefined : 'public-read',
     }),
   )
 
-  return getS3URL(key)
+  return isPrivate ? getFileURL(key) : getS3URL(key)
 }
 
 export async function uploadStreamToS3(
   key: string,
   body: Readable,
   contentType: string,
-  cache = 'public, max-age=31536000',
+  cache?: string,
   isPrivate = true,
 ) {
   const client = useS3()
   if (!client) return null
 
   const config = useRuntimeConfig()
+  cache ||= getCacheControl(isPrivate)
   const partSize = 5 * 1024 * 1024 // S3 minimum, only the last part may be smaller
 
   let uploadId: string | undefined
@@ -680,7 +694,7 @@ export async function initMultipartUploadToS3(
     Bucket: isPrivate ? config.s3.privateBucket : config.s3.publicBucket,
     Key: key,
     ContentType: contentType,
-    CacheControl: cache,
+    CacheControl: cache || getCacheControl(isPrivate),
     ACL: isPrivate ? undefined : 'public-read',
   })
 
@@ -734,7 +748,7 @@ export async function completeMultipartUploadToS3(
   })
 
   await client.send(command)
-  return isPrivate ? getS3SignedUrl(key) : getS3URL(key)
+  return isPrivate ? getFileURL(key) : getS3URL(key)
 }
 
 export async function deleteFromS3(path: string, isPrivate = true) {
@@ -800,17 +814,15 @@ export async function listFromS3(path: string, isPrivate = true) {
     )
     ContinuationToken = response.NextContinuationToken
     files.push(
-      ...(await Promise.all(
-        (response.Contents || [])
-          .filter((item) => item.Key === path || item.Key?.startsWith(`${path}/`))
-          .map(async (item) => ({
-            path: removeRoot(item.Key || '', isPrivate),
-            name: item.Key?.split('/').pop() || '',
-            url: isPrivate ? await getS3SignedUrl(item.Key || '') : getS3URL(item.Key || ''),
-            updatedAt: item.LastModified ?? new Date(0),
-            size: item.Size || 0,
-          })),
-      )),
+      ...(response.Contents || [])
+        .filter((item) => item.Key === path || item.Key?.startsWith(`${path}/`))
+        .map((item) => ({
+          path: removeRoot(item.Key || '', isPrivate),
+          name: item.Key?.split('/').pop() || '',
+          url: isPrivate ? getFileURL(item.Key || '') : getS3URL(item.Key || ''),
+          updatedAt: item.LastModified ?? new Date(0),
+          size: item.Size || 0,
+        })),
     )
   } while (ContinuationToken)
 
@@ -829,6 +841,7 @@ export async function copyFromS3(src: string, dest: string, isPrivate = true, de
       Bucket: bucket,
       Key: dest,
       CopySource: copySource,
+      ACL: isPrivate ? undefined : 'public-read',
     }),
   )
   if (deleteSrc) {

package/layers/base/server/utils/rateLimit.ts

@@ -1,4 +1,5 @@
 import type { H3Event } from 'h3'
+import { isIPv6 } from 'node:net'
 
 export interface RateLimitRule {
   limit: number // max requests per window
@@ -24,7 +25,31 @@ setInterval(() => {
 async function getId(event: H3Event): Promise<string> {
   const { user } = await getUserSession(event)
   if (user) return user.id
-  return getClientIP(event)
+  return rateLimitIP(getClientIP(event))
+}
+
+// An IPv6 client usually holds a whole /64, so counting single addresses would let it rotate
+// through 2^64 of them. Count the /64 instead, and IPv4-mapped addresses as their IPv4.
+export function rateLimitIP(ip: string): string {
+  const address = ip.split('%')[0]!.toLowerCase() // drop the zone id
+  if (!isIPv6(address)) return ip
+
+  const mapped = address.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)
+  if (mapped) return mapped[1]!
+
+  // an embedded IPv4 tail fills the last two groups
+  const toGroups = (part: string) =>
+    part ? part.split(':').flatMap((group) => (group.includes('.') ? ['0', '0'] : [group])) : []
+  const [head = '', tail] = address.split('::')
+  let groups = toGroups(head)
+  if (tail !== undefined) {
+    const tailGroups = toGroups(tail)
+    groups = [...groups, ...Array(8 - groups.length - tailGroups.length).fill('0'), ...tailGroups]
+  }
+  return `${groups
+    .slice(0, 4)
+    .map((group) => parseInt(group, 16).toString(16))
+    .join(':')}::/64`
 }
 
 export async function enforceRateLimit(

package/nuxt.config.ts

@@ -13,10 +13,7 @@ export default defineNuxtConfig({
         lang: 'en',
       },
       title: process.env.NUXT_PUBLIC_NAME,
-      link: [
-        { rel: 'icon', href: '/favicon.ico', sizes: '32x32' },
-        { rel: 'icon', type: 'image/svg+xml', href: '/logo.svg' },
-      ],
+      link: [{ rel: 'icon', href: '/favicon.ico', sizes: '32x32' }],
       meta: [{ name: 'theme-color', content: '#000000' }],
     },
   },
@@ -29,7 +26,7 @@ export default defineNuxtConfig({
     rateLimit: {
       routes: {
         // limit: max requests per IP, window: in seconds
-        '/api/log': { limit: 30, window: 60 },
+        '/api/log': { limit: 10, window: 3600 },
         '/api/auth/options': { limit: 10, window: 60 },
         '/api/auth/password': { limit: 5, window: 60 },
         '/api/auth/otp/get': { limit: 5, window: 900 },
@@ -38,6 +35,7 @@ export default defineNuxtConfig({
         '/api/auth/otp/verify': { limit: 10, window: 60 },
         '/api/auth/totp/verify': { limit: 10, window: 60 },
         '/api/auth/webauthn/authenticate': { limit: 10, window: 60 },
+        '/api/auth/webauthn/register': { limit: 10, window: 60 },
         '/api/auth/anonymous': { limit: 5, window: 3600 },
       },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxibase",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "description": "Nuxt layer with auth, files, logs and backups",
   "keywords": [
     "nuxt",
@@ -58,12 +58,12 @@
     "prepublishOnly": "pnpm lint && pnpm fmt:check && pnpm typecheck && pnpm test"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1146.0",
-    "@aws-sdk/s3-request-presigner": "^3.1146.0",
-    "@iconify-json/lucide": "^1.2.140",
-    "@nuxt/hints": "^1.1.4",
+    "@aws-sdk/client-s3": "^3.1154.0",
+    "@aws-sdk/s3-request-presigner": "^3.1154.0",
+    "@iconify-json/lucide": "^1.2.147",
+    "@nuxt/hints": "^1.1.5",
     "@nuxt/icon": "^2.5.1",
-    "@pinia/nuxt": "^1.0.2",
+    "@pinia/nuxt": "^1.0.3",
     "@simplewebauthn/browser": "^11.0.0",
     "@simplewebauthn/server": "^11.0.0",
     "@types/nodemailer": "^8.0.2",
@@ -71,24 +71,25 @@
     "@types/qrcode": "^1.5.6",
     "drizzle-orm": "1.0.0-rc.3",
     "goku-css": "^9.0.8",
-    "nodemailer": "^9.1.1",
-    "nuxt-auth-utils": "^0.5.30",
-    "nuxt-i18n-micro": "^3.30.0",
+    "mime": "^4.1.1",
+    "nodemailer": "^10.1.7",
+    "nuxt-auth-utils": "^0.5.32",
+    "nuxt-i18n-micro": "^3.30.1",
     "otplib": "^13.5.0",
     "pg": "^8.23.1",
-    "pinia": "^4.0.3",
+    "pinia": "^4.1.0",
     "qrcode": "^1.5.4",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "drizzle-kit": "1.0.0-rc.3",
     "drizzle-seed": "1.0.0-rc.3",
     "maxibase": "link:.",
-    "nuxt": "^4.6.0",
+    "nuxt": "^4.6.2",
     "oxfmt": "^0.72.0",
-    "oxlint": "^1.87.0",
+    "oxlint": "^1.89.0",
     "typescript": "^5.9.3",
-    "vitest": "^5.0.3",
-    "vue-tsc": "^3.3.12"
+    "vitest": "^5.0.5",
+    "vue-tsc": "^3.3.13"
   }
 }