svelteesp32 2.3.2 → 2.4.0

package/README.md

@@ -88,6 +88,10 @@ void setup() {
 
 ## What's New
 
+- **v2.4.0** — `--analyze` for CI size budget checks (per-file table, exits 1 on over-budget); `--manifest` to write a companion JSON manifest alongside the header
+- **v2.3.3** — TypeScript 6 upgrade; `module`/`moduleResolution` updated to `Node16`, target raised to `ES2023`
+- **v2.3.2** — Security hardening: symlink traversal blocked, RC file CWD warning, absolute `outputfile` rejected in RC files, per-file 50 MB size limit
+- **v2.3.1** — Fixes: `--version` and `--basepath` input validation, `formatConfiguration` newline safety
 - **v2.3.0** — `--cachetime-html` and `--cachetime-assets` for per-type cache control (e.g. `no-cache` for HTML, 1-year for content-hashed JS/CSS)
 - **v2.2.0** — SPA routing catch-all (`--spa`) for client-side routers on all four engines
 - **v2.1.0** — New Arduino WebServer engine (`-e webserver`), dependency updates
@@ -241,10 +245,10 @@ The generated header file includes everything your ESP needs:
 #include <PsychicHttp.h>
 #include <PsychicHttpsServer.h>
 
-const uint8_t datagzip_assets_index_KwubEIf__js[12547] = {0x1f, 0x8b, 0x8, 0x0, ...
-const uint8_t datagzip_assets_index_Soe6cpLA_css[5368] = {0x1f, 0x8b, 0x8, 0x0, 0x0, ...
-const char * etag_assets_index_KwubEIf__js = "387b88e345cc56ef9091...";
-const char * etag_assets_index_Soe6cpLA_css = "d4f23bc45ef67890ab12...";
+static const uint8_t datagzip_assets_index_KwubEIf__js[12547] = {0x1f, 0x8b, 0x8, 0x0, ...
+static const uint8_t datagzip_assets_index_Soe6cpLA_css[5368] = {0x1f, 0x8b, 0x8, 0x0, 0x0, ...
+static const char etag_assets_index_KwubEIf__js[] = "387b88e345cc56ef9091...";
+static const char etag_assets_index_Soe6cpLA_css[] = "d4f23bc45ef67890ab12...";
 
 // File manifest for runtime introspection
 struct SVELTEESP32_FileInfo {
@@ -424,6 +428,63 @@ What gets generated per engine:
 
 **Note:** `--spa` requires `index.html` or `index.htm` in the source directory — a warning is printed if it is missing.
 
+### Analyze Mode (CI Size Budget Checks)
+
+Use `--analyze` in CI to validate firmware size budgets without producing any output file:
+
+```bash
+npx svelteesp32 -e psychic -s ./dist --maxsize=400k --maxgzipsize=150k --analyze
+```
+
+Sample output:
+
+```
+index.html                           Original  Gzip
+──────────────────────────────────── ────────  ────────
+assets/index-KwubEIf-.js             37.9kB    12.3kB
+assets/index-Soe6cpLA.css            31.7kB    5.2kB
+favicon.png                          32.5kB    32.5kB  [no gzip]
+index.html                           0.5kB     0.3kB
+────────────────────────────────────────────────────────
+Total                                102.6kB   50.3kB
+Budget (maxsize)                     400.0kB   -         ✓ PASS
+Budget (maxgzipsize)                 -         150.0kB   ✓ PASS
+```
+
+Exits with code **1** if any budget is exceeded — CI fails automatically. Mutually exclusive with `--dryrun`.
+
+### JSON Manifest
+
+Add `--manifest` to write a companion `.manifest.json` file alongside the header (same directory, same base name):
+
+```bash
+npx svelteesp32 -e psychic -s ./dist -o ./esp32/svelteesp32.h --manifest
+# also writes ./esp32/svelteesp32.manifest.json
+```
+
+The manifest records build metadata and per-file details for tooling and dashboards:
+
+```json
+{
+  "generated": "2026-04-26T12:00:00.000Z",
+  "engine": "psychic",
+  "etag": "false",
+  "gzip": "true",
+  "filecount": 4,
+  "size": 104960,
+  "gzipSize": 51507,
+  "files": [
+    {
+      "path": "/assets/index-KwubEIf-.js",
+      "mime": "text/javascript",
+      "size": 38850,
+      "gzipSize": 12547,
+      "isGzip": true
+    }
+  ]
+}
+```
+
 ### C++ Build-Time Validation
 
 Catch configuration issues at compile time with generated defines:
@@ -473,28 +534,31 @@ Called for every response (200 = content served, 304 = cache hit).
 
 ## CLI Reference
 
-| Option               | Description                                          | Default                 |
-| -------------------- | ---------------------------------------------------- | ----------------------- |
-| `-s`                 | Source folder with compiled web files                | (required)              |
-| `-e`                 | Web server engine (psychic/async/espidf/webserver)   | `psychic`               |
-| `-o`                 | Output header file path                              | `svelteesp32.h`         |
-| `--etag`             | ETag caching (true/false/compiler)                   | `false`                 |
-| `--gzip`             | Gzip compression (true/false/compiler)               | `true`                  |
-| `--exclude`          | Exclude files by glob pattern                        | (none)                  |
-| `--basepath`         | URL prefix for all routes                            | (none)                  |
-| `--maxsize`          | Max total uncompressed size (e.g., `400k`, `1m`)     | (none)                  |
-| `--maxgzipsize`      | Max total gzip size (e.g., `150k`, `500k`)           | (none)                  |
-| `--cachetime`        | Cache-Control max-age in seconds (all files)         | `0`                     |
-| `--cachetime-html`   | max-age for HTML files (overrides `--cachetime`)     | (unset)                 |
-| `--cachetime-assets` | max-age for non-HTML files (overrides `--cachetime`) | (unset)                 |
-| `--version`          | Version string in header                             | (none)                  |
-| `--define`           | C++ define prefix                                    | `SVELTEESP32`           |
-| `--espmethod`        | Init function name                                   | `initSvelteStaticFiles` |
-| `--config`           | Custom RC file path                                  | `.svelteesp32rc.json`   |
-| `--dryrun`           | Show route table + summary without writing output    | `false`                 |
-| `--spa`              | Serve index.html for unmatched routes (SPA routing)  | `false`                 |
-| `--noindexcheck`     | Skip index.html validation                           | `false`                 |
-| `-h`                 | Show help                                            |                         |
+| Option               | Description                                                                            | Default                 |
+| -------------------- | -------------------------------------------------------------------------------------- | ----------------------- |
+| `-s`                 | Source folder with compiled web files                                                  | (required)              |
+| `-e`                 | Web server engine (psychic/async/espidf/webserver)                                     | `psychic`               |
+| `-o`                 | Output header file path                                                                | `svelteesp32.h`         |
+| `--etag`             | ETag caching (true/false/compiler)                                                     | `false`                 |
+| `--gzip`             | Gzip compression (true/false/compiler)                                                 | `true`                  |
+| `--created`          | Include creation timestamp in header                                                   | `false`                 |
+| `--exclude`          | Exclude files by glob pattern                                                          | (none)                  |
+| `--basepath`         | URL prefix for all routes                                                              | (none)                  |
+| `--maxsize`          | Max total uncompressed size (e.g., `400k`, `1m`)                                       | (none)                  |
+| `--maxgzipsize`      | Max total gzip size (e.g., `150k`, `500k`)                                             | (none)                  |
+| `--cachetime`        | Cache-Control max-age in seconds (all files)                                           | `0`                     |
+| `--cachetime-html`   | max-age for HTML files (overrides `--cachetime`)                                       | (unset)                 |
+| `--cachetime-assets` | max-age for non-HTML files (overrides `--cachetime`)                                   | (unset)                 |
+| `--version`          | Version string in header                                                               | (none)                  |
+| `--define`           | C++ define prefix                                                                      | `SVELTEESP32`           |
+| `--espmethod`        | Init function name                                                                     | `initSvelteStaticFiles` |
+| `--config`           | Custom RC file path                                                                    | `.svelteesp32rc.json`   |
+| `--dryrun`           | Show route table + summary without writing output                                      | `false`                 |
+| `--analyze`          | Print per-file size table and budget status, no output written; exits 1 if over budget | `false`                 |
+| `--manifest`         | Write companion `.manifest.json` alongside the header                                  | `false`                 |
+| `--spa`              | Serve index.html for unmatched routes (SPA routing)                                    | `false`                 |
+| `--noindexcheck`     | Skip index.html validation                                                             | `false`                 |
+| `-h`                 | Show help                                                                              |                         |
 
 ---
 
@@ -518,7 +582,9 @@ Store your settings in `.svelteesp32rc.json` for zero-argument builds:
   "cachetimeassets": 31536000,
   "noindexcheck": false,
   "dryrun": false,
-  "spa": false
+  "analyze": false,
+  "spa": false,
+  "manifest": false
 }
 ```
 

package/dist/commandLine.d.ts

@@ -17,7 +17,9 @@ interface ICopyFilesArguments {
     maxGzipSize?: number;
     noIndexCheck?: boolean;
     dryRun?: boolean;
+    analyze?: boolean;
     spa?: boolean;
+    manifest?: boolean;
     help?: boolean;
 }
 interface IRcFileConfig {
@@ -39,7 +41,9 @@ interface IRcFileConfig {
     maxgzipsize?: number | string;
     noindexcheck?: boolean;
     dryrun?: boolean;
+    analyze?: boolean;
     spa?: boolean;
+    manifest?: boolean;
 }
 declare function validateCppIdentifier(value: string, name: string): string;
 declare function parseSize(value: string, name: string): number;

package/dist/commandLine.js

@@ -25,7 +25,7 @@ Configuration:
 Options:
   -e, --engine <value>       The engine for which the include file is created
                              (psychic|async|espidf|webserver) (default: "psychic")
-  -s, --sourcepath <path>    Source dist folder contains compiled web files (required)
+  -s, --sourcepath <path>    Source dist folder with compiled web files (required)
   -o, --outputfile <path>    Generated output file with path (default: "svelteesp32.h")
   --etag <value>             Use ETAG header for cache (true|false|compiler) (default: "false")
   --gzip <value>             Compress content with gzip (true|false|compiler) (default: "true")
@@ -42,8 +42,10 @@ Options:
   --maxsize <size>           Maximum total uncompressed size (e.g., 400k, 1.5m, 409600)
   --maxgzipsize <size>       Maximum total gzip size (e.g., 150k, 1m, 153600)
   --dryrun                   Show summary without writing the output file (default: false)
+  --analyze                  Print per-file size table and budget status without writing (default: false)
   --spa                      Serve index.html for unmatched routes (SPA routing) (default: false)
-  -h, --help                 Shows this help
+  --manifest                 Write companion JSON manifest file alongside the header (default: false)
+  -h, --help                 Show this help
 
 RC File:
   The tool searches for .svelteesp32rc.json in:
@@ -218,7 +220,7 @@ function interpolateNpmVariables(config, rcFilePath) {
     const packageJson = parsePackageJson(packageJsonPath);
     const interpolateString = (value) => {
         const regex = /\$npm_package_[\dA-Za-z]+(?:_[a-z][\dA-Za-z]*)*/g;
-        return value.replace(regex, (match) => getNpmPackageVariable(packageJson, match) ?? match);
+        return value.replaceAll(regex, (match) => getNpmPackageVariable(packageJson, match) ?? match);
     };
     const result = { ...config };
     if (result.sourcepath)
@@ -287,7 +289,9 @@ function validateRcConfig(config, rcPath) {
         'maxgzipsize',
         'noindexcheck',
         'dryrun',
-        'spa'
+        'analyze',
+        'spa',
+        'manifest'
     ]);
     for (const key of Object.keys(configObject))
         if (!validKeys.has(key))
@@ -333,8 +337,12 @@ function validateRcConfig(config, rcPath) {
         throw new TypeError(`Invalid noindexcheck in RC file: ${configObject['noindexcheck']} (must be boolean)`);
     if (configObject['dryrun'] !== undefined && typeof configObject['dryrun'] !== 'boolean')
         throw new TypeError(`Invalid dryrun in RC file: ${configObject['dryrun']} (must be boolean)`);
+    if (configObject['analyze'] !== undefined && typeof configObject['analyze'] !== 'boolean')
+        throw new TypeError(`Invalid analyze in RC file: ${configObject['analyze']} (must be boolean)`);
     if (configObject['spa'] !== undefined && typeof configObject['spa'] !== 'boolean')
         throw new TypeError(`Invalid spa in RC file: ${configObject['spa']} (must be boolean)`);
+    if (configObject['manifest'] !== undefined && typeof configObject['manifest'] !== 'boolean')
+        throw new TypeError(`Invalid manifest in RC file: ${configObject['manifest']} (must be boolean)`);
     if (configObject['outputfile'] !== undefined && node_path_1.default.isAbsolute(configObject['outputfile']))
         throw new Error(`'outputfile' in RC file must be a relative path (use --output CLI flag for absolute paths): ${configObject['outputfile']}`);
     return configObject;
@@ -409,8 +417,12 @@ function parseArguments() {
         result.noIndexCheck = rcConfig.noindexcheck;
     if (rcConfig.dryrun !== undefined)
         result.dryRun = rcConfig.dryrun;
+    if (rcConfig.analyze !== undefined)
+        result.analyze = rcConfig.analyze;
     if (rcConfig.spa !== undefined)
         result.spa = rcConfig.spa;
+    if (rcConfig.manifest !== undefined)
+        result.manifest = rcConfig.manifest;
     if (rcConfig.exclude && rcConfig.exclude.length > 0)
         result.exclude = [...rcConfig.exclude];
     const cliExclude = [];
@@ -513,10 +525,18 @@ function parseArguments() {
             result.dryRun = true;
             continue;
         }
+        if (argument === '--analyze') {
+            result.analyze = true;
+            continue;
+        }
         if (argument === '--spa') {
             result.spa = true;
             continue;
         }
+        if (argument === '--manifest') {
+            result.manifest = true;
+            continue;
+        }
         if (argument.startsWith('-') && !argument.startsWith('--')) {
             const flag = argument.slice(1);
             const nextArgument = arguments_[index + 1];
@@ -557,6 +577,8 @@ function parseArguments() {
         console.error('Error: --sourcepath is required (can be specified in RC file or CLI)');
         showHelp();
     }
+    if (result.dryRun && result.analyze)
+        throw new Error('--analyze and --dryrun are mutually exclusive. Use --analyze for CI budget checks or --dryrun for a developer route preview.');
     return result;
 }
 function formatConfiguration(cmdLine) {
@@ -588,6 +610,8 @@ function formatConfiguration(cmdLine) {
         parts.push(`maxGzipSize=${cmdLine.maxGzipSize}`);
     if (cmdLine.spa)
         parts.push(`spa=${cmdLine.spa}`);
+    if (cmdLine.analyze)
+        parts.push(`analyze=${cmdLine.analyze}`);
     if (cmdLine.exclude.length > 0)
         parts.push(`exclude=[${cmdLine.exclude.join(', ')}]`);
     return parts.join(' ').replace(/[\n\r]/g, ' ');

package/dist/cppCode.js

@@ -990,7 +990,7 @@ const postProcessCppCode = (code) => code
     .filter(Boolean)
     .map((line) => (line === '//' ? '' : line))
     .join('\n')
-    .replace(/\n{2,}/g, '\n');
+    .replaceAll(/\n{2,}/g, '\n');
 const createHandlebarsHelpers = () => {
     let switchValue;
     return {

package/dist/index.d.ts

@@ -1,10 +1,17 @@
 import { CppCodeSource, CppCodeSources, ExtensionGroups } from './cppCode';
+type ProcessingSummary = {
+    filecount: number;
+    size: number;
+    gzipsize: number;
+};
 declare const shouldUseGzip: (originalSize: number, compressedSize: number) => boolean;
 declare const calculateCompressionRatio: (originalSize: number, compressedSize: number) => number;
 declare const formatCompressionLog: (filename: string, padding: string, originalSize: number, compressedSize: number, useGzip: boolean) => string;
 declare const formatSize: (bytes: number) => string;
+declare const formatSizePrecise: (bytes: number) => string;
 declare const createSourceEntry: (filename: string, dataname: string, content: Buffer, contentGzip: Buffer, mimeType: string, sha256: string, isGzip: boolean) => CppCodeSource;
 declare const updateExtensionGroup: (filesByExtension: ExtensionGroups, extension: string) => void;
 declare const formatDryRunRoutes: (sources: CppCodeSources, engine: "psychic" | "async" | "espidf" | "webserver", basePath: string, spa: boolean) => string;
+declare const formatAnalyzeTable: (sources: CppCodeSources, summary: ProcessingSummary, maxSize: number | undefined, maxGzipSize: number | undefined) => string;
 export declare function main(): void;
-export { calculateCompressionRatio, createSourceEntry, formatCompressionLog, formatDryRunRoutes, formatSize, shouldUseGzip, updateExtensionGroup };
+export { calculateCompressionRatio, createSourceEntry, formatAnalyzeTable, formatCompressionLog, formatDryRunRoutes, formatSize, formatSizePrecise, shouldUseGzip, updateExtensionGroup };

package/dist/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateExtensionGroup = exports.shouldUseGzip = exports.formatSize = exports.formatDryRunRoutes = exports.formatCompressionLog = exports.createSourceEntry = exports.calculateCompressionRatio = void 0;
+exports.updateExtensionGroup = exports.shouldUseGzip = exports.formatSizePrecise = exports.formatSize = exports.formatDryRunRoutes = exports.formatCompressionLog = exports.formatAnalyzeTable = exports.createSourceEntry = exports.calculateCompressionRatio = void 0;
 exports.main = main;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
@@ -35,6 +35,12 @@ const formatSize = (bytes) => {
     return `${Math.round(bytes / 1024)}kB`;
 };
 exports.formatSize = formatSize;
+const formatSizePrecise = (bytes) => {
+    if (bytes < 1024)
+        return `${bytes}B`;
+    return `${(bytes / 1024).toFixed(1)}kB`;
+};
+exports.formatSizePrecise = formatSizePrecise;
 const createSourceEntry = (filename, dataname, content, contentGzip, mimeType, sha256, isGzip) => ({
     filename,
     dataname,
@@ -94,6 +100,39 @@ const formatDryRunRoutes = (sources, engine, basePath, spa) => {
         .join('\n');
 };
 exports.formatDryRunRoutes = formatDryRunRoutes;
+const formatAnalyzeTable = (sources, summary, maxSize, maxGzipSize) => {
+    const rows = sources.map((s) => ({
+        file: s.filename,
+        orig: formatSizePrecise(s.content.length),
+        gzip: formatSizePrecise(s.isGzip ? s.contentGzip.length : s.content.length),
+        tag: s.isGzip ? '' : '[no gzip]'
+    }));
+    const fileWidth = Math.max(4, ...rows.map((r) => r.file.length), 'Total'.length);
+    const origWidth = Math.max(8, ...rows.map((r) => r.orig.length), formatSizePrecise(summary.size).length);
+    const gzipWidth = Math.max(8, ...rows.map((r) => r.gzip.length), formatSizePrecise(summary.gzipsize).length);
+    const separator = `${'─'.repeat(fileWidth)}  ${'─'.repeat(origWidth)}  ${'─'.repeat(gzipWidth)}`;
+    const header = `${'File'.padEnd(fileWidth)}  ${'Original'.padEnd(origWidth)}  ${'Gzip'.padEnd(gzipWidth)}`;
+    const dataRows = rows.map((r) => {
+        const tagPart = r.tag ? `  ${r.tag}` : '';
+        return `${r.file.padEnd(fileWidth)}  ${r.orig.padEnd(origWidth)}  ${r.gzip.padEnd(gzipWidth)}${tagPart}`.trimEnd();
+    });
+    const totalOrig = formatSizePrecise(summary.size);
+    const totalGzip = formatSizePrecise(summary.gzipsize);
+    const totalRow = `${'Total'.padEnd(fileWidth)}  ${totalOrig.padEnd(origWidth)}  ${totalGzip.padEnd(gzipWidth)}`;
+    const lines = [header, separator, ...dataRows, separator, totalRow];
+    if (maxSize !== undefined) {
+        const pass = summary.size <= maxSize;
+        const budgetRow = `${'Budget (maxsize)'.padEnd(fileWidth)}  ${formatSizePrecise(maxSize).padEnd(origWidth)}  ${'-'.padEnd(gzipWidth)}  ${pass ? '✓ PASS' : '✗ FAIL'}`;
+        lines.push(budgetRow);
+    }
+    if (maxGzipSize !== undefined) {
+        const pass = summary.gzipsize <= maxGzipSize;
+        const budgetRow = `${'Budget (maxgzipsize)'.padEnd(fileWidth)}  ${'-'.padEnd(origWidth)}  ${formatSizePrecise(maxGzipSize).padEnd(gzipWidth)}  ${pass ? '✓ PASS' : '✗ FAIL'}`;
+        lines.push(budgetRow);
+    }
+    return lines.join('\n');
+};
+exports.formatAnalyzeTable = formatAnalyzeTable;
 function main() {
     const summary = {
         filecount: 0,
@@ -138,6 +177,14 @@ function main() {
     }
     console.log('');
     filesByExtension.sort((left, right) => left.extension.localeCompare(right.extension));
+    if (commandLine_1.cmdLine.analyze) {
+        console.log(formatAnalyzeTable(sources, summary, commandLine_1.cmdLine.maxSize, commandLine_1.cmdLine.maxGzipSize));
+        const overBudget = (commandLine_1.cmdLine.maxSize !== undefined && summary.size > commandLine_1.cmdLine.maxSize) ||
+            (commandLine_1.cmdLine.maxGzipSize !== undefined && summary.gzipsize > commandLine_1.cmdLine.maxGzipSize);
+        if (overBudget)
+            process.exit(1);
+        return;
+    }
     if (commandLine_1.cmdLine.maxSize !== undefined && summary.size > commandLine_1.cmdLine.maxSize) {
         console.error((0, errorMessages_1.getSizeBudgetExceededError)('size', commandLine_1.cmdLine.maxSize, summary.size));
         process.exit(1);
@@ -161,6 +208,27 @@ function main() {
     (0, node_fs_1.writeFileSync)(commandLine_1.cmdLine.outputfile, cppFile, { flush: true, encoding: 'utf8' });
     console.log(`${summary.filecount} files, ${formatSize(summary.size)} original size, ${formatSize(summary.gzipsize)} gzip size`);
     console.log(`${commandLine_1.cmdLine.outputfile} ${formatSize(cppFile.length)} size`);
+    if (commandLine_1.cmdLine.manifest) {
+        const manifestPath = node_path_1.default.join(node_path_1.default.dirname(commandLine_1.cmdLine.outputfile), node_path_1.default.basename(commandLine_1.cmdLine.outputfile, node_path_1.default.extname(commandLine_1.cmdLine.outputfile)) + '.manifest.json');
+        const manifest = {
+            generated: new Date().toISOString(),
+            engine: commandLine_1.cmdLine.engine,
+            etag: commandLine_1.cmdLine.etag,
+            gzip: commandLine_1.cmdLine.gzip,
+            filecount: summary.filecount,
+            size: summary.size,
+            gzipSize: summary.gzipsize,
+            files: sources.map((s) => ({
+                path: s.filename,
+                mime: s.mime,
+                size: s.content.length,
+                gzipSize: s.isGzip ? s.contentGzip.length : s.content.length,
+                isGzip: s.isGzip
+            }))
+        };
+        (0, node_fs_1.writeFileSync)(manifestPath, JSON.stringify(manifest, undefined, 2), { encoding: 'utf8' });
+        console.log(`${manifestPath} manifest written`);
+    }
     if (commandLine_1.cmdLine.engine === 'psychic' || commandLine_1.cmdLine.engine === 'espidf')
         console.log('\n' + (0, errorMessages_1.getMaxUriHandlersHint)(commandLine_1.cmdLine.engine, sources.length, commandLine_1.cmdLine.espmethod));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelteesp32",
-  "version": "2.3.2",
+  "version": "2.4.0",
   "description": "Convert Svelte (or any frontend) JS application to serve it from ESP32 webserver (PsychicHttp)",
   "author": "BCsabaEngine",
   "license": "ISC",
@@ -62,27 +62,27 @@
     "@eslint/eslintrc": "^3.3.5",
     "@eslint/js": "^10.0.1",
     "@types/mime-types": "^3.0.1",
-    "@types/node": "^25.5.0",
-    "@types/picomatch": "^4.0.2",
-    "@typescript-eslint/eslint-plugin": "^8.57.2",
-    "@typescript-eslint/parser": "^8.57.2",
-    "@vitest/coverage-v8": "^4.1.2",
-    "eslint": "^10.1.0",
+    "@types/node": "^25.6.0",
+    "@types/picomatch": "^4.0.3",
+    "@typescript-eslint/eslint-plugin": "^8.59.0",
+    "@typescript-eslint/parser": "^8.59.0",
+    "@vitest/coverage-v8": "^4.1.5",
+    "eslint": "^10.2.1",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-simple-import-sort": "^12.1.1",
+    "eslint-plugin-simple-import-sort": "^13.0.0",
     "eslint-plugin-unicorn": "^64.0.0",
-    "memfs": "^4.57.1",
+    "memfs": "^4.57.2",
     "nodemon": "^3.1.14",
-    "prettier": "^3.8.1",
+    "prettier": "^3.8.3",
     "ts-node": "^10.9.2",
     "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.2"
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.5"
   },
   "dependencies": {
     "handlebars": "^4.7.9",
     "mime-types": "^3.0.2",
     "picomatch": "^4.0.4",
-    "tinyglobby": "^0.2.15"
+    "tinyglobby": "^0.2.16"
   }
 }