chore(deps): upgrade all dependencies; next 16.4.3 (RCE fix); v0.16.4

.nixpacks/Dockerfile

@@ -20,7 +20,7 @@ RUN --mount=type=cache,id=diskpush-pnpm-store,target=/root/.local/share/pnpm/sto
   pnpm install --frozen-lockfile --prod=false --filter @diskpush/web...
 RUN pnpm --filter @diskpush/web build
 
-FROM oven/bun:1.4.0-slim AS runtime
+FROM oven/bun:1.4.4-slim AS runtime
 WORKDIR /app
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=3000
 # Docker sets HOSTNAME to the container id, and standalone binds to it literally.

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/cli",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "bin": {
     "diskpush": "./dist/bin.js"
@@ -25,9 +25,9 @@
     "@diskpush/s3-core": "workspace:*",
     "@diskpush/schemas": "workspace:*",
     "@diskpush/ssh-core": "workspace:*",
-    "@profullstack/hqtui": "^0.5.1",
-    "@profullstack/readm3": "^0.3.0",
+    "@profullstack/hqtui": "^0.11.0",
+    "@profullstack/readm3": "^0.24.0",
     "@profullstack/text-type-detection": "^1.0.0",
-    "zod": "^3.24.1"
+    "zod": "^4.6.7"
   }
 }

apps/desktop/electron/main/icon-path.test.ts

@@ -39,15 +39,17 @@ describe('StartupWMClass', () => {
 
   it('is what electron-builder writes into the packaged entry', () => {
     const manifest = JSON.parse(readFileSync(join(root, 'apps', 'desktop', 'package.json'), 'utf8'))
-    expect(manifest.build.linux.desktop.StartupWMClass).toBe(WM_CLASS)
+    expect(manifest.build.linux.desktop.entry.StartupWMClass).toBe(WM_CLASS)
   })
 
-  it('is a flat map, which is the only shape electron-builder 25 reads', () => {
-    // `desktop: { entry: {...} }` is electron-builder 26 syntax. 25 stringifies
-    // the nested object, so the deb shipped `entry=[object Object]` and lost
-    // its Keywords without a warning.
+  it('sits under desktop.entry as flat strings, the shape electron-builder 26 reads', () => {
+    // electron-builder 26 rejects a flat `linux.desktop` map at schema
+    // validation; 25 instead stringified the nested object, so the deb shipped
+    // `entry=[object Object]` and lost its Keywords without a warning. The
+    // builder version and this shape have to move together.
     const manifest = JSON.parse(readFileSync(join(root, 'apps', 'desktop', 'package.json'), 'utf8'))
-    for (const value of Object.values(manifest.build.linux.desktop)) {
+    expect(Object.keys(manifest.build.linux.desktop)).toEqual(['entry'])
+    for (const value of Object.values(manifest.build.linux.desktop.entry)) {
       expect(typeof value).toBe('string')
     }
   })

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/desktop",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "private": true,
   "type": "module",
   "main": "dist-electron/main/index.js",
@@ -14,7 +14,7 @@
     "package": "electron-builder --linux AppImage deb"
   },
   "dependencies": {
-    "@base-ui/react": "^1.7.0",
+    "@base-ui/react": "^1.9.0",
     "@diskpush/database": "workspace:*",
     "@diskpush/fleet-core": "workspace:*",
     "@diskpush/plugin-api": "workspace:*",
@@ -27,24 +27,24 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "lucide-react": "^1.35.0",
-    "shadcn": "^4.19.0",
-    "tailwind-merge": "^3.6.0",
+    "lucide-react": "^1.61.0",
+    "shadcn": "^4.22.1",
+    "tailwind-merge": "^3.7.0",
     "tw-animate-css": "^1.4.0",
-    "zod": "^3.24.1"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@tailwindcss/postcss": "^4.1.13",
-    "@types/react": "^19.1.0",
-    "@types/react-dom": "^19.1.0",
-    "electron": "^33.2.0",
-    "electron-builder": "^25.1.8",
-    "esbuild": "^0.25.0",
-    "next": "^15.5.4",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0",
-    "tailwindcss": "^4.1.13",
-    "typescript": "^5.7.3"
+    "@tailwindcss/postcss": "^4.3.3",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "electron": "^45.0.0",
+    "electron-builder": "^26.18.0",
+    "esbuild": "^0.28.2",
+    "next": "^16.4.3",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "tailwindcss": "^4.3.3",
+    "typescript": "^7.0.2"
   },
   "build": {
     "appId": "com.profullstack.diskpush",
@@ -89,8 +89,10 @@
       ],
       "icon": "resources/icons",
       "desktop": {
-        "Keywords": "rsync;sftp;ssh;sync;transfer;backup;",
-        "StartupWMClass": "DiskPush"
+        "entry": {
+          "Keywords": "rsync;sftp;ssh;sync;transfer;backup;",
+          "StartupWMClass": "DiskPush"
+        }
       },
       "artifactName": "${productName}-${version}-linux-${arch}.${ext}"
     },

apps/desktop/tsconfig.json

@@ -6,7 +6,7 @@
       "dom.iterable",
       "ES2022"
     ],
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "module": "esnext",
     "moduleResolution": "bundler",
     "strict": true,
@@ -37,7 +37,8 @@
     "out/types/**/*.ts",
     "src/**/*.ts",
     "src/**/*.tsx",
-    ".next/types/**/*.ts"
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
   ],
   "exclude": [
     "node_modules",

apps/web/app/sitemap.ts

@@ -40,7 +40,7 @@ async function committed(path: string): Promise<Date | null> {
 
 async function touched(path: string): Promise<Date | null> {
   try {
-    return (await stat(join(ROOT, path))).mtime
+    return (await stat(join(/*turbopackIgnore: true*/ ROOT, path))).mtime
   } catch {
     return null
   }

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/web",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "private": true,
   "type": "module",
   "scripts": {
@@ -11,17 +11,17 @@
   },
   "dependencies": {
     "@profullstack/footer": "latest",
-    "@profullstack/x402-gateway": "^0.11.0",
-    "marked": "^15.0.7",
-    "next": "^15.5.4",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0"
+    "@profullstack/x402-gateway": "^0.13.1",
+    "marked": "^18.1.1",
+    "next": "^16.4.3",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1"
   },
   "devDependencies": {
-    "@tailwindcss/postcss": "^4.1.13",
-    "@types/react": "^19.1.0",
-    "@types/react-dom": "^19.1.0",
-    "tailwindcss": "^4.1.13",
-    "typescript": "^5.7.3"
+    "@tailwindcss/postcss": "^4.3.3",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "tailwindcss": "^4.3.3",
+    "typescript": "^7.0.2"
   }
 }

apps/web/middleware.ts → apps/web/proxy.ts

@@ -1,7 +1,7 @@
 import { gate } from "@/lib/crawl-gateway";
 import { NextResponse, type NextRequest } from "next/server";
 
-export async function middleware(request: NextRequest) {
+export async function proxy(request: NextRequest) {
   // The status page's health probe skips the crawl gateway.
   if (request.nextUrl.pathname === "/api/health") return NextResponse.next();
   // Crawl gateway first: AI training crawlers get 402 Payment Required (or the

apps/web/tsconfig.json

@@ -6,7 +6,7 @@
       "dom.iterable",
       "ES2022"
     ],
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "module": "esnext",
     "moduleResolution": "bundler",
     "strict": true,
@@ -32,7 +32,8 @@
     "next-env.d.ts",
     "**/*.ts",
     "**/*.tsx",
-    ".next/types/**/*.ts"
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
   ],
   "exclude": [
     "node_modules"

package.json

@@ -17,10 +17,10 @@
     "smoke:desktop": "node scripts/smoke-desktop.mjs"
   },
   "devDependencies": {
-    "@types/node": "^24.3.0",
-    "typescript": "^5.7.3",
-    "vitest": "^3.0.5",
+    "@diskpush/rsync-core": "workspace:*",
     "@diskpush/schemas": "workspace:*",
-    "@diskpush/rsync-core": "workspace:*"
+    "@types/node": "^24.19.2",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.5"
   }
 }

packages/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/database",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@diskpush/schemas": "workspace:*",
-    "@libsql/client": "^0.15.4",
-    "zod": "^3.24.1"
+    "@libsql/client": "^0.18.0",
+    "zod": "^4.6.7"
   }
 }

packages/fleet-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/fleet-core",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -21,6 +21,6 @@
     "@diskpush/rsync-core": "workspace:*",
     "@diskpush/schemas": "workspace:*",
     "@diskpush/ssh-core": "workspace:*",
-    "zod": "^3.24.1"
+    "zod": "^4.6.7"
   }
 }

packages/plugin-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/plugin-api",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/plugin-dbbackup/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/plugin-dbbackup",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "DiskPush plugin: dump Postgres, Supabase, MySQL/MariaDB and SQLite databases to tagged, verified, gzipped files, prune them, push them anywhere rsync reaches, and restore them.",
   "license": "MIT",
   "type": "module",

packages/plugin-mediaanalyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/plugin-mediaanalyzer",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/rsync-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/rsync-core",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -20,6 +20,6 @@
   "dependencies": {
     "@diskpush/s3-core": "workspace:*",
     "@diskpush/schemas": "workspace:*",
-    "zod": "^3.24.1"
+    "zod": "^4.6.7"
   }
 }

packages/s3-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/s3-core",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/schemas/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/schemas",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -18,6 +18,6 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "zod": "^3.24.1"
+    "zod": "^4.6.7"
   }
 }

packages/schemas/src/profile.ts

@@ -45,8 +45,8 @@ export const SyncProfileSchema = z.object({
    */
   sourcePane: z.enum(['left', 'right']).default('left'),
   trustDeletes: z.boolean().default(false),
-  schedule: ScheduleSchema.default({}),
-  watch: WatchSchema.default({}),
+  schedule: ScheduleSchema.prefault({}),
+  watch: WatchSchema.prefault({}),
   notifyOnSuccess: z.boolean().default(false),
   notifyOnFailure: z.boolean().default(true),
   createdAt: z.string(),

packages/ssh-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/ssh-core",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -20,9 +20,9 @@
   "dependencies": {
     "@diskpush/rsync-core": "workspace:*",
     "@diskpush/schemas": "workspace:*",
-    "ssh2": "^1.16.0"
+    "ssh2": "^1.17.0"
   },
   "devDependencies": {
-    "@types/ssh2": "^1.15.5"
+    "@types/ssh2": "^1.15.6"
   }
 }