Merge branch 'main' into feat/claim-management

Author: cmintey

.env.example

@@ -8,4 +8,4 @@ DEFAULT_CURRENCY=USD
 # Set the logging level: trace | debug | info | warn | error | fatal | silent
 LOG_LEVEL=info
 # Maxinum image size that can be uploaded (in bytes)
-MAX_IMAGE_SIZE=5000000
+MAX_IMAGE_SIZE=5000000

.github/CONTRIBUTING.md

@@ -66,6 +66,12 @@ Please ensure:
 
 ---
 
+## Internationalization (I18n)
+
+Edit only the en.json file. All other language translations will be handled via Weblate. [See README's Translation section for more infomraiton](README.md#translations)
+
+---
+
 ## Issues & Discussions
 
 Before opening a new issue:

.github/workflows/build_push.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/build_test.yml

@@ -16,7 +16,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
               with:
                   fetch-depth: 0
 
@@ -35,15 +35,14 @@ jobs:
                   cache-from: type=gha
                   cache-to: type=gha,mode=max
 
-            - uses: pnpm/action-setup@v5
+            - uses: pnpm/action-setup@v6
               name: Install pnpm
               id: pnpm-install
               with:
-                  version: 10
                   run_install: false
 
             - name: Install Node.js
-              uses: actions/setup-node@v6
+              uses: actions/setup-node@v7
               with:
                   node-version: 24
 
@@ -53,7 +52,7 @@ jobs:
               run: |
                   echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
 
-            - uses: actions/cache@v5
+            - uses: actions/cache@v6
               name: Setup pnpm cache
               with:
                   path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}

.github/workflows/lint.yml

@@ -15,18 +15,17 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
 
             - name: Install Node.js
-              uses: actions/setup-node@v6
+              uses: actions/setup-node@v7
               with:
                   node-version: 24
 
-            - uses: pnpm/action-setup@v5
+            - uses: pnpm/action-setup@v6
               name: Install pnpm
               id: pnpm-install
               with:
-                  version: 10
                   run_install: false
 
             - name: Get pnpm store directory
@@ -35,7 +34,7 @@ jobs:
               run: |
                   echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
 
-            - uses: actions/cache@v5
+            - uses: actions/cache@v6
               name: Setup pnpm cache
               with:
                   path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}

DEVELOPMENT.md

@@ -2,8 +2,8 @@
 
 ## Prerequisites
 
-- node v24.x
-- [pnpm](https://pnpm.io/installation) v10.x
+- node v24.15.x
+- [pnpm](https://pnpm.io/installation) v11.x
 
 ## Install dependencies
 
@@ -15,19 +15,30 @@ pnpm install
 
 ### Create an env file
 
-An example env file for local development. You might want to customize the database URL to your needs:
+Copy `.env.example` to `.env`. The Prisma config (`prisma.config.ts`), the Prisma
+client, and SvelteKit all load `.env` automatically via `dotenv`.
 
 ```sh
-#.env.development
+cp .env.example .env
+```
+
+Database URL needs to be an **absolute** `file:` URL.
 
-export ORIGIN=http://localhost:3000
-export DATABASE_URL="file:$(pwd)//dev.db"
+```sh
+echo "DATABASE_URL=\"file:$(pwd)/prisma/dev.db\"" >> .env
 ```
 
 ### First Time Run
 
+Create the 'uploads' directory in the project root to store item images.
+
+```sh
+mkdir -p uploads
+```
+
+Setup Prisma ORM and development database:
+
 ```sh
-source .env.development
 pnpm prisma generate
 pnpm prisma migrate dev
 pnpm prisma db seed
@@ -65,6 +76,10 @@ docker build . --tag wishlist-dev:latest
 Specific platform, current linux/amd64 and linux/arm64 are confirmed supported
 
 ```sh
-docker build . --tag wishlist-dev:amd64  --platform linux/amd64
-docker build . --tag wishlist-dev:amd64  --platform linux/arm64
+docker build . --tag wishlist-dev:amd64 --platform linux/amd64
+docker build . --tag wishlist-dev:arm64 --platform linux/arm64
 ```
+
+## Internationalization (I18n)
+
+Edit only the en.json file. All other language translations will be handled via Weblate. [See README's Translation section for more infomraiton](README.md#translations)

Dockerfile

@@ -1,6 +1,6 @@
-FROM node:24-slim@sha256:d8e448a56fc63242f70026718378bd4b00f8c82e78d20eefb199224a4d8e33d8 AS base
+FROM node:24-slim@sha256:b31e7a42fdf8b8aa5f5ed477c72d694301273f1069c5a2f71d53c6482e99a2fc AS base
 WORKDIR /usr/src/app
-RUN npm install -g pnpm@latest-10
+RUN corepack enable
 
 # Build step
 FROM base AS build
@@ -30,7 +30,7 @@ RUN pnpm run build
 RUN pnpm prune --prod
 
 # Download Caddy from github
-FROM --platform=$BUILDPLATFORM alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS caddy
+FROM --platform=$BUILDPLATFORM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS caddy
 
 ARG TARGETPLATFORM
 ARG CADDY_VERSION=2.10.0
@@ -58,7 +58,7 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=caddy /caddy /usr/bin/caddy
-COPY ["package.json", "pnpm-lock.yaml", "entrypoint.sh", "prisma.config.ts", "Caddyfile", "./"]
+COPY ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", "entrypoint.sh", "prisma.config.ts", "Caddyfile", "./"]
 COPY ./templates/ ./templates
 COPY ./prisma/ ./prisma/
 

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest version of Wishlist is actively supported. Security patches will only be made available in the next version not back-ported to older versions.
+
+## Reporting a Vulnerability
+
+This repository has [private vulnerability reporting](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/privately-reporting-a-security-vulnerability) enabled. To confidentially report a security issue, click the **"Report a vulnerability"** button on the [Security tab](../../security/advisories/new) of this repository. This allows you to submit details directly to the maintainers without public disclosure.
+
+For non-sensitive issues or general feedback, feel free to open a GitHub issue or contribute a fix via pull request.

entrypoint.sh

@@ -8,5 +8,6 @@ caddy start --config /usr/src/app/Caddyfile
 
 pnpm prisma migrate deploy && \
 pnpm prisma db seed && \
-pnpm db:patch && \
-pnpm start
+pnpm db:patch
+
+exec pnpm start

package.json

@@ -30,8 +30,8 @@
         "@tailwindcss/forms": "^0.5.10",
         "@tailwindcss/vite": "^4.1.18",
         "@types/eslint": "^9.6.1",
-        "@types/node": "^24.12.0",
-        "@types/nodemailer": "^7.0.0",
+        "@types/node": "^24.13.2",
+        "@types/nodemailer": "^8.0.0",
         "@types/pulltorefreshjs": "^0.1.7",
         "@vite-pwa/sveltekit": "^1.0.0",
         "autoprefixer": "^10.4.21",
@@ -41,8 +41,8 @@
         "globals": "^17.0.0",
         "pino-pretty": "^13.1.1",
         "prettier": "^3.6.2",
-        "prettier-plugin-svelte": "^3.4.0",
-        "prettier-plugin-tailwindcss": "^0.7.2",
+        "prettier-plugin-svelte": "^4.0.0",
+        "prettier-plugin-tailwindcss": "^0.8.0",
         "pulltorefreshjs": "^0.1.22",
         "svelte": "^5.38.2",
         "svelte-check": "^4.3.1",
@@ -52,7 +52,7 @@
         "tailwindcss": "^4.1.18",
         "ts-node": "^10.9.2",
         "tslib": "^2.8.1",
-        "typescript": "^5.9.2",
+        "typescript": "^6.0.0",
         "typescript-eslint": "^8.40.0",
         "vite": "^8.0.0",
         "vite-plugin-pwa": "^1.0.2",
@@ -68,41 +68,31 @@
         "@paralleldrive/cuid2": "^3.0.0",
         "@prisma/adapter-better-sqlite3": "^7.1.0",
         "@prisma/client": "^7.1.0",
-        "@zxcvbn-ts/core": "^3.0.4",
-        "@zxcvbn-ts/language-common": "^3.0.4",
-        "@zxcvbn-ts/language-de": "^3.0.2",
-        "@zxcvbn-ts/language-en": "^3.0.2",
-        "@zxcvbn-ts/language-es-es": "^3.0.2",
-        "@zxcvbn-ts/language-fr": "^3.0.2",
+        "@zxcvbn-ts/core": "^4.0.0",
+        "@zxcvbn-ts/language-common": "^4.0.0",
+        "@zxcvbn-ts/language-de": "^4.0.0",
+        "@zxcvbn-ts/language-en": "^4.0.0",
+        "@zxcvbn-ts/language-es-es": "^4.0.0",
+        "@zxcvbn-ts/language-fr": "^4.0.0",
         "dotenv": "^17.2.3",
         "got-scraping": "^4.1.2",
         "handlebars": "^4.7.8",
         "metascraper": "^5.49.1",
         "metascraper-image": "^5.49.1",
         "metascraper-title": "^5.49.1",
-        "nodemailer": "^8.0.0",
+        "nodemailer": "^9.0.0",
         "openid-client": "^6.6.4",
         "pino": "^10.0.0",
         "prisma": "^7.1.0",
-        "sharp": "^0.34.3",
+        "sharp": "^0.35.0",
         "svelte-i18n": "^4.0.1",
         "svelte-virtuallists": "^1.4.2",
         "tsx": "^4.21.0",
         "zod": "^4.0.17"
     },
     "engines": {
         "node": "^24.0.0",
-        "pnpm": "^10"
+        "pnpm": "11.11.0"
     },
-    "pnpm": {
-        "onlyBuiltDependencies": [
-            "better-sqlite3",
-            "es5-ext",
-            "esbuild",
-            "prisma",
-            "re2",
-            "svelte-preprocess",
-            "@tailwindcss/oxide"
-        ]
-    }
+    "packageManager": "pnpm@11.11.0+sha512.4463f65fd80ed80d69bc1d4bf163ee94f605c7380fc318bb5b2ebe15f8cd12d49c51a4d59e951b401e764d3b6ca751cbf51bc50ed7001a6bcb4935e684c34882"
 }