audit fix

app/lib/auth.ts

@@ -58,8 +58,10 @@ export async function getAuthServer(
           cloudflareEnv.GOOGLE_CLIENT_SECRET,
       },
     },
-    experimental: {
-      joins: true,
+    advanced: {
+      database: {
+        joins: true,
+      },
     },
     onAPIError: {
       customizeDefaultErrorPage: {

eslint.config.mjs

@@ -1,6 +1,5 @@
 import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
 import nextTypescript from "eslint-config-next/typescript";
-import reactHooks from "eslint-plugin-react-hooks";
 
 const eslintConfig = [
   {
@@ -16,7 +15,6 @@ const eslintConfig = [
   ...nextCoreWebVitals,
   ...nextTypescript,
   {
-    plugins: { "react-hooks": reactHooks },
     rules: {
       // Next.jsのデフォルト設定を上書き
       "@typescript-eslint/no-unused-vars": [
@@ -27,6 +25,8 @@ const eslintConfig = [
           ignoreRestSiblings: true,
         },
       ],
+      "react-hooks/refs": "warn",
+      "react-hooks/set-state-in-effect": "warn",
     },
   },
 ];

package.json

@@ -28,76 +28,76 @@
     "test": "node --import tsx/esm --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@better-auth/drizzle-adapter": "^1.6.23",
+    "@better-auth/drizzle-adapter": "^1.7.5",
     "@floating-ui/react": "^0.27.20",
-    "@fontsource-variable/inconsolata": "^5.2.7",
-    "@fontsource/m-plus-rounded-1c": "^5.2.9",
-    "@google/genai": "^1.21.0",
-    "@opennextjs/cloudflare": "^1.19.9",
-    "@sentry/nextjs": "^10.47.0",
-    "@sentry/vercel-edge": "^10.47.0",
+    "@fontsource-variable/inconsolata": "^5.3.0",
+    "@fontsource/m-plus-rounded-1c": "^5.3.0",
+    "@google/genai": "^1.52.0",
+    "@opennextjs/cloudflare": "^1.20.6",
+    "@sentry/nextjs": "^10.74.0",
+    "@sentry/vercel-edge": "^10.74.0",
     "@xterm/addon-fit": "^0.11.0",
-    "@xterm/xterm": "^6.1.0-beta.168",
-    "ace-builds": "^1.43.2",
-    "better-auth": "^1.6.23",
-    "chalk": "^5.5.0",
+    "@xterm/xterm": "6.1.0-beta.168",
+    "ace-builds": "^1.44.0",
+    "better-auth": "^1.7.5",
+    "chalk": "^5.6.2",
     "clsx": "^2.1.1",
-    "dotenv": "^17.2.3",
+    "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
-    "js-yaml": "^4.1.1",
-    "mocha": "^11.7.4",
-    "next": "^16.2.11",
-    "next-license-list": "^1.0.0",
-    "pg": "^8.16.3",
+    "js-yaml": "^4.3.2",
+    "mocha": "^11.8.0",
+    "next": "^16.3.5",
+    "next-license-list": "^1.0.1",
+    "pg": "^8.23.0",
     "prismjs": "^1.30.0",
-    "react": "^19",
-    "react-ace": "^14.0.1",
+    "react": "^19.3.0",
+    "react-ace": "^14.1.0",
     "react-children-utilities": "^2.10.0",
-    "react-dom": "^19",
+    "react-dom": "^19.3.0",
     "react-markdown": "^10.1.0",
-    "react-syntax-highlighter": "^16.1.0",
+    "react-syntax-highlighter": "^16.1.1",
     "remark-cjk-friendly": "^1.2.3",
     "remark-gfm": "^4.0.1",
     "remark-remove-comments": "^1.1.1",
-    "swr": "^2.3.6",
+    "swr": "^2.5.1",
     "unist-util-remove": "^4.0.0",
     "unist-util-visit": "^5.1.0",
-    "zod": "^4.0.17"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
     "@my-code/runtime": "workspace:*",
     "@pyodide/webpack-plugin": "^1.4.0",
-    "@tailwindcss/postcss": "^4",
+    "@tailwindcss/postcss": "^4.3.3",
     "@types/js-yaml": "^4.0.9",
     "@types/mdast": "^4.0.4",
     "@types/mocha": "^10.0.10",
-    "@types/node": "^20",
+    "@types/node": "^20.19.43",
     "@types/pako": "^2.0.4",
-    "@types/pg": "^8.15.5",
-    "@types/prismjs": "^1.26.5",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
+    "@types/pg": "^8.23.1",
+    "@types/prismjs": "^1.26.6",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "@types/react-syntax-highlighter": "^15.5.13",
-    "@typescript/vfs": "^1.6.2",
-    "daisyui": "^5.7.13",
-    "drizzle-kit": "^0.31.5",
-    "eslint": "^9",
-    "eslint-config-next": "^16.2.6",
-    "eslint-plugin-react-hooks": "^7.0.1",
+    "@typescript/vfs": "^1.6.4",
+    "daisyui": "^5.7.38",
+    "drizzle-kit": "^0.31.10",
+    "eslint": "^9.39.5",
+    "eslint-config-next": "^16.2.11",
+    "eslint-plugin-react-hooks": "7.0.1",
     "fonteditor-core": "^2.6.3",
     "mdast-util-phrasing": "^4.1.0",
-    "pako": "^2.1.0",
-    "prettier": "^3.6.2",
-    "prisma": "^6.18.0",
-    "pyodide": "^0.29.0",
+    "pako": "^2.2.0",
+    "prettier": "^3.9.6",
+    "prisma": "^6.19.3",
+    "pyodide": "^0.29.4",
     "remark-parse": "^11.0.0",
     "remark-stringify": "^11.0.0",
-    "tailwindcss": "^4",
-    "tsx": "^4.20.6",
+    "tailwindcss": "^4.3.3",
+    "tsx": "^4.23.13",
     "typescript": "5.9.3",
     "unified": "^11.0.5",
     "unsandbox": "^1.0.0",
     "webpack-license-plugin": "^4.5.1",
-    "wrangler": "^4.27.0"
+    "wrangler": "^4.132.0"
   }
 }

packages/jsEval/package.json

@@ -14,7 +14,7 @@
   },
   "devDependencies": {
     "@types/object-inspect": "^1.13.0",
-    "tsx": "^4",
-    "typescript": "^5"
+    "tsx": "^4.23.13",
+    "typescript": "^5.9.3"
   }
 }

packages/jsEval/src/console.ts

@@ -1,8 +1,7 @@
 import inspect from "object-inspect";
 
 export type ConsoleOutput =
-  | { type: "stdout"; message: string }
-  | { type: "stderr"; message: string };
+  { type: "stdout"; message: string } | { type: "stderr"; message: string };
 
 export type ConsoleEmitter = (output: ConsoleOutput) => void;
 

packages/jsEval/tsconfig.json

@@ -1,7 +1,7 @@
 {
   "compilerOptions": {
     "target": "ES2022",
-    "module": "NodeNext",
+    "module": "ESNext",
     "moduleResolution": "bundler",
     "strict": true,
     "esModuleInterop": true,

packages/runtime/package.json

@@ -11,30 +11,30 @@
   },
   "dependencies": {
     "@my-code/js-eval": "workspace:*",
-    "@ruby/wasm-wasi": "^2.7.2",
-    "@typescript/vfs": "^1.6.2",
+    "@ruby/wasm-wasi": "^2.10.1",
+    "@typescript/vfs": "^1.6.4",
     "async-mutex": "^0.5.0",
-    "chai": "^6.2.0",
+    "chai": "^6.2.2",
     "comlink": "^4.4.2",
     "object-inspect": "^1.13.4",
-    "pyodide": "^0.29.0",
-    "react": "^19",
-    "react-dom": "^19",
-    "swr": "^2",
-    "typescript": "^5",
-    "zod": "^4.0.17"
+    "pyodide": "^0.29.4",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "swr": "^2.5.1",
+    "typescript": "^5.9.3",
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@testing-library/dom": "^10.0.0",
-    "@testing-library/react": "^16.3.2",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/react": "^16.3.3",
     "@types/chai": "^5.2.3",
     "@types/object-inspect": "^1.13.0",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
-    "@vitejs/plugin-react": "^5.1.4",
-    "@vitest/browser-webdriverio": "^4.1.10",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^5.2.0",
+    "@vitest/browser-webdriverio": "^4.1.11",
     "dotenv": "^17.4.2",
-    "vitest": "^4.1.10",
-    "webdriverio": "^9.29.1"
+    "vitest": "^4.1.11",
+    "webdriverio": "^9.31.9"
   }
 }

packages/runtime/src/languages.ts

@@ -35,12 +35,7 @@ export type MarkdownLang =
   | "txt";
 
 export type RuntimeLang =
-  | "python"
-  | "ruby"
-  | "cpp"
-  | "rust"
-  | "javascript"
-  | "typescript";
+  "python" | "ruby" | "cpp" | "rust" | "javascript" | "typescript";
 
 export type LangConstants = {
   originalLang: MarkdownLang | undefined;

packages/runtime/src/worker/jsEval.worker.ts

@@ -26,7 +26,9 @@ self.console = {
   }),
 };
 
-async function init(/*_interruptBuffer?: Uint8Array*/): Promise<{
+async function init(
+  /*_interruptBuffer?: Uint8Array*/
+): Promise<{
   capabilities: WorkerCapabilities;
 }> {
   // Initialize the worker and report capabilities

packages/runtime/src/worker/pyodide.worker.ts

@@ -18,8 +18,7 @@ const HOME = `/home/pyodide`;
 let pyodide: PyodideInterface;
 let pendingOutputPromise: Promise<void>[] = [];
 let currentOutputCallback:
-  | ((output: ReplOutput | UpdatedFile) => Promise<void>)
-  | null = null;
+  ((output: ReplOutput | UpdatedFile) => Promise<void>) | null = null;
 
 // Helper function to read all files from the Pyodide file system
 function readAllFiles(): Record<string, string> {

packages/runtime/src/worker/ruby.worker.ts

@@ -18,8 +18,7 @@ import eval_code_rb from "./ruby/eval_code.rb?raw";
 
 let rubyVM: RubyVM | null = null;
 let currentOutputCallback:
-  | ((output: ReplOutput | UpdatedFile) => Promise<void>)
-  | null = null;
+  ((output: ReplOutput | UpdatedFile) => Promise<void>) | null = null;
 let stdoutBuffer = "";
 let stderrBuffer = "";
 
@@ -57,7 +56,9 @@ async function handleBatchOutput(
   return buffer;
 }
 
-async function init(/*_interruptBuffer?: Uint8Array*/): Promise<{
+async function init(
+  /*_interruptBuffer?: Uint8Array*/
+): Promise<{
   capabilities: WorkerCapabilities;
 }> {
   // interruptBuffer is not used for Ruby (restart-based interruption)