chore: update all dependencies (#1209)

* chore: update all dependencies

* chore: remove lint errors

* fix(client): restore typecheck after dependency bump

vitest 4 types vi.fn() as Mock<Procedure | Constructable>, which no
longer assigns to the strictly-typed onUpdate prop; type the mock
explicitly. TS6 + the new transitive @types/node 25 stopped auto-
including node builtin module types, so import('node:buffer') failed;
add @types/node as a direct client devDependency and a scoped node
type reference in the one test that needs it.

* test: fix constructor mocks for vitest 4 Reflect.construct semantics

vitest 4 resolves new-invoked mocks via Reflect.construct, which rejects
arrow-function implementations (including mockReturnValue sugar) as
non-constructable. Convert mapbox-gl and better-sqlite3 mocks that the
code instantiates with new to regular function implementations.

server/package.json

@@ -94,11 +94,11 @@
     "@types/unzipper": "^0.10.11",
     "@types/uuid": "^10.0.0",
     "@types/ws": "^8.18.1",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^4.1.9",
     "nodemon": "^3.1.0",
     "supertest": "^7.2.2",
     "tz-lookup": "^6.1.25",
     "unplugin-swc": "^1.5.9",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.9"
   }
 }

server/src/services/airtrail/airtrailSync.ts

@@ -1,10 +1,9 @@
+import { ADDON_IDS } from '../../addons';
 import { db } from '../../db/database';
-import { logError, logInfo } from '../auditLog';
 import { broadcast } from '../../websocket';
 import { isAddonEnabled } from '../adminService';
-import { ADDON_IDS } from '../../addons';
+import { logError, logInfo } from '../auditLog';
 import { getReservation, getReservationWithJoins, updateReservation } from '../reservationService';
-import { getAirtrailCredentials } from './airtrailService';
 import {
   AirtrailAuthError,
   AirtrailCreds,
@@ -15,6 +14,7 @@ import {
   saveFlight,
 } from './airtrailClient';
 import { canonicalHash, mapFlightToReservation } from './airtrailMapper';
+import { getAirtrailCredentials } from './airtrailService';
 
 /** Global on/off: the addon must be enabled and sync not explicitly turned off. */
 export function syncGloballyEnabled(): boolean {
@@ -59,7 +59,7 @@ async function syncOwner(uid: number): Promise<number> {
     if (err instanceof AirtrailAuthError) logError(`AirTrail sync: invalid API key for user ${uid}`);
     return 0;
   }
-  const byId = new Map(flights.map(f => [String(f.id), f]));
+  const byId = new Map(flights.map((f) => [String(f.id), f]));
 
   const linked = db
     .prepare(
@@ -145,15 +145,15 @@ function splitLocal(dt: string | null | undefined): { date: string | null; time:
 }
 
 function buildSavePayload(reservation: any, existing: AirtrailFlightRaw): AirtrailSavePayload | null {
-  let meta: Record<string, any> = {};
+  let meta: Record<string, any>;
   try {
     meta = reservation.metadata ? JSON.parse(reservation.metadata) : {};
   } catch {
     meta = {};
   }
   const endpoints: any[] = reservation.endpoints || [];
-  const fromEp = endpoints.find(e => e.role === 'from');
-  const toEp = endpoints.find(e => e.role === 'to');
+  const fromEp = endpoints.find((e) => e.role === 'from');
+  const toEp = endpoints.find((e) => e.role === 'to');
   const fromCode = fromEp?.code || existing.from?.iata || existing.from?.icao || null;
   const toCode = toEp?.code || existing.to?.iata || existing.to?.icao || null;
   if (!fromCode || !toCode) return null;
@@ -164,7 +164,7 @@ function buildSavePayload(reservation: any, existing: AirtrailFlightRaw): Airtra
 
   // Preserve the existing seat manifest (an update replaces all seats); fall back
   // to the key-owner placeholder so AirTrail attributes it to the connecting user.
-  const seats = (existing.seats ?? []).map(s => ({
+  const seats = (existing.seats ?? []).map((s) => ({
     userId: s.userId,
     guestName: s.guestName,
     seat: s.seat,
@@ -179,7 +179,7 @@ function buildSavePayload(reservation: any, existing: AirtrailFlightRaw): Airtra
   // a userId), leaving any co-passenger seats untouched.
   const seatNumber = typeof meta.seat === 'string' && meta.seat.trim() ? meta.seat.trim() : null;
   if (seatNumber) {
-    const ownSeat = seats.find(s => s.userId) ?? seats[0];
+    const ownSeat = seats.find((s) => s.userId) ?? seats[0];
     if (ownSeat) ownSeat.seatNumber = seatNumber;
   }
 

server/src/services/placePhotoCache.ts

@@ -1,9 +1,10 @@
-import path from 'node:path';
+import { db } from '../db/database';
+
+import { Jimp, JimpMime } from 'jimp';
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import fsPromises from 'node:fs/promises';
-import crypto from 'node:crypto';
-import { Jimp, JimpMime } from 'jimp';
-import { db } from '../db/database';
+import path from 'node:path';
 
 // Overridable for tests (mirrors the TREK_DB_FILE seam) so the suite never touches
 // the real uploads tree.
@@ -26,7 +27,9 @@ const knownOnDisk = new Set<string>();
 // Ensure upload dir exists once at startup — avoids sync FS calls inside put() on every write.
 try {
   fs.mkdirSync(GOOGLE_PHOTO_DIR, { recursive: true });
-} catch { /* already exists */ }
+} catch {
+  /* already exists */
+}
 
 function filePath(placeId: string): string {
   // Hash to avoid filename collisions — coords:lat:lng pseudo-IDs contain characters that
@@ -46,9 +49,9 @@ interface CachedPhoto {
 }
 
 export function get(placeId: string): CachedPhoto | null {
-  const row = db.prepare(
-    'SELECT attribution FROM google_place_photo_meta WHERE place_id = ? AND error_at IS NULL'
-  ).get(placeId) as { attribution: string | null } | undefined;
+  const row = db
+    .prepare('SELECT attribution FROM google_place_photo_meta WHERE place_id = ? AND error_at IS NULL')
+    .get(placeId) as { attribution: string | null } | undefined;
 
   if (!row) return null;
 
@@ -68,9 +71,9 @@ export function get(placeId: string): CachedPhoto | null {
 }
 
 export function getErrored(placeId: string): boolean {
-  const row = db.prepare(
-    'SELECT error_at FROM google_place_photo_meta WHERE place_id = ? AND error_at IS NOT NULL'
-  ).get(placeId) as { error_at: number } | undefined;
+  const row = db
+    .prepare('SELECT error_at FROM google_place_photo_meta WHERE place_id = ? AND error_at IS NOT NULL')
+    .get(placeId) as { error_at: number } | undefined;
 
   if (!row) return false;
   return Date.now() - row.error_at < ERROR_TTL;
@@ -79,7 +82,7 @@ export function getErrored(placeId: string): boolean {
 export function markError(placeId: string): void {
   knownOnDisk.delete(placeId);
   db.prepare(
-    'INSERT OR REPLACE INTO google_place_photo_meta (place_id, attribution, fetched_at, error_at) VALUES (?, NULL, ?, ?)'
+    'INSERT OR REPLACE INTO google_place_photo_meta (place_id, attribution, fetched_at, error_at) VALUES (?, NULL, ?, ?)',
   ).run(placeId, Date.now(), Date.now());
 }
 
@@ -109,21 +112,28 @@ export async function put(placeId: string, bytes: Buffer, attribution: string |
   knownOnDisk.add(placeId);
 
   db.prepare(
-    'INSERT OR REPLACE INTO google_place_photo_meta (place_id, attribution, fetched_at, error_at) VALUES (?, ?, ?, NULL)'
+    'INSERT OR REPLACE INTO google_place_photo_meta (place_id, attribution, fetched_at, error_at) VALUES (?, ?, ?, NULL)',
   ).run(placeId, attribution, Date.now());
 
   return { photoUrl: proxyUrl(placeId), filePath: fp, attribution };
 }
 
-export function getInFlight(placeId: string): Promise<{ filePath: string; attribution: string | null } | null> | undefined {
+export function getInFlight(
+  placeId: string,
+): Promise<{ filePath: string; attribution: string | null } | null> | undefined {
   return inFlight.get(placeId);
 }
 
-export function setInFlight(placeId: string, promise: Promise<{ filePath: string; attribution: string | null } | null>): void {
+export function setInFlight(
+  placeId: string,
+  promise: Promise<{ filePath: string; attribution: string | null } | null>,
+): void {
   inFlight.set(placeId, promise);
   promise
     .finally(() => inFlight.delete(placeId))
-    .catch(() => { /* awaiter logs; this .catch only prevents unhandledRejection */ });
+    .catch(() => {
+      /* awaiter logs; this .catch only prevents unhandledRejection */
+    });
 }
 
 export function serveFilePath(placeId: string): string | null {
@@ -138,14 +148,18 @@ export function serveFilePath(placeId: string): string | null {
 // Google place_id (the dedup key) or by the stable proxy URL stored in image_url
 // (covers coords: pseudo-ids, which never have a google_place_id).
 function isReferenced(placeId: string): boolean {
-  const row = db.prepare(
-    'SELECT 1 FROM places WHERE google_place_id = ? OR image_url = ? LIMIT 1'
-  ).get(placeId, proxyUrl(placeId));
+  const row = db
+    .prepare('SELECT 1 FROM places WHERE google_place_id = ? OR image_url = ? LIMIT 1')
+    .get(placeId, proxyUrl(placeId));
   return !!row;
 }
 
 function deleteEntry(placeId: string): void {
-  try { fs.unlinkSync(filePath(placeId)); } catch { /* already gone */ }
+  try {
+    fs.unlinkSync(filePath(placeId));
+  } catch {
+    /* already gone */
+  }
   db.prepare('DELETE FROM google_place_photo_meta WHERE place_id = ?').run(placeId);
   knownOnDisk.delete(placeId);
 }
@@ -175,11 +189,20 @@ export function sweepOrphans(): number {
 
   // Pass 2: files on disk that no surviving meta row maps to (e.g. left over from a
   // crash between writeFile and the DB upsert, or a meta row deleted out-of-band).
-  let entries: string[] = [];
-  try { entries = fs.readdirSync(GOOGLE_PHOTO_DIR); } catch { entries = []; }
+  let entries: string[];
+  try {
+    entries = fs.readdirSync(GOOGLE_PHOTO_DIR);
+  } catch {
+    entries = [];
+  }
   for (const entry of entries) {
     if (!entry.endsWith('.jpg') || keepFiles.has(entry)) continue;
-    try { fs.unlinkSync(path.join(GOOGLE_PHOTO_DIR, entry)); removed++; } catch { /* race */ }
+    try {
+      fs.unlinkSync(path.join(GOOGLE_PHOTO_DIR, entry));
+      removed++;
+    } catch {
+      /* race */
+    }
   }
 
   return removed;

server/tests/unit/services/backupService.test.ts

@@ -769,7 +769,9 @@ describe('BACKUP-042 restoreFromZip — integrity check fails', () => {
       }),
       close: vi.fn(),
     };
-    DatabaseMock.mockReturnValue(fakeDbInstance);
+    DatabaseMock.mockImplementation(function () {
+      return fakeDbInstance;
+    });
 
     const result = await restoreFromZip('/data/tmp/upload.zip');
 
@@ -803,7 +805,9 @@ describe('BACKUP-043 restoreFromZip — missing required table', () => {
         }),
       close: vi.fn(),
     };
-    DatabaseMock.mockReturnValue(fakeDbInstance);
+    DatabaseMock.mockImplementation(function () {
+      return fakeDbInstance;
+    });
 
     const result = await restoreFromZip('/data/tmp/upload.zip');
 
@@ -827,7 +831,7 @@ describe('BACKUP-044 restoreFromZip — Database constructor throws (invalid SQL
     );
     fsMock.rmSync.mockReturnValue(undefined);
 
-    DatabaseMock.mockImplementation(() => {
+    DatabaseMock.mockImplementation(function () {
       throw new Error('file is not a database');
     });
 
@@ -862,7 +866,9 @@ describe('BACKUP-045 restoreFromZip — full success path (no uploads)', () => {
         }),
       close: vi.fn(),
     };
-    DatabaseMock.mockReturnValue(fakeDbInstance);
+    DatabaseMock.mockImplementation(function () {
+      return fakeDbInstance;
+    });
     return fakeDbInstance;
   }
 
@@ -997,7 +1003,9 @@ describe('BACKUP-046 restoreFromZip — with uploads directory', () => {
         }),
       close: vi.fn(),
     };
-    DatabaseMock.mockReturnValue(fakeDbInstance);
+    DatabaseMock.mockImplementation(function () {
+      return fakeDbInstance;
+    });
 
     fsMock.existsSync.mockImplementation((p: string) => {
       // travel.db present, extractedUploads present
@@ -1052,7 +1060,9 @@ describe('BACKUP-046 restoreFromZip — with uploads directory', () => {
         }),
       close: vi.fn(),
     };
-    DatabaseMock.mockReturnValue(fakeDbInstance);
+    DatabaseMock.mockImplementation(function () {
+      return fakeDbInstance;
+    });
 
     fsMock.existsSync.mockImplementation((p: string) => {
       if (String(p).endsWith('travel.db')) return true;