Dependency updates for v2.10.0

[qwqcode]

No description provided.

[Copilot]

Pull request overview

This PR updates dependencies and build/release tooling for the v2.10.0 release, while also tightening several runtime behaviors (sanitization, voting, JWT, DB/TLS) and modernizing CI/release configuration.

Changes:

• Bump frontend/tooling dependencies across the monorepo (Vite, ESLint, TypeScript-ESLint, marked, katex, etc.) and update pnpm workspace rules/overrides.
• Replace the UI HTML sanitizer implementation with DOMPurify and add targeted sanitizer tests.
• Improve backend reliability/security: transactional vote updates, migrate JWT parsing to golang-jwt/jwt/v5, harden MySQL TLS config handling, and switch to CGO-free builds (including sqlite driver changes).

Reviewed changes

Copilot reviewed 35 out of 39 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
ui/plugin-kit/package.json	Bumps build/tooling dependencies for the plugin kit.
ui/plugin-katex/package.json	Updates katex/marked versions and broadens katex peer range.
ui/plugin-auth/package.json	Updates solid/vite plugin dev dependencies.
ui/eslint-plugin-artalk/package.json	Updates eslint/typescript-eslint/tsdown dependency versions.
ui/artalk/src/plugins/list/fetch.ts	Adapts list fetch handling to optional page in API response with stricter runtime check.
ui/artalk/src/lib/sanitizer.ts	Replaces insane sanitizer with DOMPurify + a second-pass attribute filter.
ui/artalk/src/lib/sanitizer.test.ts	Adds vitest coverage for sanitizer allow/deny behavior and former ReDoS payload.
ui/artalk/src/api/v2.ts	Regenerates swagger TS client output; adjusts typings and request/response formatting.
ui/artalk/package.json	Swaps sanitizer dependency to dompurify; updates marked; adjusts test command env.
ui/artalk-sidebar/typed-router.d.ts	Updates generated vue-router typing config/types.
ui/artalk-sidebar/package.json	Updates sidebar dependency versions (Vue, router, yaml, types, etc.).
test/app.go	Switches test sqlite driver import to github.com/libtnb/sqlite.
server/handler/vote.go	Adds input validation for VoteGet; refactors VoteCreate into transactional update helper.
server/handler/vote_test.go	Adds more VoteGet coverage + transaction rollback test for VoteCreate.
server/common/auth.go	Migrates JWT handling to jwt/v5 and improves algorithm validation/parsing flow.
server/common/auth_test.go	Adds unit tests for token creation, legacy claim parsing, alg validation, expiry.
scripts/fetch-registry.mjs	Hardens registry download (host allowlist, redirect limit, timeout, size cap).
scripts/check-npm-publish.mjs	Uses execFileSync for pnpm info; improves error handling and exit code behavior.
pnpm-workspace.yaml	Moves pnpm peer rules/overrides into workspace config; adds onlyBuiltDependencies.
package.json	Updates root tooling deps; removes embedded pnpm config (moved to workspace file).
Makefile	Sets CGO_ENABLED=0 for builds.
internal/sync/key_mutex_test.go	Makes mutex tests deterministic (channels instead of sleeps).
internal/email/queue_test.go	Makes queue tests deterministic; ensures cleanup via Close().
internal/db/open.go	Switches sqlite driver; refactors MySQL TLS config loading/registration.
internal/db/open_test.go	Adds tests validating MySQL TLS config construction and requirements.
internal/db/dsn.go	Adds conditional MySQL TLS mode selection for Cloud SQL cert configs.
internal/db/dsn_test.go	Adds DSN test coverage for Cloud SQL TLS mode.
internal/core/base.go	Prevents repeated mutation of process-global time.Local via one-time initializer.
internal/core/base_test.go	Adds concurrency tests for timezone initializer behavior.
go.sum	Updates Go module checksums after dependency upgrades.
go.mod	Updates Go/tooling deps; switches JWT module to v5; adds sqlite module; bumps Go version.
docs/swagger/swagger.yaml	Regenerated swagger spec (optional fields, added 400, updated descriptions).
docs/swagger/swagger.json	Regenerated swagger JSON (mirrors YAML changes).
docs/swagger/package.json	Updates swagger tooling and improves build-client formatting workflow.
docs/swagger/docs.go	Regenerated embedded swagger doc template output.
docs/landing/package.json	Updates landing site dependency versions.
docs/docs/package.json	Updates docs dependency versions (katex, vue).
Dockerfile	Bumps Go/alpine base images and removes build tool packages no longer needed.
cmd/base.go	Ensures config path is resolved from invocation dir before implicit data-dir chdir.
cmd/base_test.go	Adds tests for config-path resolution behavior.
.goreleaser.yml	Migrates config to GoReleaser v2 and aligns with CGO-free builds.
.github/workflows/test-frontend.yml	Updates GitHub Actions versions (checkout/setup-node/pnpm).
.github/workflows/test-docs.yml	Updates GitHub Actions versions (checkout/setup-node/pnpm).
.github/workflows/test-app.yml	Updates actions + enforces CGO_ENABLED=0 in CI.
.github/workflows/repo-dispatch.yml	Updates repository-dispatch action version.
.github/workflows/release.yml	Updates checkout/setup-node action versions.
.github/workflows/docs-cn.yml	Updates checkout/setup-node/pnpm action versions.
.github/workflows/codeql.yml	Updates checkout and CodeQL action versions.
.github/workflows/build-ui.yml	Updates checkout/setup-node/pnpm action versions.
.github/workflows/build-nightly.yml	Updates multiple action versions across nightly workflow.
.github/workflows/build-done.yml	Updates checkout action version.
.github/workflows/build-docker.yml	Updates Docker-related action versions.
.github/workflows/build-app.yml	Reworks release build to use setup-go/node/pnpm + GoReleaser action.
.github/actions/comment/action.yml	Updates github-script action version.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.