chore(deps): take four majors, fix the aes-gcm and typescript blockers

[dlukt]

Closes out six of the seven majors Dependabot surfaced once the open-pull-requests-limit backlog drained. Replaces #35, #36, #38, #39 and #40, and explains why #37 stays closed.

Taken as-is

	from	to	PR
sqlx	0.8.6	0.9.0	#38
sha2	0.10.9	0.11.0	#40
marked	17.0.6	18.0.12	#36
jsdom	28.1.0	30.1.1	#35

#39 aes-gcm 0.11 — was red on a deprecation, not a break

Array::from_slice is deprecated in favour of TryFrom, and clippy -D warnings turns that into a failure. Two call sites in recovery_email_service.rs:

• the encrypt side holds a [u8; 12], so it uses Nonce::from
• the decrypt side holds a decoded Vec<u8>, so Nonce::try_from now enforces the 12-byte length that an explicit len() != 12 check used to cover — same error message, one less branch

#37 typescript 7.0.2 — stays closed, but it exposed a config bug

svelte-check@4.7.6 peers typescript@^5.0.0 || ^6.0.0, so TS 7 cannot resolve and npm ci ERESOLVEs. The real defect was in dependabot.yml: the svelte-toolchain group's own comment says "svelte-check pins svelte + typescript", but typescript was never in its patterns. That omission is why this opened as a solo PR instead of moving in lockstep. Added it, so typescript can only move alongside a svelte-check that accepts it. (TS 6 satisfies the peer range, so this isn't permanently stuck.)

jsdom needed more than a bump

#35 is green only because its lockfile happens to pin 30.0.1. The declared range is ^30.0.1, so the next npm install drifts to 30.1.x — where this happens:

jsdom 30.0.1 → URL.createObjectURL(file) = "blob:nodedata:29843b07-…"
jsdom 30.1.0 → THREW: Cannot read properties of undefined (reading '_buffer')

With that throwing, previewUrl stays null and the avatar preview in ProfileSettingsView silently never renders. Merging #35 as-is would have planted a failure that appears on an unrelated future install.

Fixed by stubbing createObjectURL/revokeObjectURL in src/test/setup.ts — the component only needs a string for img.src, so the suite no longer depends on jsdom's blob-URL internals either way.

One thing worth a look while you're here: the test that caught this asserts

expect(getByRole('img', { name: 'Avatar preview' })).toBeInTheDocument()

which passes whether or not the preview rendered — the {:else} fallback <div> carries the same role="img" and aria-label="Avatar preview". Only the subsequent "Remove selected image" button assertion actually proves anything. Not changed here, but that assertion is weaker than it looks.

Verification

• server — cargo fmt --check, cargo clippy -- -D warnings, 401 tests, cargo audit all clean
• client — npm run lint, npm run check (0 errors / 274 files), 294 tests, npm run build, npm audit all clean

Left open

#41 webrtc 0.17 → 0.20. Three 0.x majors at once and the API de-async'd (Result<usize, Error> is not a future at voice_channel.rs:93 and :97). That's a real migration in the least test-covered part of the codebase, and it deserves its own change rather than riding along in a dependency sweep.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.