[narcisonunez]

Summary

Resolves the open Dependabot alerts in this repo and fixes 4 templates that don't parse under toml 4.x.

Dokploy is upgrading to toml 4.2.0 in Dokploy/dokploy#5517. Dokploy fetches template.toml from this repo at runtime (fetchTemplateFiles → templates.dokploy.com). This PR should be merged and deployed before #5517 ships. Otherwise those 4 templates will fail to parse in Dokploy.

app/: dependency bumps only

Package	Before	After	Alerts
react-router-dom / react-router	7.9.6	7.18.4	#19-21, #34-39, #47-50
vite	6.4.1	6.4.3	#30, #33, #44, #45
yaml	2.7.1	2.8.3	#25, #26
postcss (transitive)	8.5.3	8.5.28	#46, #51-53
nanoid (transitive)	3.3.9	3.3.19	#55, #56, #63
picomatch (transitive)	2.3.1 / 4.0.3	2.3.2 / 4.0.7	#23, #24, #31, #32
browserslist (transitive)	4.24.4	4.29.2	#64, #65
rollup (transitive)	4.35.0	4.63.5	#22
@babel/core (transitive)	7.28.5	7.29.7	#43
@babel/runtime (transitive)	7.26.9	7.29.7	#2

The transitive packages were bumped inside their existing semver ranges, and no overrides were added. @codemirror/* stays exactly as before, so there is still a single @codemirror/state copy. A plain pnpm update would have added a second copy and broken the editor.

build-scripts/

Package	Before	After	Alerts
toml	3.0.0	4.2.0 (pinned to match Dokploy)	#57-62
yaml	2.7.1	2.8.3	#28, #29

Template fixes (required by toml 4.x)

toml 4 follows the TOML spec strictly and rejected these 4 templates, which toml 3 accepted leniently:

• signoz, supabase: invalid escape sequences in basic strings (\{, \$, \(, \s, \w, \1, …).
  • toml 3 kept these backslashes literally, so they are now written as \\. The parsed value is identical.
• timescaledb, valkey: mounts = [] followed by [[config.mounts]], which redefines a static array. Removed the empty mounts = [].

Validation

• Every template.toml was parsed with toml 3.0.0 before and after the changes and compared with a deep-equal check: 0 differences in 532 templates. Dokploy currently on toml 3 receives exactly the same config.
• The same comparison between toml 3.0.0 and toml 4.2.0 after the fix: 0 differences across all 532 templates.
• validate-template.ts and validate-docker-compose.ts pass on all 532 blueprints, with the same results as on canary.
• Every docker-compose.yml parses identically with yaml 2.8.3.
• generate-meta.js --check passes.
• app: pnpm build passes (tsc -b + vite 6.4.3).
• Smoke test of vite preview in the browser:
  • The template list renders.
  • The template modal shows the compose file in CodeMirror.
  • ?q= search works in both directions with react-router 7.18 useSearchParams.
  • No console errors.

Note

CI uses pnpm 8, which ignores the lockfile v9 (WARN Ignoring not compatible lockfile) and resolves fresh. The new minimum versions in package.json ensure that path also gets patched versions. This PR does not change that setup.

[github-actions]

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
templates	✅ Ready (View Log)	Visit Preview	77fd697

[Siumauricio]

Thanks! Ported this to canary in #1206, since this PR targets main and conflicts with canary. #1206 keeps all your changes. It also fixes appwrite-2, which was merged after this PR and fails under toml 4 too. Checked with toml@4.2.0: all 559 templates parse. This one can be closed once #1206 is merged.

[narcisonunez]

Thanks, my bad. Now we are using the canary branch in this repo too.

Thanks