chore(deps): update to Next 16 and maplibre 6, bump the CI actions

.github/dependabot.yml

@@ -40,6 +40,13 @@ updates:
       # upgrade belongs in a deliberate PR, not an automatic one.
       - dependency-name: better-sqlite3
         update-types: ["version-update:semver-major"]
+      # TypeScript 7 ships no programmatic API, which Next needs to load
+      # next.config.ts and tsconfig; the move is a deliberate PR.
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
+      # Types follow the runtime in the Dockerfile and CI, currently Node 22.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: docker
     directory: "/"

.github/workflows/ci.yml

@@ -21,12 +21,12 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Before setup-node, which needs pnpm on PATH to resolve the store cache.
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
@@ -50,7 +50,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Warning and up: the remote-expansion notes in deploy.sh are deliberate,
       # the commands are built locally on purpose.

.github/workflows/codeql.yml

@@ -27,13 +27,13 @@ jobs:
     if: ${{ !github.event.repository.private }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
           queries: security-and-quality
 
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4
         with:
           category: /language:javascript-typescript

.github/workflows/image.yml

@@ -40,7 +40,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Build only, never push. A release goes out through scripts/release.sh
       # from a machine that holds the registry credentials.

.gitignore

@@ -1,6 +1,8 @@
 node_modules/
 .next/
 out/
+# Copied out of node_modules by scripts/copy-maplibre-worker.mjs on every build.
+public/maplibre/
 data/*.db
 # -wal, -shm, -journal: SQLite creates new ones as it pleases, so the rule
 # catches them all instead of listing them.

package.json

@@ -10,23 +10,22 @@
   "type": "module",
   "packageManager": "pnpm@10.28.2",
   "scripts": {
-    "dev": "next dev",
-    "build": "next build",
+    "dev": "node scripts/copy-maplibre-worker.mjs && next dev",
+    "build": "node scripts/copy-maplibre-worker.mjs && next build",
     "start": "next start",
     "typecheck": "tsc --noEmit",
     "test": "node --import tsx --test tests/*.test.ts",
-    "lint": "next lint",
     "ingest": "tsx scripts/ingest.ts",
     "ingest:local": "tsx scripts/ingest.ts --from-file",
     "smoke": "tsx scripts/smoke.ts"
   },
   "dependencies": {
     "better-sqlite3": "^11.10.0",
-    "gtfs-realtime-bindings": "^1.1.1",
-    "maplibre-gl": "^5.6.0",
-    "next": "15.5.22",
-    "react": "19.1.0",
-    "react-dom": "19.1.0",
+    "gtfs-realtime-bindings": "^2.2.0",
+    "maplibre-gl": "^6.5.0",
+    "next": "16.3.2",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
     "yauzl": "^3.2.0"
   },
   "devDependencies": {
@@ -35,7 +34,7 @@
     "@types/node": "^22.15.0",
     "@types/react": "^19.1.8",
     "@types/react-dom": "^19.1.6",
-    "@types/yauzl": "^2.10.3",
+    "@types/yauzl": "^3.4.0",
     "tailwindcss": "^4.1.11",
     "tsx": "^4.20.3",
     "typescript": "^5.8.3"