fix: page relations link + upgrade backend npm deps

backend/package.json

@@ -35,12 +35,12 @@
     "db-up": "drizzle-kit up --dialect=postgresql --out=./db/migrations"
   },
   "dependencies": {
-    "@fastify/compress": "9.1.1",
+    "@fastify/compress": "9.2.0",
     "@fastify/cookie": "11.1.2",
     "@fastify/cors": "11.3.0",
-    "@fastify/formbody": "8.0.2",
+    "@fastify/formbody": "9.0.0",
     "@fastify/helmet": "13.1.0",
-    "@fastify/sensible": "6.0.4",
+    "@fastify/sensible": "6.0.5",
     "@fastify/session": "11.1.2",
     "@fastify/static": "10.1.3",
     "@fastify/swagger": "9.8.1",
@@ -53,12 +53,12 @@
     "bcryptjs": "3.0.3",
     "chalk": "6.0.0",
     "cheerio": "1.2.0",
-    "cron-parser": "5.7.0",
+    "cron-parser": "5.8.1",
     "diff": "9.0.0",
-    "drizzle-orm": "1.0.0-beta.15-859cf75",
+    "drizzle-orm": "1.0.0-rc.4",
     "emittery": "2.0.0",
     "es-toolkit": "1.50.0",
-    "fastify": "5.11.2",
+    "fastify": "5.11.3",
     "fastify-favicon": "5.0.0",
     "filesize": "11.0.22",
     "fs-extra": "11.4.0",
@@ -69,7 +69,7 @@
     "node-cache": "5.1.2",
     "openid-client": "6.8.4",
     "pem-jwk": "2.0.0",
-    "pg": "8.22.0",
+    "pg": "8.23.0",
     "poolifier": "5.3.2",
     "qrcode": "1.5.4",
     "sanitize-html": "2.17.6",
@@ -91,7 +91,7 @@
     "@types/sanitize-html": "2.16.1",
     "@types/semver": "7.8.0",
     "@types/ws": "8.18.1",
-    "drizzle-kit": "1.0.0-beta.15-859cf75",
+    "drizzle-kit": "1.0.0-rc.4",
     "nodemon": "3.1.14",
     "npm-check-updates": "23.0.2",
     "oxfmt": "0.62.0",

frontend/src/pages/Index.vue

@@ -126,7 +126,8 @@
                     no-caps
                     color="primary"
                     v-for="rel of relationsLeft"
-                    :key="`rel-id-` + rel.id">
+                    :key="`rel-id-` + rel.id"
+                    v-bind="relationLink(rel)">
                     <w-icon :name="rel.icon" />
                     <div class="flex flex-col text-left pl-4">
                       <div class="text-body2">
@@ -143,7 +144,8 @@
                       flat
                       no-caps
                       v-for="rel of relationsCenter"
-                      :key="`rel-id-` + rel.id">
+                      :key="`rel-id-` + rel.id"
+                      v-bind="relationLink(rel)">
                       <w-icon class="mr-2" :name="rel.icon" />
                       <span>{{ rel.label }}</span>
                     </w-btn>
@@ -157,7 +159,8 @@
                     no-caps
                     color="primary"
                     v-for="rel of relationsRight"
-                    :key="`rel-id-` + rel.id">
+                    :key="`rel-id-` + rel.id"
+                    v-bind="relationLink(rel)">
                     <div class="flex flex-col text-left pr-4">
                       <div class="text-body2">
                         <strong>{{ rel.label }}</strong>
@@ -655,6 +658,43 @@ watch(
  * which ones are ours; anything it declines is left to the browser, including a click asking for a
  * new tab.
  */
+/**
+ * What a relation button links to, as props for `WBtn`.
+ *
+ * The buttons were rendered with neither, so a relation was decoration: it drew its label and caption
+ * and swallowed the click. A target is stored as `PageRelationDialog` leaves it — a rooted path within
+ * this wiki (`/guides/upgrading`) or a complete external address — so the two cases are told apart the
+ * same way an in-content link is, by `routableHref`, and the router takes the ones that are ours
+ * rather than reloading the app to reach them.
+ *
+ * Nothing at all for a relation with no target: the dialog only requires a label, and an `<a>` with an
+ * empty href reloads the current page.
+ *
+ * @param rel A page relation
+ * @returns `{ to }` for a page in this wiki, `{ href }` for an ordinary web address, `{}` for neither
+ */
+function relationLink(rel) {
+  const target = rel.target?.trim()
+  if (!target) {
+    return {}
+  }
+  let url
+  try {
+    // -> Resolved against this origin, because a stored page target is a path rather than a URL and
+    //    `routableHref` compares origins
+    url = new URL(target, window.location.origin)
+  } catch {
+    return {}
+  }
+  const routed = routableHref({ href: url.toString() }, window.location)
+  if (routed) {
+    return { to: routed }
+  }
+  // -> An ordinary web link or nothing: a target is author-supplied, and `javascript:` in an href is
+  //    script this page would run on click
+  return /^https?:$/.test(url.protocol) ? { href: url.toString() } : {}
+}
+
 function onContentClick(ev) {
   if (
     ev.defaultPrevented ||