chore(deps): refresh packages and bundled engines

- update React DOM types and compatible Rust lock dependencies
- refresh Windows and Linux FFmpeg source URLs and checksums
- cover aria2 asset hashes and Windows npm command execution
- verify Firelink and Companion across tests, builds, and engine payloads

scripts/check-updates.js

@@ -58,12 +58,28 @@ function releaseAssetHashes(release) {
   );
 }
 
+function providerAssetHashes({ ytDlp, deno, aria2 }) {
+  return {
+    ...releaseAssetHashes(ytDlp),
+    ...releaseAssetHashes(deno),
+    ...releaseAssetHashes(aria2),
+  };
+}
+
+function npmExecutable(platform = process.platform) {
+  return platform === 'win32' ? 'npm.cmd' : 'npm';
+}
+
 function npmOutdated(cwd) {
   if (!fs.existsSync(path.join(cwd, 'package.json'))) {
     throw new Error(`npm workspace is missing package.json: ${cwd}`);
   }
   try {
-    execFileSync('npm', ['outdated', '--json'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    execFileSync(npmExecutable(), ['outdated', '--json'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
     return {};
   } catch (error) {
     if (error.status !== 1) {
@@ -360,10 +376,7 @@ async function main() {
   const latestByTargetEngine = {};
   const latestUrlsByTargetEngine = {};
   const latestHashesByTargetEngine = {};
-  const latestHashesByUrl = {
-    ...releaseAssetHashes(ytDlp),
-    ...releaseAssetHashes(deno),
-  };
+  const latestHashesByUrl = providerAssetHashes({ ytDlp, deno, aria2 });
   if (btbnFfmpegN81Build?.version && btbnFfmpegN81Build.urls?.windows && btbnFfmpegN81Build.urls?.linux) {
     latestByTargetEngine['x86_64-pc-windows-msvc:ffmpeg'] = btbnFfmpegN81Build.version;
     latestByTargetEngine['x86_64-unknown-linux-gnu:ffmpeg'] = btbnFfmpegN81Build.version;
@@ -443,4 +456,4 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
   });
 }
 
-export { checkRows, fetchJson, fetchText, fetchWithContext };
+export { checkRows, fetchJson, fetchText, fetchWithContext, npmExecutable, providerAssetHashes };

scripts/check-updates.node-test.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 
-import { checkRows, fetchJson, fetchText } from './check-updates.js';
+import { checkRows, fetchJson, fetchText, npmExecutable, providerAssetHashes } from './check-updates.js';
 
 async function withMockFetch(mockFetch, callback) {
   const originalFetch = globalThis.fetch;
@@ -85,3 +85,35 @@ test('checkRows detects a provider hash change when version and URL are current'
 
   assert.equal(outdated, 1);
 });
+
+test('checkRows detects an aria2 asset digest change when the provider supplies it', () => {
+  const url = 'https://github.com/aria2/aria2/releases/download/release-1.37.0/aria2-1.37.0-win-64bit-build1.zip';
+  const digest = 'b'.repeat(64);
+  const hashes = providerAssetHashes({
+    aria2: { assets: [{ browser_download_url: url, digest: `sha256:${digest}` }] },
+  });
+
+  const outdated = checkRows(
+    [{
+      target: 'x86_64-pc-windows-msvc',
+      engine: 'aria2c',
+      version: '1.37.0',
+      url,
+      sha256: 'a'.repeat(64),
+    }],
+    { aria2c: '1.37.0' },
+    {},
+    {},
+    new Set(),
+    {},
+    hashes,
+  );
+
+  assert.equal(outdated, 1);
+});
+
+test('npm executable selection uses the Windows command shim when needed', () => {
+  assert.equal(npmExecutable('win32'), 'npm.cmd');
+  assert.equal(npmExecutable('darwin'), 'npm');
+  assert.equal(npmExecutable('linux'), 'npm');
+});