diff --git a/flake.lock b/flake.lock
index c2cc24a92..62ec88ad8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766902085,
-        "narHash": "sha256-coBu0ONtFzlwwVBzmjacUQwj3G+lybcZ1oeNSQkgC0M=",
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c0b0e0fddf73fd517c3471e546c0df87a42d53f4",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
         "type": "github"
       },
       "original": {
diff --git a/framework/eslint-config/package.json b/framework/eslint-config/package.json
index 288eadbb5..ab407bf6f 100644
--- a/framework/eslint-config/package.json
+++ b/framework/eslint-config/package.json
@@ -5,11 +5,11 @@
     "main": "base.mjs",
     "repository": "https://github.com/hydro-dev/Hydro",
     "dependencies": {
-        "@antfu/eslint-config": "^8.2.0",
+        "@antfu/eslint-config": "^8.3.0",
         "@eslint-react/eslint-plugin": "^4.2.3",
-        "@typescript-eslint/eslint-plugin": "^8.59.1",
-        "@typescript-eslint/parser": "^8.59.1",
-        "eslint-plugin-de-morgan": "^2.1.1",
+        "@typescript-eslint/eslint-plugin": "^8.59.4",
+        "@typescript-eslint/parser": "^8.59.4",
+        "eslint-plugin-de-morgan": "^2.1.2",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-react-hooks": "^7.1.1",
         "eslint-plugin-react-refresh": "^0.5.2",
diff --git a/framework/framework/package.json b/framework/framework/package.json
index 515dd6026..6ce959b1a 100644
--- a/framework/framework/package.json
+++ b/framework/framework/package.json
@@ -9,18 +9,18 @@
     },
     "dependencies": {
         "@hydrooj/utils": "workspace:^",
-        "@koa/router": "^15.4.0",
-        "@mongodb-js/saslprep": "^1.4.10",
+        "@koa/router": "^15.5.0",
+        "@mongodb-js/saslprep": "^1.4.11",
         "emoji-regex": "^10.6.0",
-        "fs-extra": "^11.3.4",
+        "fs-extra": "^11.3.5",
         "koa": "^3.2.0",
-        "koa-body": "^7.0.1",
+        "koa-body": "^8.0.0",
         "koa-compress": "5.2.1",
         "path-to-regexp": "^8.4.2",
         "sanitize-filename": "^1.6.4",
         "schemastery": "^3.18.0",
         "shorty.js": "^1.0.1",
-        "ws": "^8.20.0"
+        "ws": "^8.20.1"
     },
     "devDependencies": {
         "@types/fs-extra": "^11.0.4",
diff --git a/framework/utils/package.json b/framework/utils/package.json
index 9ba6bee17..da19699a1 100644
--- a/framework/utils/package.json
+++ b/framework/utils/package.json
@@ -15,11 +15,11 @@
     "dependencies": {
         "@hydrooj/register": "workspace:^",
         "cac": "^7.0.0",
-        "fs-extra": "^11.3.4",
+        "fs-extra": "^11.3.5",
         "js-yaml": "^4.1.1",
         "reggol": "^2.1.0",
         "search-query-parser": "^1.6.0",
-        "systeminformation": "^5.31.5"
+        "systeminformation": "^5.31.6"
     },
     "devDependencies": {
         "@types/fs-extra": "^11.0.4"
diff --git a/package.json b/package.json
index 53cbce46d..2c1562576 100644
--- a/package.json
+++ b/package.json
@@ -47,16 +47,16 @@
         "eslint": "^9.39.4",
         "eslint-import-resolver-typescript": "^4.4.4",
         "eslint-import-resolver-webpack": "^0.13.11",
-        "fs-extra": "^11.3.4",
-        "globals": "^17.5.0",
+        "fs-extra": "^11.3.5",
+        "globals": "^17.6.0",
         "globby": "~14.0.2",
         "inspectpack": "^4.7.1",
         "mongodb-memory-server": "11.0.1",
         "nyc": "^18.0.0",
         "ora": "^9.4.0",
-        "oxlint": "^1.62.0",
+        "oxlint": "^1.65.0",
         "package-json": "^10.0.1",
-        "semver": "^7.7.4",
+        "semver": "^7.8.0",
         "simple-git": "^3.36.0",
         "supertest": "^7.2.2",
         "supports-hyperlinks": "^4.4.0",
diff --git a/packages/center/package.json b/packages/center/package.json
index 58035e1e3..a71f1a4ce 100644
--- a/packages/center/package.json
+++ b/packages/center/package.json
@@ -11,6 +11,6 @@
     },
     "dependencies": {
         "crypto-js": "^4.2.0",
-        "semver": "^7.7.4"
+        "semver": "^7.8.0"
     }
 }
diff --git a/packages/hydrojudge/package.json b/packages/hydrojudge/package.json
index 6d1b09924..fec0a3a64 100644
--- a/packages/hydrojudge/package.json
+++ b/packages/hydrojudge/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@hydrooj/hydrojudge",
     "bin": "bin/hydrojudge.js",
-    "version": "4.0.2",
+    "version": "4.0.3",
     "main": "./src/index.ts",
     "author": "undefined <i@undefined.moe>",
     "repository": "https://github.com/hydro-dev/Hydro.git",
@@ -9,16 +9,16 @@
         "@hydrooj/common": "workspace:^",
         "@hydrooj/utils": "workspace:^",
         "@opentelemetry/api": "^1.9.1",
-        "@opentelemetry/exporter-trace-otlp-http": "^0.216.0",
-        "@opentelemetry/sdk-node": "^0.216.0",
+        "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
+        "@opentelemetry/sdk-node": "^0.218.0",
         "@zip.js/zip.js": "^2.8.26",
         "cac": "^7.0.0",
-        "p-queue": "^9.2.0",
+        "p-queue": "^9.3.0",
         "schemastery": "^3.18.0",
-        "semver": "^7.7.4",
+        "semver": "^7.8.0",
         "shell-quote": "^1.8.3",
         "superagent": "^10.3.0",
-        "ws": "^8.20.0"
+        "ws": "^8.20.1"
     },
     "preferUnplugged": true,
     "license": "AGPL-3.0-or-later",
diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index c7a9b9910..7a63a4a93 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -12,18 +12,18 @@
     },
     "preferUnplugged": true,
     "dependencies": {
-        "@aws-sdk/client-s3": "3.1039.0",
-        "@aws-sdk/lib-storage": "3.1039.0",
-        "@aws-sdk/s3-presigned-post": "3.1039.0",
-        "@aws-sdk/s3-request-presigner": "3.1039.0",
+        "@aws-sdk/client-s3": "3.1048.0",
+        "@aws-sdk/lib-storage": "3.1048.0",
+        "@aws-sdk/s3-presigned-post": "3.1048.0",
+        "@aws-sdk/s3-request-presigner": "3.1048.0",
         "@babel/code-frame": "^7.29.0",
         "@cordisjs/plugin-logger": "^1.0.2",
-        "@cordisjs/plugin-timer": "1.1.1",
+        "@cordisjs/plugin-timer": "1.1.2",
         "@hydrooj/common": "workspace:^",
         "@hydrooj/framework": "workspace:^",
         "@hydrooj/utils": "workspace:^",
-        "@mongodb-js/saslprep": "^1.4.10",
-        "@simplewebauthn/server": "13.2.2",
+        "@mongodb-js/saslprep": "^1.4.11",
+        "@simplewebauthn/server": "13.3.0",
         "@undefined-moe/require-resolve-hook": "^1.1.0",
         "@zip.js/zip.js": "^2.8.26",
         "adm-zip": "0.5.16",
@@ -32,12 +32,12 @@
         "csv-stringify": "^6.7.0",
         "emoji-regex": "^10.6.0",
         "emojis-list": "2.1.0",
-        "fs-extra": "^11.3.4",
+        "fs-extra": "^11.3.5",
         "js-yaml": "^4.1.1",
         "koa-proxies": "^0.12.4",
         "koa-static-cache": "^5.1.4",
         "lodash": "^4.18.1",
-        "lru-cache": "^11.3.5",
+        "lru-cache": "^11.4.0",
         "mime-types": "^3.0.2",
         "moment-timezone": "^0.6.2",
         "mongodb": "^7.2.0",
@@ -45,10 +45,10 @@
         "nanoid": "^5.1.11",
         "nodemailer": "^8.0.7",
         "otpauth": "^9.5.1",
-        "p-queue": "^9.2.0",
+        "p-queue": "^9.3.0",
         "sanitize-filename": "^1.6.4",
         "schemastery": "^3.18.0",
-        "semver": "^7.7.4",
+        "semver": "^7.8.0",
         "shorty.js": "^1.0.1",
         "superagent": "^10.3.0",
         "superagent-proxy": "^3.0.0",
diff --git a/packages/hydrooj/src/handler/home.ts b/packages/hydrooj/src/handler/home.ts
index e097daff1..0af7b8d97 100644
--- a/packages/hydrooj/src/handler/home.ts
+++ b/packages/hydrooj/src/handler/home.ts
@@ -188,7 +188,7 @@ class HomeSecurityHandler extends Handler {
             session._id = md5(session._id);
             const ua = session.updateUa || session.createUa;
             if (ua) session.updateUaInfo = UAParser(ua);
-            session.updateGeoip = this.ctx.geoip?.lookup?.(
+            session.updateGeoip = this.ctx.get('geoip')?.lookup?.(
                 session.updateIp || session.createIp,
                 this.translate('geoip_locale'),
             );
@@ -202,7 +202,7 @@ class HomeSecurityHandler extends Handler {
                 'credentialID', 'name', 'credentialType', 'credentialDeviceType',
                 'authenticatorAttachment', 'regat', 'fmt',
             ])),
-            geoipProvider: this.ctx.geoip?.provider,
+            geoipProvider: this.ctx.get('geoip')?.provider,
             relations,
         };
     }
@@ -615,7 +615,7 @@ class HomeMessagesHandler extends Handler {
     }
 }
 
-export const inject = { geoip: { required: false }, oauth: {} };
+export const inject = ['oauth'];
 export function apply(ctx: Context) {
     ctx.Route('homepage', '/', HomeHandler);
     ctx.Route('home_security', '/home/security', HomeSecurityHandler, PRIV.PRIV_USER_PROFILE);
diff --git a/packages/onsite-toolkit/package.json b/packages/onsite-toolkit/package.json
index 2bcb8975e..6be0fa50d 100644
--- a/packages/onsite-toolkit/package.json
+++ b/packages/onsite-toolkit/package.json
@@ -3,6 +3,6 @@
     "version": "0.1.0",
     "repository": "https://github.com/hydro-dev/Hydro",
     "dependencies": {
-        "lru-cache": "^11.3.5"
+        "lru-cache": "^11.4.0"
     }
 }
diff --git a/packages/ui-default/build/config/webpack.ts b/packages/ui-default/build/config/webpack.ts
index d6c04861f..24525cca7 100644
--- a/packages/ui-default/build/config/webpack.ts
+++ b/packages/ui-default/build/config/webpack.ts
@@ -302,7 +302,6 @@ export default async function (env: { watch?: boolean, production?: boolean, mea
         authToken: process.env.SENTRY_AUTH_TOKEN,
         org: 'hydro-dev',
         project: 'hydro-web',
-        url: 'https://sentry.hydro.ac',
         sourcemaps: {
           rewriteSources: (source) => source.replace('@hydrooj/ui-default/../../node_modules/', ''),
         },
diff --git a/packages/ui-default/components/dialog/dialog.page.styl b/packages/ui-default/components/dialog/dialog.page.styl
index b4a5da94e..30c5549c0 100644
--- a/packages/ui-default/components/dialog/dialog.page.styl
+++ b/packages/ui-default/components/dialog/dialog.page.styl
@@ -22,7 +22,9 @@
   box-shadow: $dialog-shadow
   min-width: rem(500px)
   max-width: rem(900px)
+  max-height: 90vh
   padding: rem(40px) rem(30px)
+  overflow-y: auto
 
 .dialog__body
   margin-bottom: rem(20px)
diff --git a/packages/ui-default/package.json b/packages/ui-default/package.json
index bc967a2b4..f8225ab89 100644
--- a/packages/ui-default/package.json
+++ b/packages/ui-default/package.json
@@ -16,16 +16,16 @@
     "@fontsource/inconsolata": "^5.2.8",
     "@fontsource/jetbrains-mono": "^5.2.8",
     "@fontsource/pt-mono": "^5.2.8",
-    "@fontsource/roboto-mono": "^5.2.8",
+    "@fontsource/roboto-mono": "^5.2.9",
     "@fontsource/source-code-pro": "^5.2.7",
     "@fontsource/ubuntu-mono": "^5.2.8",
     "@hydrooj/utils": "workspace:^",
-    "@mantine/core": "^9.1.1",
-    "@mantine/hooks": "^9.1.1",
-    "@mantine/notifications": "^9.1.1",
-    "@sentry/browser": "^10.51.0",
-    "@sentry/webpack-plugin": "^5.2.1",
-    "@simplewebauthn/browser": "13.2.2",
+    "@mantine/core": "^9.2.1",
+    "@mantine/hooks": "^9.2.1",
+    "@mantine/notifications": "^9.2.1",
+    "@sentry/browser": "^10.53.1",
+    "@sentry/webpack-plugin": "^5.3.0",
+    "@simplewebauthn/browser": "13.3.0",
     "@svgr/webpack": "^8.1.0",
     "@types/html-to-text": "^9.0.4",
     "@types/jquery": "^3.5.34",
@@ -66,7 +66,7 @@
     "jquery": "^3.7.1",
     "jquery.easing": "^1.4.1",
     "jquery.transit": "^0.9.12",
-    "mantine-contextmenu": "^8.3.13",
+    "mantine-contextmenu": "^9.2.1",
     "matchmedia-polyfill": "^0.3.2",
     "md-editor-rt": "^6.5.0",
     "mini-css-extract-plugin": "^2.10.2",
@@ -79,7 +79,7 @@
     "nanoid": "^5.1.11",
     "normalize.css": "^8.0.1",
     "nprogress": "^0.2.0",
-    "p-queue": "^9.2.0",
+    "p-queue": "^9.3.0",
     "postcss-loader": "7.3.4",
     "postcss-preset-mantine": "^1.18.0",
     "prism-themes": "^1.9.0",
@@ -87,12 +87,12 @@
     "prop-types": "^15.8.1",
     "qface": "^1.4.1",
     "qrcode": "^1.5.4",
-    "react": "^19.2.5",
-    "react-colorful": "^5.6.1",
+    "react": "^19.2.6",
+    "react-colorful": "^5.7.0",
     "react-dnd": "^16.0.1",
     "react-dnd-html5-backend": "^16.0.1",
-    "react-dom": "^19.2.5",
-    "react-redux": "^9.2.0",
+    "react-dom": "^19.2.6",
+    "react-redux": "^9.3.0",
     "reconnecting-websocket": "^4.4.0",
     "redux": "^5.0.1",
     "redux-logger": "^3.0.6",
@@ -100,23 +100,23 @@
     "redux-thunk": "^3.1.0",
     "rupture": "^0.7.1",
     "sass": "^1.99.0",
-    "sass-loader": "^16.0.7",
+    "sass-loader": "^16.0.8",
     "schemastery": "^3.18.0",
     "shorty.js": "^1.0.1",
     "sticky-kit": "^1.1.3",
     "style-loader": "^4.0.0",
     "stylus": "^0.64.0",
     "stylus-loader": "7.1.2",
-    "svgtofont": "^6.5.1",
+    "svgtofont": "^6.5.2",
     "tether": "1.4.7",
     "tether-drop": "^1.4.2",
     "timeago-react": "^3.0.7",
     "timeago.js": "^4.0.2",
     "ts-loader": "^9.5.7",
-    "web-streams-polyfill": "^4.2.0",
+    "web-streams-polyfill": "^4.3.0",
     "webpack": "^5.106.2",
     "webpack-bundle-analyzer": "^5.3.0",
-    "webpack-dev-server": "^5.2.3",
+    "webpack-dev-server": "^5.2.4",
     "webpack-manifest-plugin": "^6.0.1",
     "webpackbar": "^7.0.0"
   },
@@ -125,11 +125,11 @@
     "ansi_up": "^6.0.6",
     "cssfilter": "^0.0.11",
     "esbuild": "0.25.2",
-    "fs-extra": "^11.3.4",
+    "fs-extra": "^11.3.5",
     "html-to-text": "^10.0.0",
     "js-yaml": "^4.1.1",
     "jsesc": "^3.1.0",
-    "katex": "^0.16.45",
+    "katex": "^0.16.47",
     "lodash": "^4.18.1",
     "markdown-it": "^14.1.1",
     "markdown-it-anchor": "^9.2.0",
diff --git a/packages/ui-default/pages/contest_balloon.page.tsx b/packages/ui-default/pages/contest_balloon.page.tsx
index da2064da1..2a7f2891f 100644
--- a/packages/ui-default/pages/contest_balloon.page.tsx
+++ b/packages/ui-default/pages/contest_balloon.page.tsx
@@ -3,6 +3,7 @@ import { getAlphabeticId } from '@hydrooj/utils/lib/common';
 import yaml from 'js-yaml';
 import React from 'react';
 import { HexColorInput, HexColorPicker } from 'react-colorful';
+import { createPortal } from 'react-dom';
 import { ActionDialog } from 'vj/components/dialog';
 import Notification from 'vj/components/notification';
 import { NamedPage } from 'vj/misc/Page';
@@ -12,17 +13,46 @@ import {
 
 function Balloon({ tdoc, val }) {
   const [color, setColor] = React.useState('');
-  const [now, setNow] = React.useState('');
+  const [now, setNow] = React.useState<number | null>(null);
+  const [pickerTarget, setPickerTarget] = React.useState<HTMLElement | null>(null);
+  const [pickerStyle, setPickerStyle] = React.useState<React.CSSProperties>({});
+  const updatePickerStyle = React.useCallback((target: HTMLElement) => {
+    const row = target.closest('tr');
+    if (!row) return;
+    const rect = row.getBoundingClientRect();
+    setPickerStyle({
+      position: 'fixed',
+      left: rect.right,
+      top: rect.top + rect.height / 2,
+      transform: 'translateY(-50%)',
+      zIndex: 10000,
+    });
+  }, []);
+  const showPicker = (pid: number, c: string, target: HTMLElement) => {
+    setNow(pid);
+    setColor(c);
+    setPickerTarget(target);
+    updatePickerStyle(target);
+  };
+  React.useEffect(() => {
+    if (!pickerTarget) return undefined;
+    const update = () => updatePickerStyle(pickerTarget);
+    window.addEventListener('resize', update);
+    window.addEventListener('scroll', update, true);
+    return () => {
+      window.removeEventListener('resize', update);
+      window.removeEventListener('scroll', update, true);
+    };
+  }, [pickerTarget, updatePickerStyle]);
   return (
     <div className="row">
-      <div className="medium-12 columns">
+      <div className="medium-8 columns">
         <table className="data-table">
           <thead>
             <tr>
-              <th>{i18n('Problem')}</th>
-              <th>{i18n('Color')}</th>
-              <th>{i18n('Name')}</th>
-              <th><span className="icon icon-wrench"></span></th>
+              <th style={{ width: 70 }}>{i18n('Problem')}</th>
+              <th style={{ width: 130 }}>{i18n('Color')}</th>
+              <th style={{ width: 130 }}>{i18n('Name')}</th>
             </tr>
           </thead>
           <tbody>
@@ -31,7 +61,7 @@ function Balloon({ tdoc, val }) {
               return (
                 <tr key={pid}>
                   <td>
-                    {now === pid
+                    {now === +pid
                       ? (<b>{getAlphabeticId(tdoc.pids.indexOf(+pid))}</b>)
                       : (<span>{getAlphabeticId(tdoc.pids.indexOf(+pid))}</span>)}
                   </td>
@@ -39,7 +69,7 @@ function Balloon({ tdoc, val }) {
                     <HexColorInput
                       className="textbox"
                       color={c}
-                      onFocus={() => { setNow(pid); setColor(c); }}
+                      onFocus={(e) => showPicker(+pid, c, e.currentTarget)}
                       onChange={(e) => { val[+pid].color = e; setColor(e); }}
                     />
                   </td>
@@ -48,19 +78,24 @@ function Balloon({ tdoc, val }) {
                       type="text"
                       className="textbox"
                       defaultValue={name}
-                      onFocus={() => { setNow(pid); setColor(c); }}
+                      onFocus={(e) => showPicker(+pid, c, e.currentTarget)}
                       onChange={(e) => { val[+pid].name = e.target.value; }}
                     />
                   </td>
-                  {tdoc.pids.indexOf(+pid) === 0 && <td rowSpan={0}>
-                    {now && <HexColorPicker color={color} onChange={(e) => { val[+now].color = e; setColor(e); }} style={{ padding: '1rem' }} />}
-                  </td>}
                 </tr>
               );
             })}
           </tbody>
         </table>
       </div>
+      <div className="medium-4 columns">
+        {now !== null && createPortal(
+          <div style={pickerStyle}>
+            <HexColorPicker color={color} onChange={(e) => { val[now].color = e; setColor(e); }} style={{ padding: '1rem' }} />
+          </div>,
+          document.body,
+        )}
+      </div>
     </div>
   );
 }
diff --git a/packages/ui-default/templates/partials/contest_balloon.html b/packages/ui-default/templates/partials/contest_balloon.html
index d39462f4b..0b8d4526a 100644
--- a/packages/ui-default/templates/partials/contest_balloon.html
+++ b/packages/ui-default/templates/partials/contest_balloon.html
@@ -27,8 +27,8 @@
       {% endif %}
       <b>{{ utils.getAlphabeticId(tdoc.pids.indexOf(bdoc.pid)) }}</b>&nbsp;&nbsp;({{ tdoc.balloon[bdoc.pid].name }})
     </td>
-    <td class="col--submit-by" data-tooltip="{{ bdoc._id.getTimestamp().format() }}">{{ user.render_inline(udict[bdoc.uid], badge=false) }}</td>
-    <td class="col--send-by"{% if bdoc.sent %} data-tooltip="{{ bdoc.sentAt.format() }}"{% endif %}>
+    <td class="col--submit-by" data-tooltip="{{ bdoc._id.getTimestamp() }}">{{ user.render_inline(udict[bdoc.uid], badge=false) }}</td>
+    <td class="col--send-by"{% if bdoc.sent %} data-tooltip="{{ bdoc.sentAt }}"{% endif %}>
       {% if bdoc.sent %}{{ user.render_inline(udict[bdoc.sent], avatar=false, badge=false) }}{% else %}-{% endif %}
     </td>
     <td class="col--awards">{% if bdoc.first %}{{ _('First of Problem') }}{% endif %}</td>
diff --git a/packages/ui-next/package.json b/packages/ui-next/package.json
index 9049d33bf..77054be75 100644
--- a/packages/ui-next/package.json
+++ b/packages/ui-next/package.json
@@ -28,14 +28,14 @@
     "esbuild": "0.25.2",
     "is-relative-url": "^4.1.0",
     "path-to-regexp": "^8.4.2",
-    "react": "^19.2.5",
-    "react-dom": "^19.2.5"
+    "react": "^19.2.6",
+    "react-dom": "^19.2.6"
   },
   "devDependencies": {
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.1",
+    "@vitejs/plugin-react": "^6.0.2",
     "koa2-connect": "^1.0.2",
-    "vite": "^8.0.10"
+    "vite": "^8.0.13"
   }
 }
diff --git a/packages/vjudge/package.json b/packages/vjudge/package.json
index 406fae0b3..a46077de7 100644
--- a/packages/vjudge/package.json
+++ b/packages/vjudge/package.json
@@ -14,7 +14,7 @@
         "superagent-proxy": "^3.0.0"
     },
     "devDependencies": {
-        "@types/jsdom": "^28.0.1",
+        "@types/jsdom": "^28.0.3",
         "@types/superagent-proxy": "^3.0.4"
     }
 }