Clear all resolvable Dependabot alerts

[tomcardoso]

Takes npm audit from 11 open alerts to 0 vulnerabilities.

Scope check first

Of the 11 alerts, 10 were development-scope — build tooling that never ships in the packaged app. Exactly one, js-yaml, had runtime scope, reaching production through electron-updater, which parses the latest.yml update feed.

That one is not fixed, because it currently cannot be. The advisory names 4.2.0 as the patched version, but no such version is published to npm — the latest is 4.1.1, and only 4.0.0/4.1.0/4.1.1 exist. There is nothing to upgrade to. I'd suggest leaving the alert open as a live reminder rather than dismissing it; it should be re-checked once js-yaml actually ships a patch. Practical exposure is low (it needs a hostile update feed served over HTTPS from GitHub Releases), but it is the one that reaches users, so it shouldn't quietly disappear.

Changes

Package	Change	Why
vite	6.4.2 → 6.4.3	high — server.fs.deny bypass on Windows alternate paths; launch-editor NTLMv2 hash disclosure
electron-builder	26.8.1 → 26.15.3	moderate, transitive tar
@electron/rebuild	3.7.2 → 4.2.0	moderate — semver-major
tar (override)	7.5.15 → 7.5.20	moderate — PAX size override parser differential
undici, form-data, @babel/core	transitive	resolved by npm audit fix

Two things worth knowing:

The tar override was the blocker. npm audit fix kept reporting a fix was available, then changing nothing. The cause is an existing overrides entry added in 3dac9ff pinning tar to 7.5.15 — which was the patched version at the time and has since become the vulnerable one. The override has to be bumped by hand; audit fix cannot see past it.

@electron/rebuild is a major bump on a load-bearing package. It backs npm run rebuild, which compiles the SQLCipher and Argon2 native modules and runs in CI at build.yml:41 during releases. I ran it directly rather than inferring safety: it completes and produces working binaries, and the full test suite (which rebuilds for the Node target via pretest) passes against them.

Versions are pinned exactly, matching the existing devDependency convention — npm install -D writes caret ranges by default, which I reverted.

Verification

npm run rebuild ✓ · npm test 527 passing ✓ · npm run typecheck ✓ · npm run lint 0 errors (14 pre-existing warnings) ✓ · npm run build ✓ · npm audit 0 vulnerabilities ✓

One gap: I did not complete a local npm run dist:mac. The first attempt was invalidated when I ran npm install concurrently, and the mac config sets notarize: true, which needs Apple credentials not available here. electron-builder moved a minor version, so packaging is exercised for the first time by CI. Worth watching the first release build after this merges.