fix(deps): clear Dependabot and full-audit vulnerabilities

CHANGELOG.md

@@ -28,6 +28,21 @@
 
 ## [Unreleased]
 
+### Security
+
+- Require `@xmldom/xmldom` 0.8.15 or later in the 0.8 line for Electron
+  packaging dependencies. This addresses the XML injection, malformed-input,
+  and quadratic-time parsing advisories affecting the previous 0.8.13 copy.
+  Add a regression guard covering every resolved copy in the lockfile.
+- Update Electron within the 42.x line to 42.11.3. Its installation tooling
+  uses Electron's maintained ZIP extractor instead of the unpatched
+  `extract-zip` package, removing the vulnerable dependency rather than
+  dismissing its symlink-write advisory (`GHSA-7pqw-9j4j-h8q3`).
+- Update the existing `brace-expansion` overrides to 1.1.18, 2.1.4, and
+  5.0.9, and require `nanoid` 3.3.18+ in the 3.x line. These address the
+  unbounded-expansion and zero-size generator denial-of-service advisories
+  found by a full development-and-production dependency audit.
+
 ## [0.3.101] - 2026-08-07
 
 ### Security

apps/desktop/package.json

@@ -52,7 +52,7 @@
     "autoprefixer": "^10.5.0",
     "concurrently": "^9.2.4",
     "cross-env": "^7.0.3",
-    "electron": "~42.0.1",
+    "electron": "~42.11.3",
     "electron-builder": "~26.15.3",
     "esbuild": "^0.28.1",
     "eslint": "^8.57.1",

docs/src/changelog.md

@@ -6,6 +6,16 @@ foundational work by theme.
 
 ## Unreleased
 
+- **Build dependency security:** Require patched `@xmldom/xmldom` 0.8.15+
+  within the 0.8 line for Electron packaging tools, with a lockfile guard
+  against reintroducing vulnerable copies.
+- **Electron installation security:** Update to Electron 42.11.3, whose
+  maintained ZIP extractor replaces the vulnerable legacy `extract-zip`
+  dependency.
+- **Build dependency hardening:** Update all supported `brace-expansion`
+  lines and `nanoid` 3.x to patched releases for denial-of-service advisories
+  found by the full dependency audit.
+
 ## v0.3.103 - 2026-08-09
 
 - **Windows baseline enforcement compatibility:** Windows Server 2016 and