fix(deps): bring macOS author to audited security parity

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [Unreleased]
+
+### Security
+
+- Port the dependency security fixes from the Full edition without changing
+  the macOS Author version or capability boundary: require xmldom 0.8.15+,
+  brace-expansion 1.1.18 / 2.1.4 / 5.0.9, and nanoid 3.3.18+.
+- Update Electron within 42.x to 42.11.3, replacing the vulnerable legacy
+  `extract-zip` installation dependency with Electron-maintained extraction.
+- Guard every resolved copy and Electron workspace/lockfile consistency
+  against regressions.
+- Bring across the remaining Full-edition dependency fixes identified by
+  the author-branch audit: js-yaml 4.3.2, sharp 0.35.4, Vitest 4.1.11+,
+  and patched Browserslist, fast-uri, Joi, postcss-selector-parser, and
+  baseline-browser-mapping transitive dependencies.
+
 ## [0.3.101-author.1] - 2026-08-07
 
 > `mac-v0.3.101-author.1` is the current macOS Author release and is

apps/desktop/package.json

@@ -40,7 +40,7 @@
     "electron-updater": "6.8.9",
     "i18next": "^25.0.0",
     "i18next-browser-languagedetector": "^8.0.0",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "react-i18next": "^15.0.0",
     "monaco-editor": "^0.55.1",
     "pdfkit": "^0.18.0"
@@ -58,7 +58,7 @@
     "autoprefixer": "^10.5.0",
     "concurrently": "^9.2.4",
     "cross-env": "^7.0.3",
-    "electron": "~42.0.1",
+    "electron": "~42.11.3",
     "electron-builder": "~26.15.3",
     "esbuild": "^0.28.1",
     "eslint": "^8.57.1",
@@ -67,7 +67,7 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-router-dom": "^7.18.2",
-    "sharp": "0.35.0",
+    "sharp": "0.35.4",
     "tailwindcss": "^3.4.19",
     "typescript": "^5.7.3",
     "vite": "^6.4.3",

docs/src/changelog.md

@@ -3,6 +3,15 @@
 A concise release history for ConfigForge. Newer entries use the
 shipped semver tag; older entries summarize the foundational work by theme.
 
+## Unreleased
+
+- **Dependency security:** Port patched xmldom, brace-expansion, and nanoid
+  dependencies, and update Electron to 42.11.3 to remove the vulnerable
+  legacy ZIP extractor. The macOS Author version and author-only capability
+  boundary are unchanged.
+- **Security parity:** Include the remaining audited js-yaml, sharp, Vitest,
+  and transitive build-tool fixes already present in the Full edition.
+
 ## macOS Author v0.3.101-author.1 - 2026-08-07
 
 `mac-v0.3.101-author.1` is the current macOS Author release and is published