[Amir Bredy (ABMFST)]

Summary

• Address all 19 Dependabot alerts open on main at the start of this work
  on 2026-10-15, including the critical shell-quote advisory.
• Consolidate the dependency and immutable Action-pin changes covered by
  fix(deps-dev): bump ip-address from 10.4.0 to 10.7.2 #135, fix(deps-dev): bump dompurify from 3.4.13 to 3.4.16 #136, fix(deps-dev): bump axios from 1.18.1 to 1.20.0 #137, fix(deps): bump shell-quote and concurrently #138, and fix(deps): bump the github-actions group with 2 updates #139, and patch compatible findings uncovered
  by a full development-and-production audit.
• Fix the root shell-quote override that would otherwise retain vulnerable
  1.9.0 even after the concurrently update in fix(deps): bump shell-quote and concurrently #138.
• Regenerate and exercise the lockfile on GitHub-hosted runners only.
  No Node.js or npm execution is required on the maintainer's machine.

Dependency changes

Dependency	Previous resolved version	New resolved version
shell-quote	1.9.0	1.12.0
concurrently	9.2.4	9.2.5
Axios	1.18.1	1.20.0
DOMPurify	3.4.13	3.4.16
ip-address	10.4.0	10.7.2
brace-expansion	1.1.18 / 2.1.4 / 5.0.9	1.1.21 / 2.1.7 / 5.0.12
Undici	6.28.0 / 7.29.0	6.29.1 / 7.30.1
http-cache-semantics	4.2.0	4.3.0
sharp	0.35.4	0.35.5
fast-uri	3.1.7	3.1.8
joi	18.2.8	18.2.9
source-map-js	1.2.1	1.2.2
postcss-selector-parser	6.1.4	7.1.6

The 4.3.0 http-cache-semantics release is outside the advisory's affected
range (<=4.2.0), even though the GitHub advisory does not identify a first
patched version.

The selector-parser override is an intentional transitive-major update:
the security fix is not available on 6.x. Tailwind remains on 3.x, with a
focused regression test for hover, focus, group, ARIA, and arbitrary child
selectors. No framework-major migration is included.

Update setup-node to v7.1.0 and upload-artifact to v7.0.2, preserving full
commit-SHA pins verified against the official Action repositories.

Lockfile and compatibility guarantees

• Preserve all 78 native package variants and all 208 optional package
  records, including Windows, Linux, and macOS build dependencies.
• npm rehomes sharp and its native packages under the desktop workspace;
  this is generated lockfile layout, not missing platform coverage.
• Keep every remote tarball on registry.npmjs.org.
• Add guards for every resolved security-sensitive copy, not just manifest
  ranges, plus native-package and CSS compatibility regression coverage.
• Keep the root and desktop application versions at 0.3.103.
• No new runtime dependencies, IPC contracts, registered resource types,
  deployment behavior, or localization changes. Existing dependency licenses
  remain unchanged.

Hosted validation

Preparation run:
https://github.com/Azure/ConfigForge/actions/runs/38810656478

• Clean hosted npm ci for focused checks, with lifecycle scripts disabled
  for that preparation install only.
• 29 dependency-metadata and CSS compatibility tests pass.
• Public packaging guard and its 8 Node tests pass.
• Production audit reports 0 vulnerabilities.
• Every residual full-audit node is verified as development-only.

Full PR validation also passed:
https://github.com/Azure/ConfigForge/actions/runs/38811070654

• Normal clean-install lifecycle, lint, and production audit.
• 1,935 Vitest tests across 126 files.
• Linux desktop build and dist-artifact verification.
• Node 24 source-build compatibility.
• Windows Electron smoke: 87 passed, 1 skipped; no existing smoke
  assertions were weakened.
• Both required CodeQL contexts (javascript-typescript and actions),
  the CodeQL summary, docs build, and CLA check are green.
• GitHub's dependency comparison reports no newly added vulnerable entries.

All required automated checks are satisfied. The PR still requires its
normal human approval; no protection rule or review gate is bypassed.

Remaining upstream development-only advisories

These are additional findings from the full audit, not unresolved copies of
the 19 original Dependabot alerts:

Package	Advisory	Upstream state
braces 3.0.3	GHSA-vfj7-8cjw-p6xm - high	Latest published version is affected; no patched release
sprintf-js 1.1.3	GHSA-hp3w-g68c-fv3c - moderate	Latest published version is affected; no patched release

Their transitive propagation accounts for the full audit's 13 affected
development-dependency entries: 5 high and 8 moderate, but only two
distinct underlying advisories. The production tree is clean. No alert is
dismissed, no audit suppression is added, and the production audit gate is
unchanged. Do not force a Tailwind 4 migration or downgrade electron-builder
just to hide these findings.

Scope and follow-up

This PR targets main. It does not cross-merge mac-author-build; port the
reviewed shared dependency changes through a separate author-build PR after
the main change lands.

The existing Dependabot PRs are left untouched until this consolidated
change is reviewed and merged. No releases or tags are created.