fix(deps): port October security fixes to macOS Author

.github/workflows/docs.yml

@@ -62,7 +62,7 @@ jobs:
         run: cd docs && mdbook build
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: book
           path: docs/book

.github/workflows/pr-check.yml

@@ -47,7 +47,7 @@ jobs:
     timeout-minutes: 8
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
@@ -71,7 +71,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
@@ -107,7 +107,7 @@ jobs:
     timeout-minutes: 12
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: npm
@@ -126,7 +126,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
@@ -177,10 +177,62 @@ jobs:
       # can post-mortem without re-running the spec locally.
       - name: Upload Playwright artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-failure-artifacts
           path: |
             apps/desktop/test-results/
             apps/desktop/playwright-report/
           retention-days: 7
+
+  mac-author:
+    name: macOS Author build and capability boundary
+    if: github.base_ref == 'mac-author-build' || github.ref == 'refs/heads/mac-author-build'
+    runs-on: macos-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+      - name: Install
+        run: npm ci
+      - name: Audit production dependencies
+        run: npm audit --omit=dev --audit-level=high
+      - name: Build the author edition and native icons
+        run: |
+          npm run core:build
+          npm run build:author -w @configforge/desktop
+          npm run icons -w @configforge/desktop
+      - name: Verify compiled author capability boundary
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict';
+          import { readFileSync } from 'node:fs';
+          import { runInNewContext } from 'node:vm';
+          const namespaces = {};
+          const preloadModule = { exports: {} };
+          const electron = {
+            contextBridge: { exposeInMainWorld: (name, api) => { namespaces[name] = api; } },
+            ipcRenderer: { on() {}, removeListener() {}, invoke() {} },
+          };
+          runInNewContext(readFileSync('apps/desktop/dist/electron/preload.js', 'utf8'), {
+            module: preloadModule,
+            exports: preloadModule.exports,
+            require: (name) => {
+              assert.equal(name, 'electron');
+              return electron;
+            },
+            process: { platform: 'darwin', env: {} },
+            console,
+          });
+          assert.ok(namespaces.cfs);
+          for (const name of ['health', 'deploy', 'deployRecovery', 'revert', 'auditResults', 'system']) {
+            assert.equal(name in namespaces.cfs, false, `Author edition exposes ${name}`);
+          }
+          for (const name of ['manifests', 'cis', 'diff', 'auditPack']) {
+            assert.ok(namespaces.cfs[name], `Author edition is missing ${name}`);
+          }
+          console.log('Authoring APIs preserved; device-operation APIs omitted.');
+          NODE

.github/workflows/release-mac.yml

@@ -58,7 +58,7 @@ jobs:
           test -n "$tag_commit"
           test "$(git rev-parse HEAD)" = "$tag_commit"
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
@@ -208,7 +208,7 @@ jobs:
       # workflow run page even if the gh release upload step had a hiccup.
       - name: Stash artifacts as workflow outputs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: installers-macos-author
           path: |

.github/workflows/release.yml

@@ -85,7 +85,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
@@ -316,7 +316,7 @@ jobs:
       # publish step had a hiccup. Auto-deletes after 14 days.
       - name: Stash artifacts as workflow outputs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: installers-${{ matrix.os }}
           path: |

CHANGELOG.md

@@ -4,6 +4,24 @@
 
 ### Security
 
+- Update DOMPurify to 3.4.16, Axios to 1.20.0, ip-address to 10.7.2,
+  all supported brace-expansion lines, and both Undici lines for current
+  Dependabot advisories. Guard every resolved copy against regression.
+- Patch additional full-audit findings in sharp, fast-uri, joi, and
+  source-map-js without changing the application's version or framework majors.
+- Update http-cache-semantics to 4.3.0, outside the reported affected range,
+  and override the vulnerable CSS selector parser with 7.1.6+. Preserve
+  Tailwind 3 and cover its generated variants and child selectors in a
+  compatibility regression test.
+- Update concurrently to 9.2.5 and its shell-quote dependency to 1.12.0.
+  Correct the root override that otherwise keeps the vulnerable 1.9.0
+  shell-quote copy despite the parent-package update.
+- Refresh the SHA-pinned setup-node and upload-artifact GitHub Actions.
+- Validate the author build and native icon generation on a hosted macOS
+  runner, including the compiled preload's author-only capability boundary.
+- Keep the unpatched build-only braces (`GHSA-vfj7-8cjw-p6xm`) and
+  sprintf-js (`GHSA-hp3w-g68c-fv3c`) advisories visible. Neither upstream
+  package has a patched release; no advisory is suppressed or dismissed.
 - Upgrade the pinned CycloneDX SBOM generator to 6.0.0 to fix Windows
   workspace-argument shell injection (`GHSA-q69g-4hcv-6jg4`). Guard the
   manifest and every lockfile copy against reintroducing a vulnerable release.

apps/desktop/package.json

@@ -56,7 +56,7 @@
     "@typescript-eslint/parser": "^8.59.2",
     "@vitejs/plugin-react": "^4.3.4",
     "autoprefixer": "^10.5.0",
-    "concurrently": "^9.2.4",
+    "concurrently": "^9.2.5",
     "cross-env": "^7.0.3",
     "electron": "~42.11.3",
     "electron-builder": "~26.15.3",
@@ -67,7 +67,7 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-router-dom": "^7.18.2",
-    "sharp": "0.35.4",
+    "sharp": "0.35.5",
     "tailwindcss": "^3.4.19",
     "typescript": "^5.7.3",
     "vite": "^6.4.3",

docs/src/changelog.md

@@ -5,6 +5,21 @@ shipped semver tag; older entries summarize the foundational work by theme.
 
 ## Unreleased
 
+- **Dependency security:** Update DOMPurify, Axios, ip-address,
+  every supported brace-expansion and Undici line, and concurrently to
+  patched releases. Also patch sharp, fast-uri, joi, and source-map-js
+  findings uncovered by the full dependency audit.
+  Correct the root shell-quote override so the vulnerable copy is not
+  retained, and add lockfile regression coverage.
+- **Cache and CSS tooling:** Update http-cache-semantics beyond the reported
+  affected range and use a patched CSS selector parser without upgrading
+  Tailwind 3. Cover compiled variant and child-selector compatibility.
+- **CI dependencies:** Refresh the SHA-pinned setup-node and upload-artifact
+  GitHub Actions.
+- **macOS validation:** Build the author edition and native icons on macOS,
+  and verify that its compiled bridge excludes device-operation APIs.
+- **Remaining upstream advisories:** Build-only braces and sprintf-js have
+  no patched releases. Their advisories remain visible without suppression.
 - **SBOM tooling security:** Pin CycloneDX npm 6.0.0 to address
   `GHSA-q69g-4hcv-6jg4`, with regression coverage for resolved versions.
 - **Dependency security:** Port patched xmldom, brace-expansion, and nanoid