[Harry19081]

Problem

Dependabot has 109 open alerts on develop. In 79 of them, a patched release already fits the version range the parent package declares, so no manifest change is needed. The lockfiles simply still pin the vulnerable versions: 51 alerts in pnpm-lock.yaml and 28 in tests/e2e/pnpm-lock.yaml.

Only one of these packages ships in the desktop app: @xmldom/xmldom@0.8.12. It comes in through mammoth, which converts .docx files for the file viewer and git-diff binary previews. Its parser has quadratic time/memory and regex-backtracking bugs reachable from DOMParser.parseFromString (GHSA-965w-775f-mr7g, GHSA-8344-3jmq-59r6, GHSA-x4fp-j954-r2f4, GHSA-93r5-fhx6-vmg9). A crafted .docx in a repository or branch can therefore hang the webview when previewed. Its remaining advisories concern XMLSerializer, which mammoth does not use.

Everything else is build, lint, unit-test, and WebdriverIO tooling.

Solution

This updates only the flagged packages, each to the newest patched version inside its existing range, using the pinned pnpm 9.15.4.

pnpm-lock.yaml:

Package	From	To
@xmldom/xmldom (runtime, via mammoth)	0.8.12	0.8.15
svgo	3.3.3, 4.0.1	3.3.5, 4.1.0
undici	7.28.0	7.29.1
fast-uri	3.1.0	3.1.7
js-yaml	4.1.1	4.3.2
immutable	5.1.5	5.1.9
flatted	3.4.1	3.4.4
postcss-selector-parser	7.1.1	7.1.6
linkify-it	5.0.1	5.0.2
@babel/plugin-transform-modules-systemjs	7.29.0	7.29.8
brace-expansion	1.1.12, 2.0.2, 5.0.4	1.1.18, 2.1.4, 5.0.9

• These now resolve to versions the lockfile already contained:
  • browserslist 4.28.9, together with its baseline-browser-mapping, electron-to-chromium, node-releases, and update-browserslist-db data packages
  • lodash-es 4.18.1
  • ws 8.21.3
• svgo 4.1.0 adds three new packages: css-select@6.0.0, css-what@7.0.0, and sax@1.6.1.

tests/e2e/pnpm-lock.yaml:

• undici 6.25.0 / 7.25.0 → 6.28.1 / 7.29.1
• ws 8.20.1 → 8.21.3
• js-yaml 4.1.1 → 4.3.2
• ip-address 10.2.0 → 10.7.0
• esbuild 0.28.0 → 0.28.2, plus its platform binaries
• brace-expansion 1.1.14 / 2.1.0 → 1.1.18 / 2.1.4

No package.json changes, and both lockfiles' importers sections are unchanged.

pnpm update also re-resolved nan (a build dependency of node-sass) and the e2e react-is alias, and rewrote some e2e peer suffixes. Those entries were restored to what develop pins, and pnpm accepts the result as consistent.

Note for anyone regenerating these files: .npmrc sets prefer-offline=true. With a stale local metadata cache, pnpm update silently downgraded unrelated packages (for example @codemirror/state 6.7.4 → 6.7.1). Run it with npm_config_prefer_offline=false.

The other 30 alerts are out of scope. Each needs a parent upgrade, has no patched release, or is in a Rust lockfile:

• tar and friends under the unused node-sass peer (removed separately in build(deps): stop installing unused node-sass #1793)
• serialize-javascript 6, uuid 8 via sockjs, qs via express
• minimatch 9.0.3 pinned by typescript-eslint 6
• prismjs via refractor 3, linkify-it 3 via ansi-to-react
• esbuild via esbuild-loader, extract-zip
• Rust crates

Potential risks

• Stricter .docx parsing. xmldom 0.8.15 reports a not-well-formed end tag (for example </w:body junk>) as an error. mammoth turns any parser error into an exception, so such a file now shows the preview error state instead of rendering. Word, LibreOffice, and Google Docs do not write that markup, and well-formed documents convert byte-identically (see Verification).
• e2e ip-address. 10.7.0 rejects IPv4 octets with leading zeros. In the e2e tree it is reached only through socks for SOCKS-proxied browser downloads; the suite talks to a local tauri-driver.
• Tooling behavior. svgo, cssnano's selector parser, browserslist data, Sass's immutable, ESLint's js-yaml/flatted/minimatch, and jsdom's undici all move within semver-compatible ranges. The production build comparison below shows no CSS or SVG output change. The rspack dev server uses the same loaders but was not run.
• Lockfile conflict. build(deps): stop installing unused node-sass #1793 (stop installing the unused node-sass peer) and build(deps): declare terser-webpack-plugin as a dev dependency #1794 (move terser-webpack-plugin to devDependencies) also edit pnpm-lock.yaml. build(deps): stop installing unused node-sass #1793 overlaps this diff (for example the brace-expansion entries), so whichever of the two merges second needs a rebase plus pnpm install --lockfile-only.
• Rollback. Revert the commit. Only lockfiles change: no persistence, schema, IPC, or runtime configuration is affected.

Verification

• Installs. pnpm install --frozen-lockfile succeeds at the root and in tests/e2e (with --ignore-workspace). pnpm install --lockfile-only leaves both lockfiles byte-identical.

• Alert coverage. Re-evaluated every Dependabot alert's vulnerable range against the new lockfiles:

  • Root: 51 cleared; exactly the 21 out-of-scope alerts still match.
  • e2e: 28 cleared; serialize-javascript and extract-zip (4 alerts) remain.

• New advisories. Checked each newly added version (15 root, 34 e2e) against the GitHub Advisory Database: 0 matches.

• Production build. Ran pnpm build (webpack, production, cold cache) in the same worktree before and after:

  • 906 files each, 901 byte-identical, 0 warnings.
  • The 5 differences: the xmldom vendor chunk (+3 KB), the mammoth vendor chunk (same size, 3 module-id references), the runtime chunk-hash map, and the runtime <script> reference in index.html and mobile.html.
  • No CSS or SVG-component output changed.

• .docx conversion. Compared mammoth output with xmldom 0.8.12 vs 0.8.15 on generated fixtures, and HTML plus conversion messages were identical. The fixtures cover:

  • formatting, lists, a table, an image, a hyperlink, and Unicode
  • 40-level nested tables
  • 50-space end-tag whitespace

  A malformed end tag now errors, as described above.

• Unit tests. pnpm run test (Vitest 4.1.11): 1899 files passed; 14102 tests passed, 3 expected failures, 1 skipped.

• Lint. ESLint (--max-warnings 0, cache written then read back) and prettier --check on four source files: clean.

• markdown-it 14.2.0 + linkify-it 5.0.2. Loads; linkify stays off by default and works when enabled.

• e2e smoke script. Passes against the updated tree:

  • imports webdriverio, @wdio/cli, @wdio/local-runner, @wdio/mocha-framework, and @wdio/spec-reporter
  • HTTP round trips through both undici copies, and a ws echo
  • js-yaml merge keys, an esbuild transform via tsx, and minimatch brace globs
  • the exact ip-address calls socks makes, with results identical to 10.2.0 for valid addresses
  • wdio --version

• Not run.

  • the WebdriverIO specs (they need a built app plus tauri-driver, and are not part of CI)
  • a Tauri app launch
  • the rspack dev server
  • no screenshots, since the shipped bundle changes only in the xmldom chunk

• Hooks. Committed from a git worktree. Hooks ran (lint-staged had nothing to do; no TypeScript or Rust was staged), but the Pre-commit hook ran. trailer is not appended in a worktree.