[Harry19081]

Problem

terser-webpack-plugin sits in dependencies, but only config/webpack.config.js requires it. It never reaches the app bundle. Dependabot classifies alerts by whether a package is reachable from dependencies, and this plugin's peer webpack pulls in webpack-cli and webpack-dev-server. As a result, 15 open alerts in pure build and dev-server tooling are labeled runtime: fast-uri, browserslist, baseline-browser-mapping, qs, uuid, and ws.

That hides the few alerts that really do ship in the desktop app. The only vulnerable runtime reachability left without this plugin is @xmldom/xmldom (via mammoth), linkify-it, and prismjs.

Solution

Move terser-webpack-plugin (same ^5.3.10 specifier) from dependencies to devDependencies, next to webpack and the other build plugins. The lockfile change is limited to moving the same importer entry between the two blocks. packages and snapshots are untouched, so every install resolves and links exactly the same tree.

Potential risks

• Production-only installs. The move would only matter if something installed with devDependencies excluded, such as pnpm install --prod or NODE_ENV=production. No workflow, script, or config does that, and webpack itself is already a devDependency, so such an install could not build anyway.
• Tooling that reads dependency placement. Checked the CI workflows, scripts/ci, scripts/quality, config/dependency-cruiser.cjs, and knip.json; none reads the dependencies/devDependencies split.
• Merge conflicts. chore(deps): patch vulnerable transitive npm dependencies #1792 and build(deps): stop installing unused node-sass #1793 also edit pnpm-lock.yaml. This PR's hunks sit in the importer blocks, away from theirs, but a rebase conflict would be resolved with pnpm install --lockfile-only.
• Rollback. Revert the commit. There is no runtime, data, or configuration effect.

Verification

• Lockfile. pnpm install --lockfile-only (fresh registry metadata) produces only the 3-line importer move, and re-running it leaves the lockfile unchanged.
• Installed tree. Parsed both lockfiles: packages and snapshots are identical to develop, and pnpm install --frozen-lockfile succeeds.
• Classification. pnpm why terser-webpack-plugin lists it under devDependencies. Recomputing reachability from dependencies on the develop lockfile, the vulnerable runtime set shrinks to @xmldom/xmldom, linkify-it, and prismjs.
• Not run. Build, tests, and lint were not re-run locally, because the installed dependency tree is byte-for-byte the same; CI runs typecheck, full lint, and unit tests. There is no visual evidence because nothing user-visible changes.
• Hooks. Committed from a git worktree. Hooks ran (lint-staged formatted package.json; no TypeScript or Rust was staged), but the Pre-commit hook ran. trailer is not appended in a worktree.