[max-scopp]

Scope

Security-only follow-up to #396; #394 remains closed as a duplicate. Weekly Dependabot scheduling already exists and is unchanged. Only root package.json overrides and pnpm-lock.yaml change; Rust and #395 remain untouched.

Exact updates

• DOMPurify 3.4.16 → 3.4.17: alerts ci: rolling canary desktop release on every merge to main #153, ci: universal + signed macOS bundles, MSI-safe version, faster canary #156, fix(ui): printer connection test and file download in Tauri #157 (GHSA-cg2g-xh64-v4q7, GHSA-c6gr-qvv4-5v3f, GHSA-mrv2-3pqr-j5jr). Affected ranges end at 3.4.16; minimum fix 3.4.17.
• fast-uri 3.1.8 → 3.1.9: alerts feat(settings): schema-driven field relevance across settings & profiles #158, chore(deps): clear Dependabot backlog (Angular 22, sea-orm 2, reqwest 0.13) #169–171 (GHSA-wjr9-j795-jxcr, GHSA-333x-w4r6-6crp, GHSA-xhq7-xmqj-769h, GHSA-w74x-v6f9-j3xg). Installed 3.x affected ranges are >=3.1.3 <3.1.9 or >=3.0.0 <3.1.9; minimum compatible fix 3.1.9. Override is restricted to 3.x.
• Vite 6.4.3 → 6.4.5 and 8.3.0 → 8.3.3: alerts analysis: track gcode diagnostic scripts & repro configs #147–152 and fix(ci): keep canary bundles downloadable and fix macOS launch #164–168. Advisory IDs: GHSA-698v-4r3x-3vcv, GHSA-587h-7wmj-h5pm, GHSA-r825-w8mm-5pxw, GHSA-vfpm-58rq-9qcg, GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22. Installed affected ranges <=6.4.3 and >=8.3.0 <=8.3.2 have fixes 6.4.4 and 8.3.3; use 6.4.5 because the audit also identifies GHSA-8g5g-mxqh-grgj in exactly 6.4.4, fixed in 6.4.5.
• Vue and its compiler/runtime/reactivity/shared/server-renderer family 3.5.33 → 3.5.42: alert chore(deps): bump typescript from 5.9.3 to 7.0.2 #144 (GHSA-g2v6-rqmx-r4w6), affected <3.5.42. Keep the family aligned, including VitePress shared dependency.
• Vite 8.3.3 requires rolldown ~1.2.11: its dependency resolves 1.2.8 → 1.2.16 with matching optional platform bindings and added @oxc-project/types 0.156.0. Existing Rolldown 1.2.8 remains for other consumers. No unrelated direct dependency upgrades.

Validation

Passed with pnpm 10.33.0:

• pnpm install --lockfile-only; pnpm install --frozen-lockfile
• pnpm --filter slicer-ui exec prettier --check "src//*.{ts,html,scss,css}" "!src/generated/"
• pnpm --filter slicer-ui exec tsc --noEmit -p tsconfig.app.json
• pnpm --filter slicer-ui exec tsc --noEmit -p tsconfig.spec.json
• pnpm --filter slicer-ui exec ng test --watch=false: 49 files / 515 tests passed
• pnpm --filter slicer-ui build --stats-json
• pnpm --filter slicer-engine-docs docs:build
• git diff --check

Used the ui-hydrated artifact from successful main Frontend CI run 38736713730 (9558289); no local Rust build. Generated artifact files were excluded from local formatting, matching the CI intent of formatting before hydration. CI runs its unchanged full formatting command on the clean checkout.

Builds succeeded with warnings: older artifact lacks resolveSliceParams; unused Angular imports; initial bundle 761.41 kB exceeds the 750 kB warning threshold (not the error threshold), component CSS warnings, and docs chunks >500 kB. Install reports Mermaid/KaTeX peer mismatches already present and the existing broad Vite override rewrites basic-ssl peer expectations to Vite 6; no hooks or CI checks bypassed.

Remaining blockers

• pnpm audit --json exits nonzero for exactly one remaining low-severity advisory: chore(deps): bump @angular/router from 21.2.10 to 22.1.3 #146 / GHSA-238p-pmpm-9mq7, KaTeX >=0.11.0 <0.18.2. Path ui → ngx-markdown@22.1.1 → mermaid@11.17.2 → katex@0.16.47. Fix >=0.18.2 is outside Mermaid 11.17.2 requirement ^0.16.47; ngx-markdown requires Mermaid >=10.6.0 <12.0.0. Leave this for a separately tested compatibility upgrade instead of forcing an unsupported version. No audit suppressions.
• Rust zip alerts ci: fix macOS bundle signing when Apple secrets not configured #159–163 remain blocked on the major upgrade tracked by chore(deps): update zip requirement from 8.6 to 9.1 #395; Cargo files unchanged.

Do not merge until required CI checks are green.

[github-actions]

Preview: https://pr-398.coldcrabby-slicer.pages.dev — the web slicer, with the docs at /docs/.

Built from 6c80d79; every push updates it, and it is taken down when this pull request closes. Pinned to this exact commit: https://649166c7.coldcrabby-slicer.pages.dev