[RubenGlez]

Summary

Patches critical and high severity vulnerabilities reported by pnpm audit, using the smallest upgrade within the same major version (no breaking major bumps).

• Direct dependencies: version range bumped in package.json.
• Transitive dependencies: scoped overrides (only the vulnerable range is redirected).

Advisory	Package	Severity	Version
GHSA-cg2g-xh64-v4q7	dompurify	critical	3.4.11 → ≥3.4.17
GHSA-27p8-2357-5qqv	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-27p8-2357-5qqv	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-2m5v-pch6-74hx	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-2v37-7h3g-55p8	nanoid	high	3.3.16 → ≥3.3.18
GHSA-3px3-54cx-rmw9	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-4cwx-7wf7-3272	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-4w3w-2rp5-g8jm	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-4w3w-2rp5-g8jm	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-4w7w-5xrc-9h26	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-587h-7wmj-h5pm	vite	high	8.1.0 → ≥8.1.6
GHSA-5jgf-p345-68v8	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-68fv-2mgg-jv7q	source-map-js	high	1.2.1 → ≥1.2.2
GHSA-6j4f-fj2g-mc7p	brace-expansion	high	5.0.8 → ≥5.0.12
GHSA-6mj3-qw4j-hgrw	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-73wf-gq98-2v4g	browserslist	high	4.28.2 → ≥4.28.7
GHSA-7p8r-x3mc-p8w7	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-8344-3jmq-59r6	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-8344-3jmq-59r6	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-93r5-fhx6-vmg9	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-93r5-fhx6-vmg9	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-965w-775f-mr7g	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-965w-775f-mr7g	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-9f4c-93c8-jc8g	electron	high	41.6.1 → ≥41.10.6
GHSA-9qh4-3jw8-366w	electron	high	41.6.1 → ≥41.10.6
GHSA-c7q8-3ch8-vqpv	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-c7q8-3ch8-vqpv	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-c83g-rgw3-j3cx	browserslist	high	4.28.2 → ≥4.28.7
GHSA-f65p-4m7j-42xc	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-fph4-wmhf-6fwf	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-g53g-w8rj-fmg7	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-gr2m-v5gq-v685	electron	high	41.6.1 → ≥41.10.6
GHSA-hq2x-r82h-9wj4	electron	high	41.6.1 → ≥41.10.6
GHSA-j84w-jfhq-vhvj	electron	high	41.6.1 → ≥41.10.6
GHSA-jqff-g426-hqxp	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-mrhx-c7xc-m3w5	zod	high	4.4.3 → ≥4.6.6
GHSA-mrv2-3pqr-j5jr	dompurify	high	3.4.11 → ≥3.4.17
GHSA-qhr7-859c-m2p7	brace-expansion	high	5.0.8 → ≥5.0.12
GHSA-qrxm-fqhp-jwvm	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-qw65-cvwx-89v3	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-r292-9mhp-454m	tar	high	7.5.20 → ≥7.5.21
GHSA-rfgv-xxqx-mfg5	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-rgw5-rvv9-x895	brace-expansion	high	5.0.8 → ≥5.0.12
GHSA-vr34-hp96-76pp	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-w293-vg96-wgc3	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-w2rr-34g9-rvrj	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-w2rr-34g9-rvrj	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-x4fp-j954-r2f4	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-xjj6-f33q-929c	undici	high	8.5.0 (node-gyp) → ≥6.29.1

Not fixed (requires a major upgrade)

Package	Installed	Advisories	Patched in
electron	41.10.6	HIGH GHSA-jr5w-w6x2-84p9	>=42.11.16
extract-zip	2.0.1	HIGH GHSA-jmr9-qjv8-65gv, HIGH GHSA-7pqw-9j4j-h8q3	>=2.0.2

Verification

• pnpm audit: 1 critical + 51 high → 0 critical, 1 high remaining (electron 41 → needs 42)
• Fixed pre-existing override undici@<6.27.0: >=6.27.0 → ^6.27.0. The open-ended range was resolving node-gyp's undici (declared ^6.25.0) to vulnerable 8.5.0; it now gets 6.29.1.
• Pre-existing overrides bumped: brace-expansion 5.0.8 → 5.0.12, tar ^7.5.16 → ^7.5.21
• Local: tsc ✅ lint ✅ test ✅ vite build ✅ (full build fails at electron-builder packaging because package.json author has no email — unrelated, same on main)

---

Generated by Claude Code

Summary

Patches critical and high severity vulnerabilities reported by pnpm audit and OSV. Same-major upgrades and scoped overrides where a patched release exists. The one remaining high, Electron GHSA-jr5w-w6x2-84p9, has no 41.x fix and is bumped to the first patched release, 42.11.16.

• Direct dependencies: version range bumped in package.json.
• Transitive dependencies: scoped overrides (only the vulnerable range is redirected).

Advisory	Package	Severity	Version
GHSA-cg2g-xh64-v4q7	dompurify	critical	3.4.11 → ≥3.4.17
GHSA-27p8-2357-5qqv	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-27p8-2357-5qqv	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-2m5v-pch6-74hx	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-2v37-7h3g-55p8	nanoid	high	3.3.16 → ≥3.3.18
GHSA-3px3-54cx-rmw9	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-4cwx-7wf7-3272	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-4w3w-2rp5-g8jm	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-4w3w-2rp5-g8jm	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-4w7w-5xrc-9h26	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-587h-7wmj-h5pm	vite	high	8.1.0 → ≥8.1.6
GHSA-5jgf-p345-68v8	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-68fv-2mgg-jv7q	source-map-js	high	1.2.1 → ≥1.2.2
GHSA-6j4f-fj2g-mc7p	brace-expansion	high	5.0.8 → ≥5.0.12
GHSA-6mj3-qw4j-hgrw	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-73wf-gq98-2v4g	browserslist	high	4.28.2 → ≥4.28.7
GHSA-7p8r-x3mc-p8w7	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-8344-3jmq-59r6	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-8344-3jmq-59r6	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-93r5-fhx6-vmg9	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-93r5-fhx6-vmg9	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-965w-775f-mr7g	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-965w-775f-mr7g	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-9f4c-93c8-jc8g	electron	high	41.6.1 → ≥41.10.6
GHSA-9qh4-3jw8-366w	electron	high	41.6.1 → ≥41.10.6
GHSA-c7q8-3ch8-vqpv	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-c7q8-3ch8-vqpv	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-c83g-rgw3-j3cx	browserslist	high	4.28.2 → ≥4.28.7
GHSA-f65p-4m7j-42xc	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-fph4-wmhf-6fwf	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-g53g-w8rj-fmg7	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-gr2m-v5gq-v685	electron	high	41.6.1 → ≥41.10.6
GHSA-hq2x-r82h-9wj4	electron	high	41.6.1 → ≥41.10.6
GHSA-j84w-jfhq-vhvj	electron	high	41.6.1 → ≥41.10.6
GHSA-jqff-g426-hqxp	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-jr5w-w6x2-84p9	electron	high	41.10.6 → 42.11.16
GHSA-mrhx-c7xc-m3w5	zod	high	4.4.3 → ≥4.6.6
GHSA-mrv2-3pqr-j5jr	dompurify	high	3.4.11 → ≥3.4.17
GHSA-qhr7-859c-m2p7	brace-expansion	high	5.0.8 → ≥5.0.12
GHSA-qrxm-fqhp-jwvm	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-qw65-cvwx-89v3	fast-uri	high	3.1.4 → ≥3.1.9
GHSA-r292-9mhp-454m	tar	high	7.5.20 → ≥7.5.21
GHSA-rfgv-xxqx-mfg5	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-rgw5-rvv9-x895	brace-expansion	high	5.0.8 → ≥5.0.12
GHSA-vr34-hp96-76pp	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-w293-vg96-wgc3	undici	high	8.5.0 (node-gyp) → ≥6.29.1
GHSA-w2rr-34g9-rvrj	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-w2rr-34g9-rvrj	@xmldom/xmldom	high	0.9.10 → ≥0.9.12
GHSA-x4fp-j954-r2f4	@xmldom/xmldom	high	0.8.13 → ≥0.8.15
GHSA-xjj6-f33q-929c	undici	high	8.5.0 (node-gyp) → ≥6.29.1

Follow-up (b24a653)

dependency-review failed on 4cfad47 because electron@41.10.6 still matched GHSA-jr5w-w6x2-84p9 / CVE-2026-115570 (high; patched < 42.11.16 → 42.11.16). 41.10.7 is inside the same range. The same package also carried the moderate/low advisories that the gate reports at its default low threshold; those patch lines are all older than 42.11.16, so they clear with this bump.

better-sqlite3 moves ^12.10.0 → ^12.10.1 (locked at 12.10.1). 12.10.0 does not compile against Electron 42 V8 headers (WiseLibs/better-sqlite3#1475, merged in 12.10.1). electron-rebuild -f -w better-sqlite3 completes.

extract-zip is not in the lockfile. The tree has @electron-internal/extract-zip@1.0.8, which OSV does not list. npm extract-zip stops at 2.0.1; GHSA-jmr9-qjv8-65gv and GHSA-7pqw-9j4j-h8q3 have first_patched_version: null and last_affected: 2.0.1. pnpm audit does not report that package.

Left at moderate (out of scope)

pnpm audit after this bump: 0 critical, 0 high, 6 moderate (fflate, vitest / @vitest/mocker, js-yaml, minimatch). OSV agrees there is no remaining advisory labeled high or critical. These were not changed.

Verification

• Local: tsc, lint, vitest (19), vite build, electron-rebuild for better-sqlite3.
• pnpm audit --audit-level=high and --prod: exit 0.
• CI on b24a653172ca4f51c527d50343a0142ca98df49c: check success, dependency-review success (no vulnerable packages at low or higher).

Not merged.

  

[RubenGlez]

Automated review — not merged. Diff reviewed: 1 critical + 51 high → 1 high. Fixed a pre-existing override (undici@<6.27.0: ">=6.27.0" was resolving node-gyp's undici ^6.25 to vulnerable 8.5.0). Local tsc/lint/test/vite build pass; CI check is green.

dependency-review fails because electron 41.10.6 (the newest 41.x) still carries advisories that are only fixed in electron 42 (1 high: GHSA-jr5w-w6x2-84p9, plus moderates). The previous 41.6.1 had more. Fully clearing it needs a major Electron upgrade — leaving that decision to you.

---

Generated by Claude Code