chore: refresh PDF, scrolling, and desktop dependencies

[steipete]

Updates the dependencies behind PDF previews, virtualized lists, and the desktop shell: PDF.js 6.2.108 → 6.3.289, virtua 0.50.6 → 0.51.0, and Electron 43.4.1 → 43.5.1. The embedded web assets are regenerated from the updated lockfile; application and test source are unchanged. The Unreleased changelog records the maintenance update.

All three versions cleared the existing 48-hour release-age policy at the fixed September 4, 09:24 UTC audit cutoff. A complete Electron 43 audit found 43.5.1 eligible; 43.6.0 remains too young. Node and macOS minimums, package-manager policy, PDF allocation limits, navigation isolation, and settings/authentication contracts are unchanged.

Virtua's removed legacy-browser fallbacks are compatible with the existing Vite browser targets: ClickClack uses vertical virtualizers and no smooth-scroll option. PDF.js's changed metadata return types affect APIs the viewer does not call. Electron remains on the supported 43 line; the packaged app and both arm64/x64 Electron frameworks declare macOS 12 as their minimum.

Validation:

• Frozen pnpm install and integrity/release-age audit for all three new lockfile entries; pnpm check; coverage 86.6%; web/SDK/server/desktop/docs builds.
• All 377 browser tests pass with two workers, without retries, against the built candidate on the standard test ports. This covers PDF rendering, safety fallbacks, scroll ownership, history, search, and live message delivery.
• Actual Foundation-signed native baseline/candidate comparison: PDF pages and text, 120% zoom, oversized-page download fallback, message send, reading-position retention across incoming messages, Escape-to-latest, at-bottom live follow, native Settings server test, and restart persistence. Strict/deep seals, designated requirement, and hardened runtime verified before launch.
• Docker build and live nonroot Linux container: health, embedded app, new PDF worker delivery, CLI message creation, and online backup.
• Complete independent P0–P2 review of the lockfile and every generated asset. One proposed glyph-coordinate fix was rejected: the code already uses separate coordinate arrays, is identical to baseline, and passes a focused two-contour compiler check with a nonidentity transform. No accepted actionable findings remain.

Native proof ran on arm64 macOS 26.6.2; macOS 12 compatibility is verified through bundle and Mach-O minimums, not an actual macOS 12 run. Both baseline and candidate received the same OS denial when applying the existing login-launch preference, so that behavior is not claimed as verified. The existing openapi-typescript/TypeScript peer warning is unchanged. No issue closure is implied by the upstream dependency fixes.

PDF preview before and after, in the signed native app with synthetic data:

Baseline	Candidate

Candidate reading position before and after an incoming synthetic message:

Before arrival	After arrival

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​pdfjs-dist@​6.2.108 ⏵ 6.3.289	+1		+1		-10
	npm/​virtua@​0.50.6 ⏵ 0.51.0	+1			+1
	npm/​electron@​43.4.1 ⏵ 43.5.1			+1

View full report

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 4, 2026, 12:00 PM ET / 16:00 UTC.

ClawSweeper review

What this changes

Updates PDF.js, Virtua, and Electron, refreshes the pnpm lockfile and generated embedded web assets, and records the maintenance update in the changelog.

Merge readiness

✅ Ready for maintainer review

Keep open: current main is the PR's direct parent and still has the prior dependency resolutions, while this clean, focused update has passed its reported checks and the prior CodeQL blocker is now resolved.

Priority: P3
Reviewed head: f6e93e39db7aa29ee5be781e12797b94c05e1833

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	A focused dependency refresh with strong supplied behavior evidence, matching generated output, and no actionable review finding.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (screenshot): The changed production consumers are the PDF artifact viewer, virtualized lists, and Electron desktop package; the captured PR body provides native before/after PDF and reading-position screenshots and reports after-fix browser, desktop, Linux-container, and signed-native validation.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (screenshot): The changed production consumers are the PDF artifact viewer, virtualized lists, and Electron desktop package; the captured PR body provides native before/after PDF and reading-position screenshots and reports after-fix browser, desktop, Linux-container, and signed-native validation.
Evidence reviewed	5 items	Introduced dependency scope: The introduced manifest and lockfile changes update PDF.js 6.2.108→6.3.289, Virtua 0.50.6→0.51.0, and Electron 43.4.1→43.5.1; current main is the parent with the older resolutions. Affected production consumers: The application imports the PDF.js worker for artifact previews and Virtua for message virtualization, so the declared dependency updates match active production consumers. Embedded asset linkage: The Go API embeds the complete web distribution, and the regenerated HTML now points at the corresponding new hashed entry and route chunks; no references to the removed hashed names remain in the distribution.
Findings	None	None.
Security	None	None.

How this fits together

The web app uses PDF.js for artifact previews and Virtua for virtualized message and member lists, then builds those files into assets embedded by the Go API. The desktop package runs the same product inside Electron.

flowchart LR
A[Uploaded PDFs] --> B[Web artifact viewer]
C[Message timelines] --> D[Virtualized lists]
B --> E[Web application build]
D --> E
E --> F[Embedded API web assets]
G[Desktop application] --> H[Electron runtime]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency and generated scope	3 direct resolutions updated; 17 embedded web-asset files refreshed	Most changed lines are the expected compiled distribution accompanying two web dependency updates.

Technical review

Best possible solution:

Land the focused dependency refresh after normal draft-to-ready maintainer workflow, retaining the lockfile and regenerated embedded assets together.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is a dependency-maintenance change rather than a report of a currently failing behavior; its supplied native and browser validation exercises the affected paths.

Is this the best way to solve the issue?

Yes: updating the manifests, lockfile, and generated embedded distribution together is the narrow maintainable path for these active dependencies.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against fa52084a04bf.

Labels

Label justifications:

• P3: This is a bounded maintenance refresh with no reported user-facing regression and successful completed checks.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The changed production consumers are the PDF artifact viewer, virtualized lists, and Electron desktop package; the captured PR body provides native before/after PDF and reading-position screenshots and reports after-fix browser, desktop, Linux-container, and signed-native validation.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed production consumers are the PDF artifact viewer, virtualized lists, and Electron desktop package; the captured PR body provides native before/after PDF and reading-position screenshots and reports after-fix browser, desktop, Linux-container, and signed-native validation.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The changed production consumers are the PDF artifact viewer, virtualized lists, and Electron desktop package; the captured PR body provides native before/after PDF and reading-position screenshots and reports after-fix browser, desktop, Linux-container, and signed-native validation.

Evidence

What I checked:

• Introduced dependency scope: The introduced manifest and lockfile changes update PDF.js 6.2.108→6.3.289, Virtua 0.50.6→0.51.0, and Electron 43.4.1→43.5.1; current main is the parent with the older resolutions. (apps/web/package.json:23, f6e93e39db7a)
• Affected production consumers: The application imports the PDF.js worker for artifact previews and Virtua for message virtualization, so the declared dependency updates match active production consumers. (apps/web/src/components/artifacts/ArtifactViewer.svelte:34, f6e93e39db7a)
• Embedded asset linkage: The Go API embeds the complete web distribution, and the regenerated HTML now points at the corresponding new hashed entry and route chunks; no references to the removed hashed names remain in the distribution. (apps/api/internal/webassets/webassets.go:11, f6e93e39db7a)
• Current checks and supplied proof: The captured PR context reports successful CodeQL, desktop, browser, Docker, TypeScript, Go, and Socket checks, plus before/after native PDF and reading-position screenshots. This resolves the prior ClawSweeper request to clear or explain CodeQL. (f6e93e39db7a)
• Recent area history: Recent merged main history includes steipete's message-state and history-position work, making that contributor a relevant routing contact for the virtualized-list portion. (apps/web/src/components/messages/MessageList.svelte:26, 6b13de3c3615)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-04T11:51:50.430Z sha f6e93e3 :: blocked before merge. :: none