chore(deps): update vulnerable packages to patched versions

Updated packages:
- simple-git 3.32.3 → 3.36.0 (RCE vulnerability)
- fast-uri 3.1.0 → 3.1.2 (host confusion, path traversal)
- dompurify 3.3.1 → 3.4.5 (XSS bypasses)
- mermaid 11.13.0 → 11.15.0 (CSS injection, DoS)
- uuid 11.1.0 → 11.1.1 (buffer bounds check)
- ws 8.20.0 → 8.20.0 (uninitialized memory)
- ip-address 10.1.0 → 10.2.0 (XSS)
- @xmldom/xmldom 0.8.11 → 0.9.10 (XML injection, DoS)
- docx4js 3.3.0 → 2.0.1 (breaks xml2js dep chain)
- brace-expansion (transitive update)

Also applied lint:fix autofix (const correctness).

Amit Haridas

src/main/PDFOperations.js

@@ -60,13 +60,13 @@ async function pdfSplit(data) {
     const pdf = await PDFDocument.load(pdfBytes);
     const totalPages = pdf.getPageCount();
 
-    let splits = [];
+    const splits = [];
 
     if (data.splitMode === 'pages') {
       const ranges = data.pageRanges.split(',').map(r => r.trim());
       for (let i = 0; i < ranges.length; i++) {
         const range = ranges[i];
-        let pages = [];
+        const pages = [];
 
         if (range.includes('-')) {
           const [start, end] = range.split('-').map(n => parseInt(n.trim()));

src/renderer.js

@@ -132,7 +132,7 @@ function plantumlEncode(text) {
 }
 
 // Module-level reference set by DOMContentLoaded after sidebar registration
-let outlinePanelContainer = null;
+const outlinePanelContainer = null;
 
 // Tab Management
 class TabManager {
@@ -1489,7 +1489,7 @@ document.addEventListener('DOMContentLoaded', async () => {
     // Initialize sidebar
     const SidebarManager = getSidebarManager();
     const sidebarManager = new SidebarManager();
-    let explorerCurrentDir = null;
+    const explorerCurrentDir = null;
 
     sidebarManager.registerPanel('explorer', {
         title: 'Explorer',
@@ -3416,7 +3416,7 @@ function showPDFValidationMessage(message, focusSelector = null) {
 // Process PDF Operation
 function processPDFOperation() {
     const operation = currentPDFOperation;
-    let operationData = { operation };
+    const operationData = { operation };
 
     try {
         switch (operation) {
@@ -4206,7 +4206,7 @@ function textToASCII(text, style) {
         lines[i] = '';
     }
 
-    for (let char of upperText) {
+    for (const char of upperText) {
         const charLines = font.chars[char] || font.chars[' '];
         if (charLines) {
             for (let i = 0; i < font.height; i++) {
@@ -4244,7 +4244,7 @@ function createASCIIBox(text, style, padding) {
     }
 
     // Content lines
-    for (let line of lines) {
+    for (const line of lines) {
         const paddedLine = line.padEnd(maxLength, ' ');
         result += chars.v + ' '.repeat(padding) + paddedLine + ' '.repeat(padding) + chars.v + '\n';
     }

src/wordTemplateExporter.js

@@ -655,7 +655,7 @@ class WordTemplateExporter {
      */
     parseInlineFormatting(text) {
         let xml = '';
-        let pos = 0;
+        const pos = 0;
 
         // Patterns for inline formatting
         const patterns = [

src/zen-mode.js

@@ -117,7 +117,7 @@ class ZenMode {
     _applyTypewriterBehavior(view) {
         // We use a custom update listener that scrolls the cursor to center.
         // This is stored on the instance so we can clean it up.
-        let scrollTimeout = null;
+        const scrollTimeout = null;
 
         const scrollFn = () => {
             if (!this.active) return;