fix(deps): clear all npm audit vulnerabilities (27 → 0)

Browse Source

- Remove unused docx4js (only a stale comment referenced it); drops the
  vulnerable transitive xml2js prototype-pollution chain
- Upgrade sharp 0.34 -> 0.35.4 for the libvips CVEs (GHSA-f88m-g3jw-g9cj);
  resize/format API surface unchanged, @img/@napi-rs asarUnpack globs still
  match the new prebuilt layout
- npm audit fix for the rest: electron 41.10.7 (protocol/iframe fixes),
  electron-builder chain (AppImage search-path + updater token leak),
  dompurify 3.4.14, mermaid 11.17.2, tar (PAX parsing, critical), tmp,
  js-yaml, brace-expansion, browserslist, fast-uri, form-data, ip-address,
  nanoid, fflate, @xmldom/xmldom, @babel/core and others

613/613 tests green; lint clean; npm audit reports 0 vulnerabilities

...

This commit is contained in:

amitwh

2026-09-05 20:52:08 +05:30

parent c4dcbd8caf

commit efca458495

3 changed files with 942 additions and 2105 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

package-lock.json

Generated

+940 -2102

File diff suppressed because it is too large Load Diff