[arielshad]

What

Second Dependabot pass, following #935. This upgrades Electron 39 → 44.9.3 and fixes everything else that has a patched release. With #935, this leaves 4 of the original 50 alerts open, and none of them have an upstream fix (see Still open below).

Packaging the desktop app locally also turned up two bugs that predate this PR, and both are fixed here:

1. Shipped installers ran Electron 36. Both electron-builder*.yml pinned electronVersion: '36.9.5' while the workspace used 39.x, so Dependabot (which reads package.json) never saw what users actually ran. package.mjs now passes the installed version (--config.electronVersion), and a test fails if either YAML pins one again.
2. The packaged app crashed on a fresh install with Cannot find module './data/compliance-control-seed.js'. build.mjs compiled migrations one file at a time without their relative imports, and migrations 160+ also import ../add-column. Each migration is now bundled with its relative imports, while npm packages stay external.

Change	Alerts / advisories
electron 39.8.10 → 44.9.3 (inside Electron's support window)	8 from the export + GHSA-fw47-9c62-h3vw (HID/USB, fixed only in 42.11.3+)
extract-zip@2.0.1 gone: Electron ≥41 uses @electron-internal/extract-zip; local patch removed	2
http-cache-semantics override → 4.3.0	1
storybook + @storybook/* 8.6.17 → 8.6.19	GHSA-f2ph-cmg5-wxc8 (critical, published after the export)
umzug 3.8.3 (uses tinyglobby)	removes braces from the runtime tree
node-abi 4.39 (lockfile)	needed: 4.28 can't map Electron 44, so electron-builder failed to rebuild better-sqlite3
drop the @electron/rebuild 3 devDependency	unused; electron-builder ships its own (and warned about it). Also removes the git-hosted @electron/node-gyp

Electron 42–44 behavior changes that apply here

• macOS notifications now go through UNNotification, which emits failed on unsigned builds, and our .dmg is unsigned. ElectronDesktopNotifier now logs failed instead of failing silently. Mac users won't see desktop notifications until the app is code-signed (agreed trade-off for staying on a supported Electron).
• macOS 13+, 64-bit only. Our targets are already x64/arm64.
• Linux frameless windows get rounded corners by default, which the apps-only shell was already designed for.

Tried and reverted

A global-agent 4 override would have removed one sprintf-js path. Testing showed global-agent 4 stops @electron/get from honouring proxies (ELECTRON_GET_USE_PROXY), while 3 works, so it isn't included.

Why

You asked for a clean Dependabot list. Electron 41 would have cleared the export too, but it's already out of support.

Still open (no patched release; please dismiss)

Alert	Reason
@typespec/compiler, @typespec/openapi3 (GHSA-2q42-4q24-7rgv)	Vulnerable code fixed locally: patches/@typespec__openapi3@0.60.0.patch adds the path-separator check, with regression tests in dependency-path-traversal.test.ts. TypeSpec 1.x needs a TypeScript emitter that only supports 0.59.
braces (GHSA-vfj7-8cjw-p6xm)	Dev-only now (semantic-release, lint-staged, tsc-alias, eslint plugins); patterns are never user-supplied.
sprintf-js (GHSA-hp3w-g68c-fv3c)	Reached only via umzug → @rushstack/ts-command-line → argparse CLI help formatting with fixed format strings; Shep uses new Umzug() programmatically. The other path is build-time (electron-builder → @electron/get → global-agent → roarr).

Screenshots / Recording

N/A: no UI change. The desktop app was verified by launch (below).

Testing

• pnpm audit: only the four entries above remain.
• Packaged and launched the desktop app: node scripts/package.mjs full linux built an Electron 44.9.3 AppImage. linux-unpacked/shep under xvfb-run with a fresh SHEP_HOME logged Backend bootstrapped → Web server started → IPC handlers registered and created the database. Inside the packaged runtime, better-sqlite3 loads (Electron 44.9.3, Node 24.22, ABI 149).
• New tests, each seen failing first:
  • electron-version.test.ts: version lookup; no YAML pin; node-abi (from electron-builder's @electron/rebuild) knows the installed Electron.
  • compile-migrations.test.ts: compiles the real migrations; no output keeps a relative require (failed on the old bundle: false with the 115 crash).
  • electron-desktop-notifier.test.ts: failed event is logged.
  • dependency-path-traversal.test.ts: now exercises Electron's extractor. It replaces a symlinked destination rather than throwing, so the three affected cases assert containment instead (nothing outside the output dir changes; no link escapes, with a platform-aware separator check so the ..\\ case is checked properly on Windows). Mutation-checked: a planted escaping link fails the test.
• pnpm lint, format:check, typecheck, check:stories, generate (no diff): clean.
• pnpm test:unit 15,334 passed (5 skipped); pnpm test:int 2,194 passed.
• pnpm build:release, pnpm build:storybook: pass.

Not verified locally: macOS and Windows installers. The Electron (m+w+l) CI jobs cover those.

Checklist

• pnpm lint passes
• pnpm format:check passes
• pnpm typecheck passes
• pnpm test:unit and pnpm test:int pass
• pnpm build succeeds (build:release, Linux installer too)
• No domain/ or application/ file imports anything from infrastructure/
• Commit messages follow Conventional Commits (fix for shipped changes)
• Updated LESSONS.md

---

Generated by Claude Code