Track npm audit vulnerabilities after Electron dependency update

[germanescobar]

Summary

npm install during the Electron desktop shell work reported npm audit findings that should be tracked separately from issue #44.

Current audit summary from npm audit --json:

• 10 total vulnerabilities
• 9 moderate
• 1 high
• 0 critical

Direct dependencies affected

• uuid — moderate — uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
  • Advisory: GHSA-w5hq-g745-h8pq
  • Range: <11.1.1
  • Fix available
• ws — moderate — ws: Uninitialized memory disclosure
  • Advisory: GHSA-58qx-3vcg-4xpx
  • Range: >=8.0.0 <8.20.1
  • Fix available

Transitive dependencies affected

• fast-uri — high — path traversal / host confusion advisories
  • GHSA-q3j6-qgpj-74h6
  • GHSA-v39h-62p7-jpjc
• @hono/node-server — moderate — serveStatic repeated-slash middleware bypass
  • GHSA-92pp-h63x-v22m
• hono — moderate — multiple advisories affecting cookie handling, static serving, JSX SSR, cache middleware, body limit, and JWT validation
• brace-expansion — moderate — numeric range DoS
  • GHSA-jxxr-4gwj-5jf2
• express-rate-limit via ip-address — moderate
• ip-address — moderate — XSS in HTML-emitting methods
  • GHSA-v2v4-37r5-5v8g
• postcss — moderate — CSS stringify XSS
  • GHSA-qx2v-qp2m-jg93
• qs — moderate — remotely triggerable DoS in qs.stringify
  • GHSA-q8mj-m7cp-5q26

Suggested next steps

1. Run npm audit on the current branch/main to confirm the active set.
2. Prefer targeted dependency upgrades for direct dependencies first: uuid and ws.
3. Investigate whether transitive findings are introduced by Electron packaging dependencies, existing app dependencies, or both.
4. Avoid a blind npm audit fix unless the resulting lockfile diff is reviewed, because it may upgrade unrelated packages.
5. Re-run npm run build and the Electron package path after any dependency updates.

Acceptance criteria

• npm audit shows no high vulnerabilities.
• Direct dependency advisories for uuid and ws are resolved.
• Any remaining moderate transitive advisories are either resolved or explicitly documented with the dependency path and risk rationale.