Amir Bredy (ABMFST) · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -15,16 +15,17 @@ The renderer is built with Vite and routes through a typed IPC bridge (`window.c
 
 ### Current repository snapshot
 
-The following release references were verified on 2026-08-06:
+The following release lines were prepared on 2026-10-28. GitHub release
+pages are authoritative for publication and asset status:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.103` | Current Windows/Linux release. All 12 Windows Server role baselines pass native Azure Audit and ApplyAndAutoCorrect with OSConfig 1.4.3. |
-| `mac-author-build` | `mac-v0.3.101-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. |
+| `main` | `v0.3.104` | Windows/Linux maintenance release with dependency security and customer-documentation updates. Historical baseline validation is recorded in the changelog. |
+| `mac-author-build` | `mac-v0.3.104-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. |
 
 On `mac-author-build`, the root package, desktop package, and lockfile records
-use `0.3.101-author.1`. The current macOS Author release is
-`mac-v0.3.101-author.1`. The Full-edition package versions are `0.3.103`; do not copy
+use `0.3.104-author.1`. The current macOS Author release is
+`mac-v0.3.104-author.1`. The Full-edition package versions are `0.3.104`; do not copy
 macOS package metadata to `main`.
 
 ### Current feature inventory
@@ -448,9 +449,9 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann
   errors, the desktop build, and a production audit with 0 vulnerabilities.
 - Historical `0.3.93-author.1` and `0.3.93-author.2` validation records are
   superseded; their tags/releases no longer exist. Use the current
-  `mac-v0.3.101-author.1` prerelease metadata and current GitHub
+  `mac-v0.3.104-author.1` prerelease metadata and current GitHub
   checks as the authority for macOS Author build and asset status.
-- The current macOS Author release is `mac-v0.3.101-author.1`. Use current
+- The current macOS Author release is `mac-v0.3.104-author.1`. Use current
   GitHub checks and release metadata as the authority for build and asset
   status rather than recording a merge SHA or workflow run here.
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.3.104] - 2026-10-28
+
+### Changed
+
+- Simplify installation and the first-baseline walkthrough. Keep advanced
+  deployment and packaging optional, and distinguish benchmark coverage,
+  device Audit, and exported Audit Packs. ([#142](https://github.com/Azure/ConfigForge/pull/142))
+- Document **Microsoft.OSConfig PowerShell module 1.4.10+** on the machine
+  creating Machine Configuration packages, separately from PowerShell 7.
+  Preserve exact installed-module binding and Audit-first validation.
+  This does not claim that every upstream baseline issue is resolved.
+
+### Security
+
+- Update Electron to 42.11.18 and ship the dependency fixes, including
+  DOMPurify 3.4.17 and js-yaml 4.3.2, without changing application workflows.
+  ([#131](https://github.com/Azure/ConfigForge/pull/131),
+  [#140](https://github.com/Azure/ConfigForge/pull/140))
+- Resolve the release-blocking DOMPurify advisories and Electron certificate
+  mitigations. Patch affected Vitest, Vite, redirect, URI, and address-parser
+  dependencies, with regression guards for every resolved copy.
+- Preserve package-integrity and public-asset safeguards. The release includes
+  per-platform SHA-256 manifests and CycloneDX software bills of materials.
+  Development-only advisories remain tracked separately; no clean full-audit
+  claim or advisory suppression is implied.
+
 ## [0.3.103] - 2026-08-09
 
 ### Fixed
@@ -26,55 +52,6 @@
   "could not read" solely because the CLI returned `[resource]` rather than
   `resource`.
 
-## [Unreleased]
-
-### Documentation
-
-- Lead the README and documentation site with release downloads, edition
-  selection, and a first saved baseline without CLI, admin access, or Azure.
-  Keep advanced packaging and contributor references available without making
-  them prerequisites; clarify unsigned-download risks and report terminology.
-- Require the **Microsoft.OSConfig PowerShell module 1.4.10+** on the machine
-  creating Machine Configuration packages, separately from PowerShell 7 and
-  GuestConfiguration. Centralize Audit-first packaging, reject missing/older
-  modules before MOF version resolution, preserve exact-version binding and
-  immutable ZIP/hash guidance, and label the 1.4.3 patch helper historical.
-  This does not claim that all upstream baseline issues are resolved.
-
-### Security
-
-- Update DOMPurify to 3.4.16, Axios to 1.20.0, ip-address to 10.7.2,
-  all supported brace-expansion lines, and both Undici lines for current
-  Dependabot advisories. Guard every resolved copy against regression.
-- Patch additional full-audit findings in sharp, fast-uri, joi, and
-  source-map-js without changing the application's version or framework majors.
-- Update http-cache-semantics to 4.3.0, outside the reported affected range,
-  and override the vulnerable CSS selector parser with 7.1.6+. Preserve
-  Tailwind 3 and cover its generated variants and child selectors in a
-  compatibility regression test.
-- Update concurrently to 9.2.5 and its shell-quote dependency to 1.12.0.
-  Correct the root override that otherwise keeps the vulnerable 1.9.0
-  shell-quote copy despite the parent-package update.
-- Refresh the SHA-pinned setup-node and upload-artifact GitHub Actions.
-- Keep the unpatched build-only braces (`GHSA-vfj7-8cjw-p6xm`) and
-  sprintf-js (`GHSA-hp3w-g68c-fv3c`) advisories visible. Neither upstream
-  package has a patched release; no advisory is suppressed or dismissed.
-- Upgrade the pinned CycloneDX SBOM generator to 6.0.0 to fix Windows
-  workspace-argument shell injection (`GHSA-q69g-4hcv-6jg4`). Guard the
-  manifest and every lockfile copy against reintroducing a vulnerable release.
-- Require `@xmldom/xmldom` 0.8.15 or later in the 0.8 line for Electron
-  packaging dependencies. This addresses the XML injection, malformed-input,
-  and quadratic-time parsing advisories affecting the previous 0.8.13 copy.
-  Add a regression guard covering every resolved copy in the lockfile.
-- Update Electron within the 42.x line to 42.11.3. Its installation tooling
-  uses Electron's maintained ZIP extractor instead of the unpatched
-  `extract-zip` package, removing the vulnerable dependency rather than
-  dismissing its symlink-write advisory (`GHSA-7pqw-9j4j-h8q3`).
-- Update the existing `brace-expansion` overrides to 1.1.18, 2.1.4, and
-  5.0.9, and require `nanoid` 3.3.18+ in the 3.x line. These address the
-  unbounded-expansion and zero-size generator denial-of-service advisories
-  found by a full development-and-production dependency audit.
-
 ## [0.3.101] - 2026-08-07
 
 ### Security

diff --git a/INSTALL.md b/INSTALL.md
@@ -15,9 +15,9 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The current Windows/Linux release is `v0.3.103`. The current macOS Author
-release is `mac-v0.3.101-author.1`; both are published as prereleases. The
-package versions are `0.3.103` for the Full edition and `0.3.101-author.1`
+The current Windows/Linux release is `v0.3.104`. The current macOS Author
+release is `mac-v0.3.104-author.1`; both are published as prereleases. The
+package versions are `0.3.104` for the Full edition and `0.3.104-author.1`
 for the macOS Author edition.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.
@@ -30,8 +30,8 @@ CLI state so you can switch to device operations after installing the CLI.
 ## Install the desktop app
 
 1. Open the [ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
-   page. Choose **Full v0.3.103** for Windows/Linux x64 or
-   **Author mac-v0.3.101-author.1** for Apple Silicon macOS. Expand **Assets**
+   page. Choose **Full v0.3.104** for Windows/Linux x64 or
+   **Author mac-v0.3.104-author.1** for Apple Silicon macOS. Expand **Assets**
    and download the appropriate installer/archive and published checksum
    manifest. Source-code archives are for contributors, not app installers.
 2. Compare the download's SHA-256 with its entry in the release checksum
@@ -182,7 +182,7 @@ later). The release contains an ARM64-only binary. It is not an x64 or
 universal build and does not support Intel Macs. Rosetta does not provide
 ARM64-on-Intel compatibility.
 
-The current macOS Author release is `mac-v0.3.101-author.1`, published as a
+The current macOS Author release is `mac-v0.3.104-author.1`, published as a
 prerelease on the
 [Azure/ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
 page. Users can also build the tagged source from the repository.

diff --git a/README.md b/README.md
@@ -18,11 +18,11 @@ subscription is needed for authoring.
 
 | Your computer | Download | What you can do |
 | --- | --- | --- |
-| Windows or Linux (x64) | **Full** — [v0.3.103](https://github.com/Azure/ConfigForge/releases/tag/v0.3.103) | Author, validate, compare, and export. Optional local Deploy, Audit, and Revert require the separately installed `oscfg` CLI. |
-| macOS on Apple Silicon (M1 or later) | **Author** — [mac-v0.3.101-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.101-author.1) | The same authoring and review workflows, including Audit Pack export; no device operations. ARM64 only—not Intel or universal. |
+| Windows or Linux (x64) | **Full** — [v0.3.104](https://github.com/Azure/ConfigForge/releases/tag/v0.3.104) | Author, validate, compare, and export. Optional local Deploy, Audit, and Revert require the separately installed `oscfg` CLI. |
+| macOS on Apple Silicon (M1 or later) | **Author** — [mac-v0.3.104-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.104-author.1) | The same authoring and review workflows, including Audit Pack export; no device operations. ARM64 only—not Intel or universal. |
 
-Both releases are **prereleases**. Full-edition package versions are `0.3.103`;
-the macOS Author package version is `0.3.101-author.1`.
+Both releases are **prereleases**. Full-edition package versions are `0.3.104`;
+the macOS Author package version is `0.3.104-author.1`.
 
 **Downloads are unsigned; macOS builds are also not notarized.** Download only
 from this repository's release page, compare the asset's SHA-256 with the

diff --git a/SECURITY.md b/SECURITY.md
@@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged source lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.103` | Supported published prerelease |
-| macOS Author edition | `mac-v0.3.101-author.1` | Supported published prerelease |
+| Full edition for Windows and Linux | `v0.3.104` | Supported published prerelease |
+| macOS Author edition | `mac-v0.3.104-author.1` | Supported published prerelease |
 | Older versions | Earlier tags | Not supported |
 
 ## Security scope

diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md
@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.103:** the release pipeline generates a
+> **Current through v0.3.104:** the release pipeline generates a
 > CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and

diff --git a/apps/desktop/package.json b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@configforge/desktop",
-  "version": "0.3.103",
+  "version": "0.3.104",
   "private": true,
   "description": "ConfigForge \u2014 OSConfig Baseline Editing tool",
   "main": "./dist/electron/main.js",
@@ -52,7 +52,7 @@
     "autoprefixer": "^10.5.0",
     "concurrently": "^9.2.5",
     "cross-env": "^7.0.3",
-    "electron": "~42.11.3",
+    "electron": "~42.11.16",
     "electron-builder": "~26.15.3",
     "esbuild": "^0.28.1",
     "eslint": "^8.57.1",
@@ -64,7 +64,7 @@
     "sharp": "0.35.5",
     "tailwindcss": "^3.4.19",
     "typescript": "^5.7.3",
-    "vite": "^6.4.3",
+    "vite": "^6.4.4",
     "wait-on": "^8.0.2"
   }
 }
diff --git a/docs/src/changelog.md b/docs/src/changelog.md
@@ -4,43 +4,20 @@ A concise release history for ConfigForge. Newer entries use their release
 tags and state publication status explicitly; older entries summarize the
 foundational work by theme.
 
-## Unreleased
-
-- **Clearer getting started:** Download the correct Full or Apple Silicon
-  Author edition, save a first baseline without CLI/admin/Azure prerequisites,
-  and choose optional comparison, reporting, device, or packaging workflows.
-  Keep technical references available under contributor navigation and explain
-  unsigned-download risks, Audit Pack vs device Audit, and benchmark coverage.
-- **Machine Configuration prerequisites:** Package with the **Microsoft.OSConfig
-  PowerShell module 1.4.10+**, separate from the PowerShell 7 runtime and
-  GuestConfiguration toolkit. The canonical Audit-first guide rejects missing
-  or older modules before resolving the MOF, keeps exact-version/immutable-ZIP
-  requirements, and excludes the historical 1.4.3 patch from current guidance.
-  The minimum version is not a statement that all upstream issues are fixed.
-- **Dependency security:** Update DOMPurify, Axios, ip-address,
-  every supported brace-expansion and Undici line, and concurrently to
-  patched releases. Also patch sharp, fast-uri, joi, and source-map-js
-  findings uncovered by the full dependency audit.
-  Correct the root shell-quote override so the vulnerable copy is not
-  retained, and add lockfile regression coverage.
-- **Cache and CSS tooling:** Update http-cache-semantics beyond the reported
-  affected range and use a patched CSS selector parser without upgrading
-  Tailwind 3. Cover compiled variant and child-selector compatibility.
-- **CI dependencies:** Refresh the SHA-pinned setup-node and upload-artifact
-  GitHub Actions.
-- **Remaining upstream advisories:** Build-only braces and sprintf-js have
-  no patched releases. Their advisories remain visible without suppression.
-- **SBOM tooling security:** Pin CycloneDX npm 6.0.0 to address
-  `GHSA-q69g-4hcv-6jg4`, with regression coverage for resolved versions.
-- **Build dependency security:** Require patched `@xmldom/xmldom` 0.8.15+
-  within the 0.8 line for Electron packaging tools, with a lockfile guard
-  against reintroducing vulnerable copies.
-- **Electron installation security:** Update to Electron 42.11.3, whose
-  maintained ZIP extractor replaces the vulnerable legacy `extract-zip`
-  dependency.
-- **Build dependency hardening:** Update all supported `brace-expansion`
-  lines and `nanoid` 3.x to patched releases for denial-of-service advisories
-  found by the full dependency audit.
+## v0.3.104 - 2026-10-28
+
+- **Security maintenance:** Ship the merged dependency updates, including
+  Electron 42.11.18, DOMPurify 3.4.17, and js-yaml 4.3.2. Resolve the new
+  sanitizer and Electron certificate advisories before publishing.
+- **Simpler onboarding:** Start with the correct download and a first saved
+  baseline. Advanced deployment, benchmark, and packaging workflows remain
+  optional; distinguish coverage, device Audit, and Audit Pack reports.
+- **Machine Configuration packages:** Use the Microsoft.OSConfig PowerShell
+  module **1.4.10+** on the packaging machine, separately from PowerShell 7.
+  Keep exact-version binding and Audit-first validation.
+- **Release scope:** Windows/Linux Full and Apple Silicon macOS Author remain
+  separate experimental, unsigned prereleases. The Author edition does not
+  perform device operations.
 
 ## v0.3.103 - 2026-08-09
 

diff --git a/docs/src/introduction.md b/docs/src/introduction.md
@@ -65,9 +65,9 @@ Review their timestamps, scope, and any unread or unavailable settings.
 | macOS on Apple Silicon (M1 or later) | **Author** | Authoring, Diff, Benchmark Mapping, history, rationale, and Audit Pack export; no device operations |
 
 The current Windows/Linux release is
-[v0.3.103](https://github.com/Azure/ConfigForge/releases/tag/v0.3.103).
+[v0.3.104](https://github.com/Azure/ConfigForge/releases/tag/v0.3.104).
 The current macOS Author release is
-[mac-v0.3.101-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.101-author.1).
+[mac-v0.3.104-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.104-author.1).
 Both are prereleases and unsigned; macOS is not notarized. Intel Macs and
 universal binaries are not supported. Read the
 [download and installation guidance](./quick-start/install-run.md) first.

diff --git a/docs/src/operations/ci.md b/docs/src/operations/ci.md
@@ -13,7 +13,7 @@ ConfigForge uses GitHub Actions from `.github/workflows/`. The product is an Ele
 
 The Win/Linux Release workflow intentionally ignores hyphen-suffix tags
 (`!v*-*`). macOS Author releases use separate tags such as
-`mac-v0.3.101-author.1`; dispatch the protected `main` workflow definition
+`mac-v0.3.104-author.1`; dispatch the protected `main` workflow definition
 manually and let its checkout step select the immutable macOS tag.
 
 ## What `pr-check.yml` runs
@@ -35,7 +35,7 @@ files; main PR #76 then passed its full suite plus 32 focused nested-navigation
 tests. Mac port PR #77 passed 79 focused tests and two isolated Playwright
 scenarios. Historical `0.3.93-author.1` and `0.3.93-author.2` validation
 records are superseded; their tags and releases no longer exist. The current
-macOS Author release is `mac-v0.3.101-author.1`, published as a prerelease.
+macOS Author release is `mac-v0.3.104-author.1`, published as a prerelease.
 Use its current GitHub checks and release metadata as the
 authority rather than pinning a workflow run in this document.
 
@@ -76,24 +76,24 @@ the immutable macOS tag:
 gh workflow run "Release (macOS author)" \
   --repo Azure/ConfigForge \
   --ref main \
-  -f release_tag=mac-v0.3.101-author.1
+  -f release_tag=mac-v0.3.104-author.1
 ```
 
 The target draft release and tag must already exist. The workflow loads its
 definition from `main`, checks out `release_tag`, verifies that
 `HEAD` resolves to the tag, checks that tagged tree with the dependency-free
 public-asset guard from protected `main`, then builds with
 `electron-builder.author.yml`.
-The `mac-v0.3.101-author.1` release contract expects exactly these assets:
+The `mac-v0.3.104-author.1` release contract expects exactly these assets:
 
-1. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg`
-2. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap`
+1. `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg`
+2. `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg.blockmap`
 3. `latest-mac.yml`
 4. `sbom-macos-author.cdx.json`
 5. `SHA256SUMS-macos-author.txt`
 
 The workflow refuses a published release and never publishes automatically.
-For `mac-v0.3.101-author.1`, use the current GitHub checks and published
+For `mac-v0.3.104-author.1`, use the current GitHub checks and published
 prerelease as the authority for actual build and asset status.
 
 ## Linux runner notes

diff --git a/docs/src/quick-start/install-run.md b/docs/src/quick-start/install-run.md
@@ -13,8 +13,8 @@ managed computer.
 
 | Your computer | Edition and download | Capabilities |
 | --- | --- | --- |
-| Windows/Linux x64 | [Full v0.3.103](https://github.com/Azure/ConfigForge/releases/tag/v0.3.103) | Authoring and review; optional CLI-based local device operations |
-| macOS, Apple Silicon (M1 or later) | [Author mac-v0.3.101-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.101-author.1) | Authoring and review, including Audit Pack export; no device operations |
+| Windows/Linux x64 | [Full v0.3.104](https://github.com/Azure/ConfigForge/releases/tag/v0.3.104) | Authoring and review; optional CLI-based local device operations |
+| macOS, Apple Silicon (M1 or later) | [Author mac-v0.3.104-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.104-author.1) | Authoring and review, including Audit Pack export; no device operations |
 
 Both are prereleases. macOS is ARM64-only: Intel Macs and universal binaries
 are not supported.