diff --git a/AGENTS.md b/AGENTS.md
index d7a76df..08b31cc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -15,21 +15,22 @@ The renderer is built with Vite and routes through a typed IPC bridge (`window.c
 
 ### Current repository snapshot
 
-The following release references describe the current tagged source lines:
+The following release lines were prepared on 2026-10-28. GitHub release
+pages are authoritative for publication and asset status:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.101` | Current Full-edition Windows/Linux release, published as a prerelease with the enforcement and dependency-security fixes. |
-| `mac-author-build` | `mac-v0.3.101-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. |
+| `main` | `v0.3.104` | Current Full-edition Windows/Linux release, published as a prerelease with the enforcement and dependency-security fixes. |
+| `mac-author-build` | `mac-v0.3.104-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. |
 
 On `mac-author-build`, the root package, desktop package, and matching lockfile
-records use `0.3.101-author.1`. This release preserves the author-only
+records use `0.3.104-author.1`. This release preserves the author-only
 capability boundary while porting shared baseline, lossless data, Machine
 Configuration packaging, build compatibility, and dependency-security fixes.
-The package version on `main` is `0.3.101`; do not copy macOS package metadata
+The package version on `main` is `0.3.104`; do not copy macOS package metadata
 to `main`.
 
-The prior macOS Author release is `mac-v0.3.98-author.1`.
+The prior macOS Author release is `mac-v0.3.101-author.1`.
 
 ### Current feature inventory
 
@@ -119,13 +120,13 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
 - The macOS tag must resolve to the exact final validated commit on
   `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and
   defaults to `Azure/ConfigForge`.
-- The current macOS Author release `mac-v0.3.101-author.1` contains exactly
+- The current macOS Author release `mac-v0.3.104-author.1` contains exactly
   these asset names:
 
   | Asset | Exact name |
   |---|---|
-  | DMG | `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg` |
-  | Blockmap | `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap` |
+  | DMG | `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg` |
+  | Blockmap | `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg.blockmap` |
   | Update metadata | `latest-mac.yml` |
   | CycloneDX SBOM | `sbom-macos-author.cdx.json` |
   | SHA-256 manifest | `SHA256SUMS-macos-author.txt` |
@@ -141,7 +142,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
   gh workflow run "Release (macOS author)" `
     --repo Azure/ConfigForge `
     --ref main `
-    -f release_tag=mac-v0.3.101-author.1
+    -f release_tag=mac-v0.3.104-author.1
   ```
 
 - `--ref main` selects the reviewed workflow definition, not the source to
@@ -450,7 +451,7 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann
   Manifest Editor tests, two isolated Playwright scenarios, lint with 0
   errors, the desktop build, and a production audit with 0 vulnerabilities.
 - The prior macOS Author release is `mac-v0.3.98-author.1`.
-- The current macOS Author release is `mac-v0.3.101-author.1`; use current
+- The current macOS Author release is `mac-v0.3.104-author.1`; use current
   GitHub checks and release metadata as the authority for build and asset
   status rather than recording a merge SHA or workflow run here.
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0183096..54810e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,58 +1,39 @@
 # Changelog
 
-## [Unreleased]
+## [0.3.104-author.1] - 2026-10-28
 
-### Documentation
+### Changed
+
+- Bring the Apple Silicon Author edition to the 0.3.104 release line while
+  keeping device deploy, audit, enforce, revert, and elevation excluded.
+- Simplify installation and first-baseline guidance. Require **Microsoft.OSConfig
+  PowerShell module 1.4.10+** on the separate machine creating Machine
+  Configuration packages; PowerShell 7 is a distinct prerequisite.
+  ([#143](https://github.com/Azure/ConfigForge/pull/143))
+
+### Fixed
 
-- Lead the README and documentation site with release downloads, edition
-  selection, and a first saved baseline without CLI, admin access, or Azure.
-  Keep advanced packaging and contributor references available without making
-  them prerequisites; clarify unsigned-download risks and report terminology.
-- Require the **Microsoft.OSConfig PowerShell module 1.4.10+** on the machine
-  creating Machine Configuration packages, separately from PowerShell 7 and
-  GuestConfiguration. Centralize Audit-first packaging, reject missing/older
-  modules before MOF version resolution, preserve exact-version binding and
-  immutable ZIP/hash guidance, and label the 1.4.3 patch helper historical.
-  This does not claim that all upstream baseline issues are resolved.
+- Include the reviewed Windows Server 2016-2025 template repairs for authoring
+  and Machine Configuration export, including effective firewall defaults and
+  non-mutating account-policy checks. These do not enable device operations
+  on macOS. ([#120](https://github.com/Azure/ConfigForge/pull/120))
 
 ### Security
 
-- Update DOMPurify to 3.4.16, Axios to 1.20.0, ip-address to 10.7.2,
-  all supported brace-expansion lines, and both Undici lines for current
-  Dependabot advisories. Guard every resolved copy against regression.
-- Patch additional full-audit findings in sharp, fast-uri, joi, and
-  source-map-js without changing the application's version or framework majors.
-- Update http-cache-semantics to 4.3.0, outside the reported affected range,
-  and override the vulnerable CSS selector parser with 7.1.6+. Preserve
-  Tailwind 3 and cover its generated variants and child selectors in a
-  compatibility regression test.
-- Update concurrently to 9.2.5 and its shell-quote dependency to 1.12.0.
-  Correct the root override that otherwise keeps the vulnerable 1.9.0
-  shell-quote copy despite the parent-package update.
-- Refresh the SHA-pinned setup-node and upload-artifact GitHub Actions.
-- Validate the author build and native icon generation on a hosted macOS
-  runner, including the compiled preload's author-only capability boundary.
-- Keep the unpatched build-only braces (`GHSA-vfj7-8cjw-p6xm`) and
-  sprintf-js (`GHSA-hp3w-g68c-fv3c`) advisories visible. Neither upstream
-  package has a patched release; no advisory is suppressed or dismissed.
-- Upgrade the pinned CycloneDX SBOM generator to 6.0.0 to fix Windows
-  workspace-argument shell injection (`GHSA-q69g-4hcv-6jg4`). Guard the
-  manifest and every lockfile copy against reintroducing a vulnerable release.
-- Port the dependency security fixes from the Full edition without changing
-  the macOS Author version or capability boundary: require xmldom 0.8.15+,
-  brace-expansion 1.1.18 / 2.1.4 / 5.0.9, and nanoid 3.3.18+.
-- Update Electron within 42.x to 42.11.3, replacing the vulnerable legacy
-  `extract-zip` installation dependency with Electron-maintained extraction.
-- Guard every resolved copy and Electron workspace/lockfile consistency
-  against regressions.
-- Bring across the remaining Full-edition dependency fixes identified by
-  the author-branch audit: js-yaml 4.3.2, sharp 0.35.4, Vitest 4.1.11+,
-  and patched Browserslist, fast-uri, Joi, postcss-selector-parser, and
-  baseline-browser-mapping transitive dependencies.
+- Update Electron to 42.11.18 and ship the dependency fixes, including
+  DOMPurify 3.4.17 and js-yaml 4.3.2, with the Author capability boundary
+  preserved. ([#132](https://github.com/Azure/ConfigForge/pull/132),
+  [#141](https://github.com/Azure/ConfigForge/pull/141))
+- Resolve the release-blocking DOMPurify advisories and Electron certificate
+  mitigations. Patch affected Vitest, Vite, redirect, URI, and address-parser
+  dependencies, with regression guards for every resolved copy.
+- Include a SHA-256 manifest and CycloneDX software bill of materials.
+  Development-only advisories remain tracked separately; no clean full-audit
+  claim or advisory suppression is implied.
 
 ## [0.3.101-author.1] - 2026-08-07
 
-> `mac-v0.3.101-author.1` is the current macOS Author release and is
+> `mac-v0.3.101-author.1` is a prior macOS Author release and is
 > published as a prerelease. The author-only capability boundary is unchanged:
 > device deploy, audit, enforce, revert, elevation, health, and audit-results
 > storage remain excluded.
diff --git a/INSTALL.md b/INSTALL.md
index 7f419fa..b19c12f 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -15,10 +15,10 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The current Windows/Linux Full-edition release is `v0.3.103`. The current
-macOS Author release is `mac-v0.3.101-author.1`. Both are published as
-prereleases. The Full-edition package version on `main` is `0.3.103`; the
-macOS Author package version is `0.3.101-author.1`.
+The current Windows/Linux Full-edition release is `v0.3.104`. The current
+macOS Author release is `mac-v0.3.104-author.1`. Both are published as
+prereleases. The Full-edition package version on `main` is `0.3.104`; the
+macOS Author package version is `0.3.104-author.1`.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.
 
@@ -30,8 +30,8 @@ CLI state so you can switch to device operations after installing the CLI.
 ## Install the desktop app
 
 1. Open the [ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
-   page. Choose **Full v0.3.103** for Windows/Linux x64 or
-   **Author mac-v0.3.101-author.1** for Apple Silicon macOS. Expand **Assets**
+   page. Choose **Full v0.3.104** for Windows/Linux x64 or
+   **Author mac-v0.3.104-author.1** for Apple Silicon macOS. Expand **Assets**
    and download the appropriate installer/archive and published checksum
    manifest. Source-code archives are for contributors, not app installers.
 2. Compare the download's SHA-256 with its entry in the release checksum
@@ -182,7 +182,7 @@ later). The release contains an ARM64-only binary. It is not an x64 or
 universal build and does not support Intel Macs. Rosetta does not provide
 ARM64-on-Intel compatibility.
 
-The current macOS Author release is `mac-v0.3.101-author.1`, published as a
+The current macOS Author release is `mac-v0.3.104-author.1`, published as a
 prerelease after its five assets pass validation. Users can download the
 release or build the tagged source by following the instructions in the
 [Azure/ConfigForge repository](https://github.com/Azure/ConfigForge).
diff --git a/README.md b/README.md
index 924aee5..b927cc0 100644
--- a/README.md
+++ b/README.md
@@ -22,11 +22,11 @@ Enforce, Revert, elevation, or CLI-health controls.
 
 | Your computer | Download | What you can do |
 | --- | --- | --- |
-| Windows or Linux (x64) | **Full** — [v0.3.103](https://github.com/Azure/ConfigForge/releases/tag/v0.3.103) | Author, validate, compare, and export. Optional local Deploy, Audit, and Revert require the separately installed `oscfg` CLI. |
-| macOS on Apple Silicon (M1 or later) | **Author** — [mac-v0.3.101-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.101-author.1) | The same authoring and review workflows, including Audit Pack export; no device operations. ARM64 only—not Intel or universal. |
+| Windows or Linux (x64) | **Full** — [v0.3.104](https://github.com/Azure/ConfigForge/releases/tag/v0.3.104) | Author, validate, compare, and export. Optional local Deploy, Audit, and Revert require the separately installed `oscfg` CLI. |
+| macOS on Apple Silicon (M1 or later) | **Author** — [mac-v0.3.104-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.104-author.1) | The same authoring and review workflows, including Audit Pack export; no device operations. ARM64 only—not Intel or universal. |
 
-Both releases are **prereleases**. Full-edition package versions are `0.3.103`;
-the macOS Author package version is `0.3.101-author.1`.
+Both releases are **prereleases**. Full-edition package versions are `0.3.104`;
+the macOS Author package version is `0.3.104-author.1`.
 
 **Downloads are unsigned; macOS builds are also not notarized.** Download only
 from this repository's release page, compare the asset's SHA-256 with the
@@ -242,7 +242,7 @@ Past module-version validation records are not current packaging prerequisites.
 
 | Version | Highlights |
 |---|---|
-| **0.3.101-author.1** (current macOS prerelease) | Ports the author-safe WS2022 baseline repairs, lossless QWord and Registry handling, Machine Configuration packaging compatibility, Node 24 build support, and dependency-security fixes. |
+| **0.3.101-author.1** (prior macOS prerelease) | Ports the author-safe WS2022 baseline repairs, lossless QWord and Registry handling, Machine Configuration packaging compatibility, Node 24 build support, and dependency-security fixes. |
 | **0.3.101** (prior Windows/Linux prerelease) | Clears the remaining dependency alerts after the verified OSConfig enforcement and Machine Configuration fixes. |
 | **0.3.98-author.1** (prior macOS prerelease) | Adds complete Machine Configuration documentation and removes stale/internal public-doc guidance. |
 | **0.3.98** (prior Windows/Linux source) | Adds the same public Machine Configuration guide and documentation cleanup to the Full edition. |
diff --git a/SECURITY.md b/SECURITY.md
index 0166d9d..fb1e75d 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged release lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.101` | Supported published prerelease |
-| macOS Author edition | `mac-v0.3.101-author.1` | Supported published prerelease |
+| Full edition for Windows and Linux | `v0.3.104` | Supported published prerelease |
+| macOS Author edition | `mac-v0.3.104-author.1` | Supported published prerelease |
 | Older versions | Earlier tags | Not supported |
 
 ## Security scope
diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md
index feff66b..b73eb61 100644
--- a/apps/desktop/PACKAGING.md
+++ b/apps/desktop/PACKAGING.md
@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.101-author.1:** the release pipeline
+> **Current through v0.3.104-author.1:** the release pipeline
 > generates a CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and
diff --git a/apps/desktop/build/release-notes-author.md b/apps/desktop/build/release-notes-author.md
index 2b80c08..d074bfc 100644
--- a/apps/desktop/build/release-notes-author.md
+++ b/apps/desktop/build/release-notes-author.md
@@ -1,43 +1,61 @@
-# ConfigForge Author 0.3.101-author.1 - macOS
+# ConfigForge Author 0.3.104-author.1 - macOS
 
 > **Release state: prerelease.**
 
-This release brings the author-safe Windows Server baseline, lossless data,
-Machine Configuration packaging, build compatibility, and dependency security
-updates from the 0.3.101 Full-edition line to Apple Silicon Macs.
+This maintenance release brings the merged baseline-template repairs,
+security updates, and clearer customer guidance to Apple Silicon Macs.
 
-## Added
+## Changed
 
-- Added a fail-closed Azure Machine Configuration package helper that patches
-  both packaged Microsoft.OSConfig 1.4.3 Set wrappers to pass resource
-  properties as compressed JSON.
+- Start with the correct download and a first saved baseline. Advanced
+  comparison, benchmark, reporting, and packaging workflows remain optional.
+  ([#143](https://github.com/Azure/ConfigForge/pull/143))
+- Creating Machine Configuration packages requires the
+  **Microsoft.OSConfig PowerShell module 1.4.10+** on a separate compatible
+  packaging machine. PowerShell 7 and GuestConfiguration are distinct
+  prerequisites. Do not apply the historical 1.4.3 package patch to newer
+  modules. See the [packaging guide](https://azure.github.io/ConfigForge/user-guide/machine-configuration.html).
 
 ## Fixed
 
-- Repaired the Windows Server 2022 Member Server, Domain Controller, and
-  Workgroup Member baselines for standalone authoring and Machine
-  Configuration export.
-- Preserved exact QWord values and canonical Registry contracts across YAML,
-  JSON, spreadsheets, Visual mode, Diff, reports, registration, and MOF
-  export.
-- Serialized overlapping history-retention and rationale writes.
-- Supported source builds on Node 22.12 and Node 24.
+- Include the reviewed Windows Server 2016-2025 template repairs for
+  authoring and export, including effective firewall defaults and
+  non-mutating account-policy checks.
+  ([#120](https://github.com/Azure/ConfigForge/pull/120))
 
 ## Security
 
-- Updated js-yaml to 4.3.1, DOMPurify to 3.4.13, fast-uri to 3.1.5,
-  ip-address to 10.4.0, React Router to 7.18.2, Undici 6.x to 6.28.0, and
-  Undici 7.x to 7.29.0.
+- Ship the dependency updates, including Electron 42.11.18,
+  DOMPurify 3.4.17, and js-yaml 4.3.2. Address the newly reported sanitizer
+  bypasses and Electron certificate mitigations before publication.
+  ([#132](https://github.com/Azure/ConfigForge/pull/132),
+  [#141](https://github.com/Azure/ConfigForge/pull/141))
+- Include a SHA-256 manifest and CycloneDX software bill of materials.
+  Development-only advisories remain tracked separately; the entire
+  development dependency tree is not claimed to be advisory-free.
 
 ## Author-only scope
 
 - Device deploy, audit, enforce, revert, elevation, health, and audit-results
   storage remain intentionally excluded.
+- Apple Silicon ARM64 only; no Intel or universal build. Authoring, Diff,
+  Benchmark Mapping, history, rationale, and Audit Pack exports remain available.
+
+## Important limits
+
+ConfigForge remains experimental, community-maintained, not an officially
+supported Microsoft product, and not intended for production use. This
+download is **unsigned and not notarized**. Verify its SHA-256 and follow your
+organization's software policy; a checksum is not proof of publisher identity
+or safety. Back up your work before upgrading. Existing baseline data is not
+automatically replaced by bundled template updates.
 
 ## Expected assets
 
-1. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg`
-2. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap`
+1. `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg`
+2. `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg.blockmap`
 3. `latest-mac.yml`
 4. `sbom-macos-author.cdx.json`
 5. `SHA256SUMS-macos-author.txt`
+
+[Full changes](https://github.com/Azure/ConfigForge/compare/mac-v0.3.101-author.1...mac-v0.3.104-author.1)
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 90e0612..325c179 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@configforge/desktop",
-  "version": "0.3.101-author.1",
+  "version": "0.3.104-author.1",
   "private": true,
   "description": "ConfigForge \u2014 OSConfig Baseline Editing tool",
   "main": "./dist/electron/main.js",
@@ -58,7 +58,7 @@
     "autoprefixer": "^10.5.0",
     "concurrently": "^9.2.5",
     "cross-env": "^7.0.3",
-    "electron": "~42.11.3",
+    "electron": "~42.11.16",
     "electron-builder": "~26.15.3",
     "esbuild": "^0.28.1",
     "eslint": "^8.57.1",
@@ -70,7 +70,7 @@
     "sharp": "0.35.5",
     "tailwindcss": "^3.4.19",
     "typescript": "^5.7.3",
-    "vite": "^6.4.3",
+    "vite": "^6.4.4",
     "wait-on": "^8.0.2"
   }
 }
diff --git a/docs/src/architecture/system-overview.md b/docs/src/architecture/system-overview.md
index b6d358c..c445533 100644
--- a/docs/src/architecture/system-overview.md
+++ b/docs/src/architecture/system-overview.md
@@ -1,6 +1,6 @@
 # System overview
 
-ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.101`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.101-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package.
+ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.104`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.101-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package.
 
 There is no HTTP server, database, queue, or microservice layer in the current app. Renderer code calls the Electron preload bridge (`window.cfs.*`), the main process validates IPC payloads, and pure handlers in `packages/core` own filesystem and CLI operations.
 
diff --git a/docs/src/changelog.md b/docs/src/changelog.md
index d812a58..c8a23c6 100644
--- a/docs/src/changelog.md
+++ b/docs/src/changelog.md
@@ -3,46 +3,27 @@
 A concise release history for ConfigForge. Newer entries use the
 shipped semver tag; older entries summarize the foundational work by theme.
 
-## Unreleased
-
-- **Clearer getting started:** Download the correct Full or Apple Silicon
-  Author edition, save a first baseline without CLI/admin/Azure prerequisites,
-  and choose optional comparison, reporting, device, or packaging workflows.
-  Keep technical references available under contributor navigation and explain
-  unsigned-download risks, Audit Pack vs device Audit, and benchmark coverage.
-- **Machine Configuration prerequisites:** Package with the **Microsoft.OSConfig
-  PowerShell module 1.4.10+**, separate from the PowerShell 7 runtime and
-  GuestConfiguration toolkit. The canonical Audit-first guide rejects missing
-  or older modules before resolving the MOF, keeps exact-version/immutable-ZIP
-  requirements, and excludes the historical 1.4.3 patch from current guidance.
-  The minimum version is not a statement that all upstream issues are fixed.
-- **Dependency security:** Update DOMPurify, Axios, ip-address,
-  every supported brace-expansion and Undici line, and concurrently to
-  patched releases. Also patch sharp, fast-uri, joi, and source-map-js
-  findings uncovered by the full dependency audit.
-  Correct the root shell-quote override so the vulnerable copy is not
-  retained, and add lockfile regression coverage.
-- **Cache and CSS tooling:** Update http-cache-semantics beyond the reported
-  affected range and use a patched CSS selector parser without upgrading
-  Tailwind 3. Cover compiled variant and child-selector compatibility.
-- **CI dependencies:** Refresh the SHA-pinned setup-node and upload-artifact
-  GitHub Actions.
-- **macOS validation:** Build the author edition and native icons on macOS,
-  and verify that its compiled bridge excludes device-operation APIs.
-- **Remaining upstream advisories:** Build-only braces and sprintf-js have
-  no patched releases. Their advisories remain visible without suppression.
-- **SBOM tooling security:** Pin CycloneDX npm 6.0.0 to address
-  `GHSA-q69g-4hcv-6jg4`, with regression coverage for resolved versions.
-- **Dependency security:** Port patched xmldom, brace-expansion, and nanoid
-  dependencies, and update Electron to 42.11.3 to remove the vulnerable
-  legacy ZIP extractor. The macOS Author version and author-only capability
-  boundary are unchanged.
-- **Security parity:** Include the remaining audited js-yaml, sharp, Vitest,
-  and transitive build-tool fixes already present in the Full edition.
+## macOS Author v0.3.104-author.1 - 2026-10-28
+
+- **Security maintenance:** Ship the merged dependency updates, including
+  Electron 42.11.18, DOMPurify 3.4.17, and js-yaml 4.3.2. Resolve the new
+  sanitizer and Electron certificate advisories before publishing.
+- **Simpler onboarding:** Start with the correct download and a first saved
+  baseline. Advanced deployment, benchmark, and packaging workflows remain
+  optional; distinguish coverage, device Audit, and Audit Pack reports.
+- **Machine Configuration packages:** Use the Microsoft.OSConfig PowerShell
+  module **1.4.10+** on the packaging machine, separately from PowerShell 7.
+  Keep exact-version binding and Audit-first validation.
+- **Release scope:** Windows/Linux Full and Apple Silicon macOS Author remain
+  separate experimental, unsigned prereleases. The Author edition does not
+  perform device operations.
+
+- **Baseline templates:** Include the reviewed Windows Server 2016-2025
+  repairs for authoring and export, without enabling local device operations.
 
 ## macOS Author v0.3.101-author.1 - 2026-08-07
 
-`mac-v0.3.101-author.1` is the current macOS Author release and is published
+`mac-v0.3.101-author.1` is a prior macOS Author release and is published
 as a prerelease. The author-only capability boundary remains unchanged.
 
 - **Windows Server 2022 baselines:** Repair the Member Server, Domain
diff --git a/docs/src/introduction.md b/docs/src/introduction.md
index 018222e..f4fb18d 100644
--- a/docs/src/introduction.md
+++ b/docs/src/introduction.md
@@ -69,9 +69,9 @@ Review their timestamps, scope, and any unread or unavailable settings.
 | macOS on Apple Silicon (M1 or later) | **Author** | Authoring, Diff, Benchmark Mapping, history, rationale, and Audit Pack export; no device operations |
 
 The current Windows/Linux release is
-[v0.3.103](https://github.com/Azure/ConfigForge/releases/tag/v0.3.103).
+[v0.3.104](https://github.com/Azure/ConfigForge/releases/tag/v0.3.104).
 The current macOS Author release is
-[mac-v0.3.101-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.101-author.1).
+[mac-v0.3.104-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.104-author.1).
 Both are prereleases and unsigned; macOS is not notarized. Intel Macs and
 universal binaries are not supported. Read the
 [download and installation guidance](./quick-start/install-run.md) first.
diff --git a/docs/src/operations/ci.md b/docs/src/operations/ci.md
index 91517ed..4f50baf 100644
--- a/docs/src/operations/ci.md
+++ b/docs/src/operations/ci.md
@@ -13,7 +13,7 @@ ConfigForge uses GitHub Actions from `.github/workflows/`. The product is an Ele
 
 The Win/Linux Release workflow intentionally ignores hyphen-suffix tags
 (`!v*-*`). macOS Author releases use separate tags such as
-`mac-v0.3.101-author.1`; dispatch the protected `main` workflow definition
+`mac-v0.3.104-author.1`; dispatch the protected `main` workflow definition
 manually and let its checkout step select the immutable macOS tag.
 
 ## What `pr-check.yml` runs
@@ -40,7 +40,7 @@ scenarios. The prior `mac-v0.3.94-author.1` draft release remains unpublished;
 workflow run
 [#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418)
 verified its five assets. The current macOS Author release is
-`mac-v0.3.101-author.1`, published as a prerelease. Use current GitHub checks
+`mac-v0.3.104-author.1`, published as a prerelease. Use current GitHub checks
 and release metadata as the authority for build and asset status.
 
 Caching covers npm, Electron binaries, electron-builder, and Playwright browser downloads. Concurrency cancels stale PR runs on the same branch.
@@ -80,7 +80,7 @@ the immutable macOS tag:
 gh workflow run "Release (macOS author)" \
   --repo Azure/ConfigForge \
   --ref main \
-  -f release_tag=mac-v0.3.101-author.1
+  -f release_tag=mac-v0.3.104-author.1
 ```
 
 The target draft release and tag must already exist. The workflow loads its
@@ -88,16 +88,16 @@ definition from `main`, checks out `release_tag`, verifies that
 `HEAD` resolves to the tag, checks that tagged tree with the dependency-free
 public-asset guard from protected `main`, then builds with
 `electron-builder.author.yml`.
-For `mac-v0.3.101-author.1`, it uses exactly these expected asset names:
+For `mac-v0.3.104-author.1`, it uses exactly these expected asset names:
 
-1. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg`
-2. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap`
+1. `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg`
+2. `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg.blockmap`
 3. `latest-mac.yml`
 4. `sbom-macos-author.cdx.json`
 5. `SHA256SUMS-macos-author.txt`
 
 The workflow refuses a published release and never publishes automatically.
-The current `mac-v0.3.101-author.1` release is published only after the five
+The current `mac-v0.3.104-author.1` release is published only after the five
 uploaded assets and their metadata pass validation.
 
 ## Linux runner notes
diff --git a/docs/src/quick-start/install-run.md b/docs/src/quick-start/install-run.md
index 70f630d..346737e 100644
--- a/docs/src/quick-start/install-run.md
+++ b/docs/src/quick-start/install-run.md
@@ -13,8 +13,8 @@ managed computer.
 
 | Your computer | Edition and download | Capabilities |
 | --- | --- | --- |
-| Windows/Linux x64 | [Full v0.3.103](https://github.com/Azure/ConfigForge/releases/tag/v0.3.103) | Authoring and review; optional CLI-based local device operations |
-| macOS, Apple Silicon (M1 or later) | [Author mac-v0.3.101-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.101-author.1) | Authoring and review, including Audit Pack export; no device operations |
+| Windows/Linux x64 | [Full v0.3.104](https://github.com/Azure/ConfigForge/releases/tag/v0.3.104) | Authoring and review; optional CLI-based local device operations |
+| macOS, Apple Silicon (M1 or later) | [Author mac-v0.3.104-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.104-author.1) | Authoring and review, including Audit Pack export; no device operations |
 
 Both are prereleases. macOS is ARM64-only: Intel Macs and universal binaries
 are not supported.
@@ -98,7 +98,7 @@ For Apple Silicon macOS:
 ```bash
 git checkout mac-author-build
 # To build the published Author release instead of the active branch:
-# git checkout mac-v0.3.101-author.1
+# git checkout mac-v0.3.104-author.1
 node --version
 npm ci
 ```
diff --git a/package-lock.json b/package-lock.json
index d0c7d3e..ba15d5e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "configforge",
-  "version": "0.3.101-author.1",
+  "version": "0.3.104-author.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "configforge",
-      "version": "0.3.101-author.1",
+      "version": "0.3.104-author.1",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [
@@ -20,12 +20,12 @@
         "@testing-library/react": "^16.3.2",
         "@testing-library/user-event": "^14.6.1",
         "@types/node": "^22.10.5",
-        "dompurify": "^3.4.16",
+        "dompurify": "^3.4.17",
         "eslint-config-prettier": "10.1.8",
         "jsdom": "^29.1.1",
         "prettier": "3.8.3",
         "typescript": "^5.7.3",
-        "vitest": "^4.1.11"
+        "vitest": "^4.1.12"
       },
       "engines": {
         "node": ">=22.12.0 <23.0.0 || >=24.0.0 <25.0.0",
@@ -34,7 +34,7 @@
     },
     "apps/desktop": {
       "name": "@configforge/desktop",
-      "version": "0.3.101-author.1",
+      "version": "0.3.104-author.1",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-components": "^9.73.8",
@@ -62,7 +62,7 @@
         "autoprefixer": "^10.5.0",
         "concurrently": "^9.2.5",
         "cross-env": "^7.0.3",
-        "electron": "~42.11.3",
+        "electron": "~42.11.16",
         "electron-builder": "~26.15.3",
         "esbuild": "^0.28.1",
         "eslint": "^8.57.1",
@@ -74,7 +74,7 @@
         "sharp": "0.35.5",
         "tailwindcss": "^3.4.19",
         "typescript": "^5.7.3",
-        "vite": "^6.4.3",
+        "vite": "^6.4.4",
         "wait-on": "^8.0.2"
       }
     },
@@ -1097,6 +1097,25 @@
         "util-deprecate": "~1.0.1"
       }
     },
+    "apps/desktop/node_modules/electron": {
+      "version": "42.11.18",
+      "resolved": "https://registry.npmjs.org/electron/-/electron-42.11.18.tgz",
+      "integrity": "sha512-hbzodG06x/l7uq+oeyob5ugv6qZBmJRWC7Uto5QEE99xSHUARz6d+++Rz+79T/ssTYTQkONW4ciTTcJuAbXKIQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@electron-internal/extract-zip": "^1.0.1",
+        "@electron/get": "^5.0.0",
+        "@types/node": "^24.9.0"
+      },
+      "bin": {
+        "electron": "cli.js",
+        "install-electron": "install.js"
+      },
+      "engines": {
+        "node": ">= 22.12.0"
+      }
+    },
     "apps/desktop/node_modules/electron-builder": {
       "version": "26.15.3",
       "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-26.15.3.tgz",
@@ -1154,6 +1173,16 @@
         "mime": "^2.5.2"
       }
     },
+    "apps/desktop/node_modules/electron/node_modules/@types/node": {
+      "version": "24.19.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.19.2.tgz",
+      "integrity": "sha512-93d49wCWJkCyN87MxLpNN6KXPCwFw7bVUg79mGUV1OS40JGWwVCr8n61DXCSqz7CV6/VfPkb7xec7uP2M+QHWQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": ">=7.24.0 <7.24.7"
+      }
+    },
     "apps/desktop/node_modules/fs-extra": {
       "version": "10.1.0",
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
@@ -1489,6 +1518,13 @@
         "node": ">=18.17"
       }
     },
+    "apps/desktop/node_modules/undici-types": {
+      "version": "7.24.6",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
+      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "apps/desktop/node_modules/universalify": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
@@ -5075,6 +5111,23 @@
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
+    "node_modules/@napi-rs/lzma-linux-x64-gnu": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-x64-gnu/-/lzma-linux-x64-gnu-1.5.1.tgz",
+      "integrity": "sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^22.20 || ^24.12 || >=25"
+      }
+    },
     "node_modules/@noble/ciphers": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.3.0.tgz",
@@ -5290,9 +5343,9 @@
       "license": "MIT"
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.60.3.tgz",
-      "integrity": "sha512-x35CNW/ANXG3hE/EZpRU8MXX1JDN86hBb2wMGAtltkz7pc6cxgjpy1OMMfDosOQ+2hWqIkag/fGok1Yady9nGw==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.65.1.tgz",
+      "integrity": "sha512-5coxNSjqOI2J3NkVhlp3u+zGcyjnowQFsU9sg7MMz4UPXY4Dv63kFGLt7ConXz9CNq2i0yuOJZAF/2RMrgI2OA==",
       "cpu": [
         "arm"
       ],
@@ -5304,9 +5357,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.60.3.tgz",
-      "integrity": "sha512-xw3xtkDApIOGayehp2+Rz4zimfkaX65r4t47iy+ymQB2G4iJCBBfj0ogVg5jpvjpn8UWn/+q9tprxleYeNp3Hw==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.65.1.tgz",
+      "integrity": "sha512-K0HFf6XMB3IYs+jDZ1/RRhZaVOwxNXrl0n4MDEyGDjuK7+B6K/nDJp8DCBitO3S1sK/fzNxAf9QZAny4AIUPtg==",
       "cpu": [
         "arm64"
       ],
@@ -5318,9 +5371,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.60.3.tgz",
-      "integrity": "sha512-vo6Y5Qfpx7/5EaamIwi0WqW2+zfiusVihKatLvtN1VFVy3D13uERk/6gZLU1UiHRL6fDXqj/ELIeVRGnvcTE1g==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.65.1.tgz",
+      "integrity": "sha512-zkZrXYwNlIcSUmcwY2DpsaDHr0XjVUeQHCuSunG3eQD7/5Wn/DvI7OMUE8NRRweK87yG8ebJ1xGOzmwpMsbZQA==",
       "cpu": [
         "arm64"
       ],
@@ -5332,9 +5385,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.60.3.tgz",
-      "integrity": "sha512-D+0QGcZhBzTN82weOnsSlY7V7+RMmPuF1CkbxyMAGE8+ZHeUjyb76ZiWmBlCu//AQQONvxcqRbwZTajZKqjuOw==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.65.1.tgz",
+      "integrity": "sha512-Zaed+R3cpkkA3aiNd7NO0GV5KFh/LVf8j6bGcoRdpoXkSm/mWH8M0oX2/3u/nyGcx/bHEovD9CzX+w9/gcpI4A==",
       "cpu": [
         "x64"
       ],
@@ -5346,9 +5399,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.60.3.tgz",
-      "integrity": "sha512-6HnvHCT7fDyj6R0Ph7A6x8dQS/S38MClRWeDLqc0MdfWkxjiu1HSDYrdPhqSILzjTIC/pnXbbJbo+ft+gy/9hQ==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.65.1.tgz",
+      "integrity": "sha512-h12p3WJWhyJ9kir0zqAPr0rKNmBzOWIjoaOMT9OULs9KZQZCeOMKd+mGSvERjd9VxJYShd3zIxtrVxkYz6BEVA==",
       "cpu": [
         "arm64"
       ],
@@ -5360,9 +5413,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.60.3.tgz",
-      "integrity": "sha512-KHLgC3WKlUYW3ShFKnnosZDOJ0xjg9zp7au3sIm2bs/tGBeC2ipmvRh/N7JKi0t9Ue20C0dpEshi8WUubg+cnA==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.65.1.tgz",
+      "integrity": "sha512-yRBwh/5imKY4DydDulVtrjy8Jf7h7NQJUqZbgmZ3zFsCD9QqlnWvZ7RtEF+ecO1b+IukKjXlu5Bb9fehV3tIbg==",
       "cpu": [
         "x64"
       ],
@@ -5374,9 +5427,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.60.3.tgz",
-      "integrity": "sha512-DV6fJoxEYWJOvaZIsok7KrYl0tPvga5OZ2yvKHNNYyk/2roMLqQAbGhr78EQ5YhHpnhLKJD3S1WFusAkmUuV5g==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.65.1.tgz",
+      "integrity": "sha512-1XuPiWYYaLE1UDOqhbKVOfsqxvfmFS/lYPSk92U1hEX1qRfSYH0hNeAlbxFIgjp4d6+YQmL95EPRgdvjbZEddA==",
       "cpu": [
         "arm"
       ],
@@ -5388,9 +5441,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.60.3.tgz",
-      "integrity": "sha512-mQKoJAzvuOs6F+TZybQO4GOTSMUu7v0WdxEk24krQ/uUxXoPTtHjuaUuPmFhtBcM4K0ons8nrE3JyhTuCFtT/w==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.65.1.tgz",
+      "integrity": "sha512-Y3C5e55Yrf6p2r5rBcc4P9hFWVNi6oqWy/53I/AyCJJGlp3KRSpTP8eoUmVntchTbEnhgBgAgLO9flj9AvOdUw==",
       "cpu": [
         "arm"
       ],
@@ -5402,9 +5455,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.60.3.tgz",
-      "integrity": "sha512-Whjj2qoiJ6+OOJMGptTYazaJvjOJm+iKHpXQM1P3LzGjt7Ff++Tp7nH4N8J/BUA7R9IHfDyx4DJIflifwnbmIA==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.65.1.tgz",
+      "integrity": "sha512-Itj6coSswkYPIcVLczObXmwdplHNQQxyfnK1ppBg4czDaX8RiEzLKqU7EMc64BiBuiDZEUS+M93ktM18rv5llw==",
       "cpu": [
         "arm64"
       ],
@@ -5416,9 +5469,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.60.3.tgz",
-      "integrity": "sha512-4YTNHKqGng5+yiZt3mg77nmyuCfmNfX4fPmyUapBcIk+BdwSwmCWGXOUxhXbBEkFHtoN5boLj/5NON+u5QC9tg==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.65.1.tgz",
+      "integrity": "sha512-KeO8jTEqdrnhvcahufbimyMoI44vedRUp1bVz2QUnRX2vDm/hxzCPt5F8fERVD5fsHyTW/vXmCElT054VOSVOA==",
       "cpu": [
         "arm64"
       ],
@@ -5430,9 +5483,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.60.3.tgz",
-      "integrity": "sha512-SU3kNlhkpI4UqlUc2VXPGK9o886ZsSeGfMAX2ba2b8DKmMXq4AL7KUrkSWVbb7koVqx41Yczx6dx5PNargIrEA==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.65.1.tgz",
+      "integrity": "sha512-dDOz5VZZ+ZGnglpmET6VJefamWXFsgaVtuhSClf2/URZBp048jprD6z1hddsIMN6n1w+oUzGZEBp9u6Mlszsfg==",
       "cpu": [
         "loong64"
       ],
@@ -5444,9 +5497,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.60.3.tgz",
-      "integrity": "sha512-6lDLl5h4TXpB1mTf2rQWnAk/LcXrx9vBfu/DT5TIPhvMhRWaZ5MxkIc8u4lJAmBo6klTe1ywXIUHFjylW505sg==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.65.1.tgz",
+      "integrity": "sha512-JbfRKz8nJCuo8gn1Dqx8lQWEHw4qhZ3uRaHphw5vrSjnSptJTKTRC/bLKHh8QQMsEnhL4uq+bdg3tkiXbJ2q/A==",
       "cpu": [
         "loong64"
       ],
@@ -5458,9 +5511,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.60.3.tgz",
-      "integrity": "sha512-BMo8bOw8evlup/8G+cj5xWtPyp93xPdyoSN16Zy90Q2QZ0ZYRhCt6ZJSwbrRzG9HApFabjwj2p25TUPDWrhzqQ==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.65.1.tgz",
+      "integrity": "sha512-3oQpe1q0emSeCAssVHMQdOz5fz3PBH5my/Fr0ZekV2UMNL4ZiRa1ciikYlGQXyDkeqseYYv1InwOY8YPqY7RIQ==",
       "cpu": [
         "ppc64"
       ],
@@ -5472,9 +5525,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.60.3.tgz",
-      "integrity": "sha512-E0L8X1dZN1/Rph+5VPF6Xj2G7JJvMACVXtamTJIDrVI44Y3K+G8gQaMEAavbqCGTa16InptiVrX6eM6pmJ+7qA==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.65.1.tgz",
+      "integrity": "sha512-nNV3HHi23o1LtpGGwH+Bav4hqnc4+klQtC96tSvCfvql8bLlNFTnTFiGl/jai2nve3eEr/vT2ocuyf+h+eMnYQ==",
       "cpu": [
         "ppc64"
       ],
@@ -5486,9 +5539,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.60.3.tgz",
-      "integrity": "sha512-oZJ/WHaVfHUiRAtmTAeo3DcevNsVvH8mbvodjZy7D5QKvCefO371SiKRpxoDcCxB3PTRTLayWBkvmDQKTcX/sw==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.65.1.tgz",
+      "integrity": "sha512-b5zab0FryBxuocuDeqOsYGAg2EzjKw4mKA6LjQXCyewXjGv/BXqACBsY2cO45xM4hV2weYtdjGThP2VB2ByAYg==",
       "cpu": [
         "riscv64"
       ],
@@ -5500,9 +5553,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.60.3.tgz",
-      "integrity": "sha512-Dhbyh7j9FybM3YaTgaHmVALwA8AkUwTPccyCQ79TG9AJUsMQqgN1DDEZNr4+QUfwiWvLDumW5vdwzoeUF+TNxQ==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.65.1.tgz",
+      "integrity": "sha512-Rh08xZakiUxKNgI3hbgH9mivlx478lSqckS9s+Oc3/TX1VrAH3W8z/5wpJXR/v5VjqcJ/jJNVBg64PU1+iQsTQ==",
       "cpu": [
         "riscv64"
       ],
@@ -5514,9 +5567,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.60.3.tgz",
-      "integrity": "sha512-cJd1X5XhHHlltkaypz1UcWLA8AcoIi1aWhsvaWDskD1oz2eKCypnqvTQ8ykMNI0RSmm7NkTdSqSSD7zM0xa6Ig==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.65.1.tgz",
+      "integrity": "sha512-qDgtS6juN3/k97y4kcD6XLFpXEo4f6CnG8lTOGYwlhrUYTrMyhN0WHdZCPAW5rqS0MqQG7qI7dxnjugt6QB39Q==",
       "cpu": [
         "s390x"
       ],
@@ -5528,9 +5581,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.3.tgz",
-      "integrity": "sha512-DAZDBHQfG2oQuhY7mc6I3/qB4LU2fQCjRvxbDwd/Jdvb9fypP4IJ4qmtu6lNjes6B531AI8cg1aKC2di97bUxA==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.65.1.tgz",
+      "integrity": "sha512-44IKzBPqXXVm0kt1O+F5eW4juR5FyIxGNlFkpP8qwIDzucBsjM1HCbdYUQrQw8rU/g6HRl/tfBm0+Qq4H4Ro3w==",
       "cpu": [
         "x64"
       ],
@@ -5542,9 +5595,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.60.3.tgz",
-      "integrity": "sha512-cRxsE8c13mZOh3vP+wLDxpQBRrOHDIGOWyDL93Sy0Ga8y515fBcC2pjUfFwUe5T7tqvTvWbCpg1URM/AXdWIXA==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.65.1.tgz",
+      "integrity": "sha512-tvYWZ/h2PCHs558Xu7B6LptuRCV8lXV2xI75ONMcldII1m2zlFwuI4BJZi9M6rSMkYqcPLLtPUPrjyqfbzLOdg==",
       "cpu": [
         "x64"
       ],
@@ -5556,9 +5609,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.60.3.tgz",
-      "integrity": "sha512-QaWcIgRxqEdQdhJqW4DJctsH6HCmo5vHxY0krHSX4jMtOqfzC+dqDGuHM87bu4H8JBeibWx7jFz+h6/4C8wA5Q==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.65.1.tgz",
+      "integrity": "sha512-gdyeucgZCnei3pXwadKVTEAOgRx0B+c847DUPR/PdOMmp3olhfkYo6r0J4PzRFZB5ZICZQTxntyvgmWH5xT7rg==",
       "cpu": [
         "x64"
       ],
@@ -5570,9 +5623,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.60.3.tgz",
-      "integrity": "sha512-AaXwSvUi3QIPtroAUw1t5yHGIyqKEXwH54WUocFolZhpGDruJcs8c+xPNDRn4XiQsS7MEwnYsHW2l0MBLDMkWg==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.65.1.tgz",
+      "integrity": "sha512-Wf/NEKdn2SAL4Nvt8HyDtdkseWTwiLbZEOoNYnEaHkbso0B9eHO42vKnZh+OYsn+IMhAMcWcuIwPlBOgOXsUzg==",
       "cpu": [
         "arm64"
       ],
@@ -5584,9 +5637,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.60.3.tgz",
-      "integrity": "sha512-65LAKM/bAWDqKNEelHlcHvm2V+Vfb8C6INFxQXRHCvaVN1rJfwr4NvdP4FyzUaLqWfaCGaadf6UbTm8xJeYfEg==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.65.1.tgz",
+      "integrity": "sha512-x9VSsDmsMsEWy4cr/mFeaEsXnVJ6Kc4NCAU/lCnwml3s7LQbZoa9+/qwc9etWHbuuDT5mYxdyyKUwo76njtjZw==",
       "cpu": [
         "arm64"
       ],
@@ -5598,9 +5651,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.60.3.tgz",
-      "integrity": "sha512-EEM2gyhBF5MFnI6vMKdX1LAosE627RGBzIoGMdLloPZkXrUN0Ckqgr2Qi8+J3zip/8NVVro3/FjB+tjhZUgUHA==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.65.1.tgz",
+      "integrity": "sha512-RIDbiVvvLkN45mOFpbo6eYMgnuiBEB62BGR/0s4QJgGg2AvVxucDDNn67kpAcUoYyfmY8iX8/RifMcmxmmnejA==",
       "cpu": [
         "ia32"
       ],
@@ -5612,9 +5665,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.60.3.tgz",
-      "integrity": "sha512-E5Eb5H/DpxaoXH++Qkv28RcUJboMopmdDUALBczvHMf7hNIxaDZqwY5lK12UK1BHacSmvupoEWGu+n993Z0y1A==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.65.1.tgz",
+      "integrity": "sha512-+KN8HIr88vN59JNxlrM2fMimzY43Y0lQB7+0xdVsFbvFCAA74CLKCdfzIHzzvndJryBc94Pm+MvwtukKjaS2ug==",
       "cpu": [
         "x64"
       ],
@@ -5626,9 +5679,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.60.3.tgz",
-      "integrity": "sha512-hPt/bgL5cE+Qp+/TPHBqptcAgPzgj46mPcg/16zNUmbQk0j+mOEQV/+Lqu8QRtDV3Ek95Q6FeFITpuhl6OTsAA==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.65.1.tgz",
+      "integrity": "sha512-+Y1Sd49cSDq60UOl8/U2HI0ebUvnSl/hDhMHQn+ouw17yb8fYwMWIazzJ4JFpSkjPE7sj5NTNSX9IoyEqcFfyQ==",
       "cpu": [
         "x64"
       ],
@@ -5866,9 +5919,9 @@
       "license": "MIT"
     },
     "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
       "dev": true,
       "license": "MIT"
     },
@@ -6250,16 +6303,16 @@
       }
     },
     "node_modules/@vitest/expect": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz",
-      "integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.12.tgz",
+      "integrity": "sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.11",
-        "@vitest/utils": "4.1.11",
+        "@vitest/spy": "4.1.12",
+        "@vitest/utils": "4.1.12",
         "chai": "^6.2.2",
         "tinyrainbow": "^3.1.0"
       },
@@ -6268,13 +6321,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz",
-      "integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.12.tgz",
+      "integrity": "sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.11",
+        "@vitest/spy": "4.1.12",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -6295,9 +6348,9 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz",
-      "integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.12.tgz",
+      "integrity": "sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6308,13 +6361,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz",
-      "integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.12.tgz",
+      "integrity": "sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.11",
+        "@vitest/utils": "4.1.12",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -6322,14 +6375,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz",
-      "integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.12.tgz",
+      "integrity": "sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.11",
-        "@vitest/utils": "4.1.11",
+        "@vitest/pretty-format": "4.1.12",
+        "@vitest/utils": "4.1.12",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -6338,9 +6391,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz",
-      "integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.12.tgz",
+      "integrity": "sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -6348,13 +6401,13 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz",
-      "integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.12.tgz",
+      "integrity": "sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.11",
+        "@vitest/pretty-format": "4.1.12",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -7073,9 +7126,9 @@
       "license": "CC-BY-4.0"
     },
     "node_modules/chai": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz",
+      "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7663,9 +7716,9 @@
       "peer": true
     },
     "node_modules/dompurify": {
-      "version": "3.4.16",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz",
-      "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==",
+      "version": "3.4.17",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz",
+      "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -7739,25 +7792,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/electron": {
-      "version": "42.11.3",
-      "resolved": "https://registry.npmjs.org/electron/-/electron-42.11.3.tgz",
-      "integrity": "sha512-r/rC6BikQ2vEGQLhnHmFwFpvVPlWTc/rnHcYfJe4HDa5MEl00yhx72ffKw7zMf1WvAM2r2hcGJ3ZftuJRo0QaQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@electron-internal/extract-zip": "^1.0.1",
-        "@electron/get": "^5.0.0",
-        "@types/node": "^24.9.0"
-      },
-      "bin": {
-        "electron": "cli.js",
-        "install-electron": "install.js"
-      },
-      "engines": {
-        "node": ">= 22.12.0"
-      }
-    },
     "node_modules/electron-log": {
       "version": "5.4.3",
       "resolved": "https://registry.npmjs.org/electron-log/-/electron-log-5.4.3.tgz",
@@ -7888,23 +7922,6 @@
         "node": ">=6 <7 || >=8"
       }
     },
-    "node_modules/electron/node_modules/@types/node": {
-      "version": "24.13.4",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.4.tgz",
-      "integrity": "sha512-YJ7EqCstVTzIr0fMr7qul/977en+pQHrfmuKIo6Zr9i75Be21dr3MovcfvGtyvi2HAUrRerWps5sMO9I7WaxDw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.18.0"
-      }
-    },
-    "node_modules/electron/node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/embla-carousel": {
       "version": "8.6.0",
       "resolved": "https://registry.npmjs.org/embla-carousel/-/embla-carousel-8.6.0.tgz",
@@ -8438,9 +8455,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "version": "3.1.9",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz",
+      "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
       "dev": true,
       "funding": [
         {
@@ -8616,9 +8633,9 @@
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
-      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
+      "version": "1.16.2",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz",
+      "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==",
       "dev": true,
       "funding": [
         {
@@ -9359,9 +9376,9 @@
       "optional": true
     },
     "node_modules/ip-address": {
-      "version": "10.7.2",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
-      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
+      "version": "10.7.5",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz",
+      "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -11734,13 +11751,13 @@
       }
     },
     "node_modules/rollup": {
-      "version": "4.60.3",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.60.3.tgz",
-      "integrity": "sha512-pAQK9HalE84QSm4Po3EmWIZPd3FnjkShVkiMlz1iligWYkWQ7wHYd1PF/T7QZ5TVSD6uSTon5gBVMSM4JfBV+A==",
+      "version": "4.65.1",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.65.1.tgz",
+      "integrity": "sha512-HzD4IdphaPMvuAacnL/vtoq5B8FwqewKvxTtqYibWvP6VDyZ+UsTtlw5F8HIOIIpLQAkN2NOP/0sM3puo9xN/A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "1.0.8"
+        "@types/estree": "1.0.9"
       },
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -11750,31 +11767,32 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.60.3",
-        "@rollup/rollup-android-arm64": "4.60.3",
-        "@rollup/rollup-darwin-arm64": "4.60.3",
-        "@rollup/rollup-darwin-x64": "4.60.3",
-        "@rollup/rollup-freebsd-arm64": "4.60.3",
-        "@rollup/rollup-freebsd-x64": "4.60.3",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.60.3",
-        "@rollup/rollup-linux-arm-musleabihf": "4.60.3",
-        "@rollup/rollup-linux-arm64-gnu": "4.60.3",
-        "@rollup/rollup-linux-arm64-musl": "4.60.3",
-        "@rollup/rollup-linux-loong64-gnu": "4.60.3",
-        "@rollup/rollup-linux-loong64-musl": "4.60.3",
-        "@rollup/rollup-linux-ppc64-gnu": "4.60.3",
-        "@rollup/rollup-linux-ppc64-musl": "4.60.3",
-        "@rollup/rollup-linux-riscv64-gnu": "4.60.3",
-        "@rollup/rollup-linux-riscv64-musl": "4.60.3",
-        "@rollup/rollup-linux-s390x-gnu": "4.60.3",
-        "@rollup/rollup-linux-x64-gnu": "4.60.3",
-        "@rollup/rollup-linux-x64-musl": "4.60.3",
-        "@rollup/rollup-openbsd-x64": "4.60.3",
-        "@rollup/rollup-openharmony-arm64": "4.60.3",
-        "@rollup/rollup-win32-arm64-msvc": "4.60.3",
-        "@rollup/rollup-win32-ia32-msvc": "4.60.3",
-        "@rollup/rollup-win32-x64-gnu": "4.60.3",
-        "@rollup/rollup-win32-x64-msvc": "4.60.3",
+        "@napi-rs/lzma-linux-x64-gnu": "1.5.1",
+        "@rollup/rollup-android-arm-eabi": "4.65.1",
+        "@rollup/rollup-android-arm64": "4.65.1",
+        "@rollup/rollup-darwin-arm64": "4.65.1",
+        "@rollup/rollup-darwin-x64": "4.65.1",
+        "@rollup/rollup-freebsd-arm64": "4.65.1",
+        "@rollup/rollup-freebsd-x64": "4.65.1",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.65.1",
+        "@rollup/rollup-linux-arm-musleabihf": "4.65.1",
+        "@rollup/rollup-linux-arm64-gnu": "4.65.1",
+        "@rollup/rollup-linux-arm64-musl": "4.65.1",
+        "@rollup/rollup-linux-loong64-gnu": "4.65.1",
+        "@rollup/rollup-linux-loong64-musl": "4.65.1",
+        "@rollup/rollup-linux-ppc64-gnu": "4.65.1",
+        "@rollup/rollup-linux-ppc64-musl": "4.65.1",
+        "@rollup/rollup-linux-riscv64-gnu": "4.65.1",
+        "@rollup/rollup-linux-riscv64-musl": "4.65.1",
+        "@rollup/rollup-linux-s390x-gnu": "4.65.1",
+        "@rollup/rollup-linux-x64-gnu": "4.65.1",
+        "@rollup/rollup-linux-x64-musl": "4.65.1",
+        "@rollup/rollup-openbsd-x64": "4.65.1",
+        "@rollup/rollup-openharmony-arm64": "4.65.1",
+        "@rollup/rollup-win32-arm64-msvc": "4.65.1",
+        "@rollup/rollup-win32-ia32-msvc": "4.65.1",
+        "@rollup/rollup-win32-x64-gnu": "4.65.1",
+        "@rollup/rollup-win32-x64-msvc": "4.65.1",
         "fsevents": "~2.3.2"
       }
     },
@@ -12823,9 +12841,9 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz",
-      "integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.2.0.tgz",
+      "integrity": "sha512-LgO3D9yZJjApUiuUfl9iFAwrtaX4+lok3wJIqttGoKCHlWUqHqbQpnxCf82L8FjgKsh4iGo78hqJwgL8F6To2A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13180,9 +13198,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "6.4.3",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
-      "integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
+      "version": "6.4.5",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.5.tgz",
+      "integrity": "sha512-4enwjFfi4IwtEh0w+jPzpLVOFQiPHmmzPxcHXQOyEur47o6u0jE573DmGpjA+7irXoMLYRZD5ZaFUEneS3abPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13288,9 +13306,9 @@
       }
     },
     "node_modules/vite/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13301,19 +13319,19 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
-      "integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.12.tgz",
+      "integrity": "sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.11",
-        "@vitest/mocker": "4.1.11",
-        "@vitest/pretty-format": "4.1.11",
-        "@vitest/runner": "4.1.11",
-        "@vitest/snapshot": "4.1.11",
-        "@vitest/spy": "4.1.11",
-        "@vitest/utils": "4.1.11",
+        "@vitest/expect": "4.1.12",
+        "@vitest/mocker": "4.1.12",
+        "@vitest/pretty-format": "4.1.12",
+        "@vitest/runner": "4.1.12",
+        "@vitest/snapshot": "4.1.12",
+        "@vitest/spy": "4.1.12",
+        "@vitest/utils": "4.1.12",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -13341,12 +13359,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.11",
-        "@vitest/browser-preview": "4.1.11",
-        "@vitest/browser-webdriverio": "4.1.11",
-        "@vitest/coverage-istanbul": "4.1.11",
-        "@vitest/coverage-v8": "4.1.11",
-        "@vitest/ui": "4.1.11",
+        "@vitest/browser-playwright": "4.1.12",
+        "@vitest/browser-preview": "4.1.12",
+        "@vitest/browser-webdriverio": "^4.1.11",
+        "@vitest/coverage-istanbul": "4.1.12",
+        "@vitest/coverage-v8": "4.1.12",
+        "@vitest/ui": "4.1.12",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
diff --git a/package.json b/package.json
index bd62fdf..43fd77e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "configforge",
-  "version": "0.3.101-author.1",
+  "version": "0.3.104-author.1",
   "private": true,
   "license": "MIT",
   "description": "ConfigForge \u2014 Cross-platform Electron desktop app for OSConfig security baseline authoring",
@@ -46,12 +46,12 @@
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/node": "^22.10.5",
-    "dompurify": "^3.4.16",
+    "dompurify": "^3.4.17",
     "eslint-config-prettier": "10.1.8",
     "jsdom": "^29.1.1",
     "prettier": "3.8.3",
     "typescript": "^5.7.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   },
   "overrides": {
     "@xmldom/xmldom": "^0.8.15",
@@ -66,6 +66,10 @@
     "esbuild": "^0.28.1",
     "js-yaml": "^4.3.2",
     "undici@7": "^7.29.1",
-    "undici@6": "^6.28.1"
+    "undici@6": "^6.28.1",
+    "monaco-editor": {
+      "dompurify": "$dompurify"
+    },
+    "vite@6": "^6.4.4"
   }
 }
diff --git a/scripts/customer-docs.test.mjs b/scripts/customer-docs.test.mjs
index 49aef54..f24c3bc 100644
--- a/scripts/customer-docs.test.mjs
+++ b/scripts/customer-docs.test.mjs
@@ -20,8 +20,8 @@ describe('customer documentation contracts', () => {
     expect(readme).toContain('not intended for');
     expect(readme).toContain('production use');
     expect(readme).toContain('not an officially supported Microsoft product');
-    expect(readme).toContain('https://github.com/Azure/ConfigForge/releases/tag/v0.3.103');
-    expect(readme).toContain('https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.101-author.1');
+    expect(readme).toContain('https://github.com/Azure/ConfigForge/releases/tag/v0.3.104');
+    expect(readme).toContain('https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.104-author.1');
     expect(readme).not.toContain('mac-v0.3.97-author.1');
   });
 
diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs
index 8ee855f..0941b9b 100644
--- a/scripts/release-metadata.test.mjs
+++ b/scripts/release-metadata.test.mjs
@@ -136,7 +136,9 @@ describe('public release metadata', () => {
     expect(packageJson.overrides['undici@7']).toBe('^7.29.1');
     expect(packageJson.overrides['postcss-selector-parser']).toBe('^7.1.6');
     expect(packageJson.overrides.dompurify).toBe('$dompurify');
-    expect(packageJson.devDependencies.dompurify).toBe('^3.4.16');
+    expect(packageJson.overrides['monaco-editor'].dompurify).toBe('$dompurify');
+    expect(packageJson.overrides['vite@6']).toBe('^6.4.4');
+    expect(packageJson.devDependencies.dompurify).toBe('^3.4.17');
     expect(lockfile.packages[''].devDependencies.dompurify).toBe(
       packageJson.devDependencies.dompurify,
     );
@@ -156,10 +158,15 @@ describe('public release metadata', () => {
 
   it.each([
     ['axios', { 1: [20, 0] }],
-    ['dompurify', { 3: [4, 16] }],
-    ['fast-uri', { 3: [1, 8] }],
+    ['dompurify', { 3: [4, 17] }],
+    ['follow-redirects', { 1: [16, 1] }],
+    ['vitest', { 4: [1, 12] }],
+    ['@vitest/mocker', { 4: [1, 12] }],
+    ['electron', { 42: [11, 16] }],
+    ['vite', { 6: [4, 4], 7: [3, 7], 8: [3, 3] }],
+    ['fast-uri', { 3: [1, 9] }],
     ['http-cache-semantics', { 4: [3, 0] }],
-    ['ip-address', { 10: [7, 2] }],
+    ['ip-address', { 10: [7, 4] }],
     ['joi', { 18: [2, 9] }],
     ['postcss-selector-parser', { 7: [1, 6] }],
     ['sharp', { 0: [35, 5] }],
@@ -367,8 +374,8 @@ describe('public release metadata', () => {
     expect(contributing).toContain('creates immutable release tags and draft');
     expect(support).toContain('The current repository maintainer is');
     expect(readme).toContain('for ownership, active-branch, review, release, and cherry-pick guidance');
-    expect(security).toContain('v0.3.101');
-    expect(security).toContain('mac-v0.3.101-author.1');
+    expect(security).toContain('v0.3.104');
+    expect(security).toContain('mac-v0.3.104-author.1');
     expect(security).toContain('Microsoft Security Response Center');
     expect(security).toContain('Microsoft OSConfig project');
     expect(support).toContain('best-effort basis');