Amir Bredy (ABMFST) · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -15,21 +15,22 @@ The renderer is built with Vite and routes through a typed IPC bridge (`window.c
 
 ### Current repository snapshot
 
-The following release references describe the current tagged source lines:
+The following release lines were prepared on 2026-10-28. GitHub release
+pages are authoritative for publication and asset status:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.101` | Current Full-edition Windows/Linux release, published as a prerelease with the enforcement and dependency-security fixes. |
-| `mac-author-build` | `mac-v0.3.101-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. |
+| `main` | `v0.3.104` | Current Full-edition Windows/Linux release, published as a prerelease with the enforcement and dependency-security fixes. |
+| `mac-author-build` | `mac-v0.3.104-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. |
 
 On `mac-author-build`, the root package, desktop package, and matching lockfile
-records use `0.3.101-author.1`. This release preserves the author-only
+records use `0.3.104-author.1`. This release preserves the author-only
 capability boundary while porting shared baseline, lossless data, Machine
 Configuration packaging, build compatibility, and dependency-security fixes.
-The package version on `main` is `0.3.101`; do not copy macOS package metadata
+The package version on `main` is `0.3.104`; do not copy macOS package metadata
 to `main`.
 
-The prior macOS Author release is `mac-v0.3.98-author.1`.
+The prior macOS Author release is `mac-v0.3.101-author.1`.
 
 ### Current feature inventory
 
@@ -119,13 +120,13 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
 - The macOS tag must resolve to the exact final validated commit on
   `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and
   defaults to `Azure/ConfigForge`.
-- The current macOS Author release `mac-v0.3.101-author.1` contains exactly
+- The current macOS Author release `mac-v0.3.104-author.1` contains exactly
   these asset names:
 
   | Asset | Exact name |
   |---|---|
-  | DMG | `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg` |
-  | Blockmap | `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap` |
+  | DMG | `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg` |
+  | Blockmap | `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg.blockmap` |
   | Update metadata | `latest-mac.yml` |
   | CycloneDX SBOM | `sbom-macos-author.cdx.json` |
   | SHA-256 manifest | `SHA256SUMS-macos-author.txt` |
@@ -141,7 +142,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
   gh workflow run "Release (macOS author)" `
     --repo Azure/ConfigForge `
     --ref main `
-    -f release_tag=mac-v0.3.101-author.1
+    -f release_tag=mac-v0.3.104-author.1
   ```
 
 - `--ref main` selects the reviewed workflow definition, not the source to
@@ -450,7 +451,7 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann
   Manifest Editor tests, two isolated Playwright scenarios, lint with 0
   errors, the desktop build, and a production audit with 0 vulnerabilities.
 - The prior macOS Author release is `mac-v0.3.98-author.1`.
-- The current macOS Author release is `mac-v0.3.101-author.1`; use current
+- The current macOS Author release is `mac-v0.3.104-author.1`; use current
   GitHub checks and release metadata as the authority for build and asset
   status rather than recording a merge SHA or workflow run here.
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,58 +1,39 @@
 # Changelog
 
-## [Unreleased]
+## [0.3.104-author.1] - 2026-10-28
 
-### Documentation
+### Changed
+
+- Bring the Apple Silicon Author edition to the 0.3.104 release line while
+  keeping device deploy, audit, enforce, revert, and elevation excluded.
+- Simplify installation and first-baseline guidance. Require **Microsoft.OSConfig
+  PowerShell module 1.4.10+** on the separate machine creating Machine
+  Configuration packages; PowerShell 7 is a distinct prerequisite.
+  ([#143](https://github.com/Azure/ConfigForge/pull/143))
+
+### Fixed
 
-- Lead the README and documentation site with release downloads, edition
-  selection, and a first saved baseline without CLI, admin access, or Azure.
-  Keep advanced packaging and contributor references available without making
-  them prerequisites; clarify unsigned-download risks and report terminology.
-- Require the **Microsoft.OSConfig PowerShell module 1.4.10+** on the machine
-  creating Machine Configuration packages, separately from PowerShell 7 and
-  GuestConfiguration. Centralize Audit-first packaging, reject missing/older
-  modules before MOF version resolution, preserve exact-version binding and
-  immutable ZIP/hash guidance, and label the 1.4.3 patch helper historical.
-  This does not claim that all upstream baseline issues are resolved.
+- Include the reviewed Windows Server 2016-2025 template repairs for authoring
+  and Machine Configuration export, including effective firewall defaults and
+  non-mutating account-policy checks. These do not enable device operations
+  on macOS. ([#120](https://github.com/Azure/ConfigForge/pull/120))
 
 ### Security
 
-- Update DOMPurify to 3.4.16, Axios to 1.20.0, ip-address to 10.7.2,
-  all supported brace-expansion lines, and both Undici lines for current
-  Dependabot advisories. Guard every resolved copy against regression.
-- Patch additional full-audit findings in sharp, fast-uri, joi, and
-  source-map-js without changing the application's version or framework majors.
-- Update http-cache-semantics to 4.3.0, outside the reported affected range,
-  and override the vulnerable CSS selector parser with 7.1.6+. Preserve
-  Tailwind 3 and cover its generated variants and child selectors in a
-  compatibility regression test.
-- Update concurrently to 9.2.5 and its shell-quote dependency to 1.12.0.
-  Correct the root override that otherwise keeps the vulnerable 1.9.0
-  shell-quote copy despite the parent-package update.
-- Refresh the SHA-pinned setup-node and upload-artifact GitHub Actions.
-- Validate the author build and native icon generation on a hosted macOS
-  runner, including the compiled preload's author-only capability boundary.
-- Keep the unpatched build-only braces (`GHSA-vfj7-8cjw-p6xm`) and
-  sprintf-js (`GHSA-hp3w-g68c-fv3c`) advisories visible. Neither upstream
-  package has a patched release; no advisory is suppressed or dismissed.
-- Upgrade the pinned CycloneDX SBOM generator to 6.0.0 to fix Windows
-  workspace-argument shell injection (`GHSA-q69g-4hcv-6jg4`). Guard the
-  manifest and every lockfile copy against reintroducing a vulnerable release.
-- Port the dependency security fixes from the Full edition without changing
-  the macOS Author version or capability boundary: require xmldom 0.8.15+,
-  brace-expansion 1.1.18 / 2.1.4 / 5.0.9, and nanoid 3.3.18+.
-- Update Electron within 42.x to 42.11.3, replacing the vulnerable legacy
-  `extract-zip` installation dependency with Electron-maintained extraction.
-- Guard every resolved copy and Electron workspace/lockfile consistency
-  against regressions.
-- Bring across the remaining Full-edition dependency fixes identified by
-  the author-branch audit: js-yaml 4.3.2, sharp 0.35.4, Vitest 4.1.11+,
-  and patched Browserslist, fast-uri, Joi, postcss-selector-parser, and
-  baseline-browser-mapping transitive dependencies.
+- Update Electron to 42.11.18 and ship the dependency fixes, including
+  DOMPurify 3.4.17 and js-yaml 4.3.2, with the Author capability boundary
+  preserved. ([#132](https://github.com/Azure/ConfigForge/pull/132),
+  [#141](https://github.com/Azure/ConfigForge/pull/141))
+- Resolve the release-blocking DOMPurify advisories and Electron certificate
+  mitigations. Patch affected Vitest, Vite, redirect, URI, and address-parser
+  dependencies, with regression guards for every resolved copy.
+- Include a SHA-256 manifest and CycloneDX software bill of materials.
+  Development-only advisories remain tracked separately; no clean full-audit
+  claim or advisory suppression is implied.
 
 ## [0.3.101-author.1] - 2026-08-07
 
-> `mac-v0.3.101-author.1` is the current macOS Author release and is
+> `mac-v0.3.101-author.1` is a prior macOS Author release and is
 > published as a prerelease. The author-only capability boundary is unchanged:
 > device deploy, audit, enforce, revert, elevation, health, and audit-results
 > storage remain excluded.

diff --git a/INSTALL.md b/INSTALL.md
@@ -15,10 +15,10 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The current Windows/Linux Full-edition release is `v0.3.103`. The current
-macOS Author release is `mac-v0.3.101-author.1`. Both are published as
-prereleases. The Full-edition package version on `main` is `0.3.103`; the
-macOS Author package version is `0.3.101-author.1`.
+The current Windows/Linux Full-edition release is `v0.3.104`. The current
+macOS Author release is `mac-v0.3.104-author.1`. Both are published as
+prereleases. The Full-edition package version on `main` is `0.3.104`; the
+macOS Author package version is `0.3.104-author.1`.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.
 
@@ -30,8 +30,8 @@ CLI state so you can switch to device operations after installing the CLI.
 ## Install the desktop app
 
 1. Open the [ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
-   page. Choose **Full v0.3.103** for Windows/Linux x64 or
-   **Author mac-v0.3.101-author.1** for Apple Silicon macOS. Expand **Assets**
+   page. Choose **Full v0.3.104** for Windows/Linux x64 or
+   **Author mac-v0.3.104-author.1** for Apple Silicon macOS. Expand **Assets**
    and download the appropriate installer/archive and published checksum
    manifest. Source-code archives are for contributors, not app installers.
 2. Compare the download's SHA-256 with its entry in the release checksum
@@ -182,7 +182,7 @@ later). The release contains an ARM64-only binary. It is not an x64 or
 universal build and does not support Intel Macs. Rosetta does not provide
 ARM64-on-Intel compatibility.
 
-The current macOS Author release is `mac-v0.3.101-author.1`, published as a
+The current macOS Author release is `mac-v0.3.104-author.1`, published as a
 prerelease after its five assets pass validation. Users can download the
 release or build the tagged source by following the instructions in the
 [Azure/ConfigForge repository](https://github.com/Azure/ConfigForge).

diff --git a/README.md b/README.md
@@ -22,11 +22,11 @@ Enforce, Revert, elevation, or CLI-health controls.
 
 | Your computer | Download | What you can do |
 | --- | --- | --- |
-| Windows or Linux (x64) | **Full** — [v0.3.103](https://github.com/Azure/ConfigForge/releases/tag/v0.3.103) | Author, validate, compare, and export. Optional local Deploy, Audit, and Revert require the separately installed `oscfg` CLI. |
-| macOS on Apple Silicon (M1 or later) | **Author** — [mac-v0.3.101-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.101-author.1) | The same authoring and review workflows, including Audit Pack export; no device operations. ARM64 only—not Intel or universal. |
+| Windows or Linux (x64) | **Full** — [v0.3.104](https://github.com/Azure/ConfigForge/releases/tag/v0.3.104) | Author, validate, compare, and export. Optional local Deploy, Audit, and Revert require the separately installed `oscfg` CLI. |
+| macOS on Apple Silicon (M1 or later) | **Author** — [mac-v0.3.104-author.1](https://github.com/Azure/ConfigForge/releases/tag/mac-v0.3.104-author.1) | The same authoring and review workflows, including Audit Pack export; no device operations. ARM64 only—not Intel or universal. |
 
-Both releases are **prereleases**. Full-edition package versions are `0.3.103`;
-the macOS Author package version is `0.3.101-author.1`.
+Both releases are **prereleases**. Full-edition package versions are `0.3.104`;
+the macOS Author package version is `0.3.104-author.1`.
 
 **Downloads are unsigned; macOS builds are also not notarized.** Download only
 from this repository's release page, compare the asset's SHA-256 with the
@@ -242,7 +242,7 @@ Past module-version validation records are not current packaging prerequisites.
 
 | Version | Highlights |
 |---|---|
-| **0.3.101-author.1** (current macOS prerelease) | Ports the author-safe WS2022 baseline repairs, lossless QWord and Registry handling, Machine Configuration packaging compatibility, Node 24 build support, and dependency-security fixes. |
+| **0.3.101-author.1** (prior macOS prerelease) | Ports the author-safe WS2022 baseline repairs, lossless QWord and Registry handling, Machine Configuration packaging compatibility, Node 24 build support, and dependency-security fixes. |
 | **0.3.101** (prior Windows/Linux prerelease) | Clears the remaining dependency alerts after the verified OSConfig enforcement and Machine Configuration fixes. |
 | **0.3.98-author.1** (prior macOS prerelease) | Adds complete Machine Configuration documentation and removes stale/internal public-doc guidance. |
 | **0.3.98** (prior Windows/Linux source) | Adds the same public Machine Configuration guide and documentation cleanup to the Full edition. |

diff --git a/SECURITY.md b/SECURITY.md
@@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged release lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.101` | Supported published prerelease |
-| macOS Author edition | `mac-v0.3.101-author.1` | Supported published prerelease |
+| Full edition for Windows and Linux | `v0.3.104` | Supported published prerelease |
+| macOS Author edition | `mac-v0.3.104-author.1` | Supported published prerelease |
 | Older versions | Earlier tags | Not supported |
 
 ## Security scope

diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md
@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.101-author.1:** the release pipeline
+> **Current through v0.3.104-author.1:** the release pipeline
 > generates a CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and

diff --git a/apps/desktop/build/release-notes-author.md b/apps/desktop/build/release-notes-author.md
@@ -1,43 +1,61 @@
-# ConfigForge Author 0.3.101-author.1 - macOS
+# ConfigForge Author 0.3.104-author.1 - macOS
 
 > **Release state: prerelease.**
 
-This release brings the author-safe Windows Server baseline, lossless data,
-Machine Configuration packaging, build compatibility, and dependency security
-updates from the 0.3.101 Full-edition line to Apple Silicon Macs.
+This maintenance release brings the merged baseline-template repairs,
+security updates, and clearer customer guidance to Apple Silicon Macs.
 
-## Added
+## Changed
 
-- Added a fail-closed Azure Machine Configuration package helper that patches
-  both packaged Microsoft.OSConfig 1.4.3 Set wrappers to pass resource
-  properties as compressed JSON.
+- Start with the correct download and a first saved baseline. Advanced
+  comparison, benchmark, reporting, and packaging workflows remain optional.
+  ([#143](https://github.com/Azure/ConfigForge/pull/143))
+- Creating Machine Configuration packages requires the
+  **Microsoft.OSConfig PowerShell module 1.4.10+** on a separate compatible
+  packaging machine. PowerShell 7 and GuestConfiguration are distinct
+  prerequisites. Do not apply the historical 1.4.3 package patch to newer
+  modules. See the [packaging guide](https://azure.github.io/ConfigForge/user-guide/machine-configuration.html).
 
 ## Fixed
 
-- Repaired the Windows Server 2022 Member Server, Domain Controller, and
-  Workgroup Member baselines for standalone authoring and Machine
-  Configuration export.
-- Preserved exact QWord values and canonical Registry contracts across YAML,
-  JSON, spreadsheets, Visual mode, Diff, reports, registration, and MOF
-  export.
-- Serialized overlapping history-retention and rationale writes.
-- Supported source builds on Node 22.12 and Node 24.
+- Include the reviewed Windows Server 2016-2025 template repairs for
+  authoring and export, including effective firewall defaults and
+  non-mutating account-policy checks.
+  ([#120](https://github.com/Azure/ConfigForge/pull/120))
 
 ## Security
 
-- Updated js-yaml to 4.3.1, DOMPurify to 3.4.13, fast-uri to 3.1.5,
-  ip-address to 10.4.0, React Router to 7.18.2, Undici 6.x to 6.28.0, and
-  Undici 7.x to 7.29.0.
+- Ship the dependency updates, including Electron 42.11.18,
+  DOMPurify 3.4.17, and js-yaml 4.3.2. Address the newly reported sanitizer
+  bypasses and Electron certificate mitigations before publication.
+  ([#132](https://github.com/Azure/ConfigForge/pull/132),
+  [#141](https://github.com/Azure/ConfigForge/pull/141))
+- Include a SHA-256 manifest and CycloneDX software bill of materials.
+  Development-only advisories remain tracked separately; the entire
+  development dependency tree is not claimed to be advisory-free.
 
 ## Author-only scope
 
 - Device deploy, audit, enforce, revert, elevation, health, and audit-results
   storage remain intentionally excluded.
+- Apple Silicon ARM64 only; no Intel or universal build. Authoring, Diff,
+  Benchmark Mapping, history, rationale, and Audit Pack exports remain available.
+
+## Important limits
+
+ConfigForge remains experimental, community-maintained, not an officially
+supported Microsoft product, and not intended for production use. This
+download is **unsigned and not notarized**. Verify its SHA-256 and follow your
+organization's software policy; a checksum is not proof of publisher identity
+or safety. Back up your work before upgrading. Existing baseline data is not
+automatically replaced by bundled template updates.
 
 ## Expected assets
 
-1. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg`
-2. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap`
+1. `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg`
+2. `ConfigForge-Author-0.3.104-author.1-mac-arm64.dmg.blockmap`
 3. `latest-mac.yml`
 4. `sbom-macos-author.cdx.json`
 5. `SHA256SUMS-macos-author.txt`
+
+[Full changes](https://github.com/Azure/ConfigForge/compare/mac-v0.3.101-author.1...mac-v0.3.104-author.1)
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@configforge/desktop",
-  "version": "0.3.101-author.1",
+  "version": "0.3.104-author.1",
   "private": true,
   "description": "ConfigForge \u2014 OSConfig Baseline Editing tool",
   "main": "./dist/electron/main.js",
@@ -58,7 +58,7 @@
     "autoprefixer": "^10.5.0",
     "concurrently": "^9.2.5",
     "cross-env": "^7.0.3",
-    "electron": "~42.11.3",
+    "electron": "~42.11.16",
     "electron-builder": "~26.15.3",
     "esbuild": "^0.28.1",
     "eslint": "^8.57.1",
@@ -70,7 +70,7 @@
     "sharp": "0.35.5",
     "tailwindcss": "^3.4.19",
     "typescript": "^5.7.3",
-    "vite": "^6.4.3",
+    "vite": "^6.4.4",
     "wait-on": "^8.0.2"
   }
 }
diff --git a/docs/src/architecture/system-overview.md b/docs/src/architecture/system-overview.md
@@ -1,6 +1,6 @@
 # System overview
 
-ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.101`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.101-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package.
+ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.104`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.101-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package.
 
 There is no HTTP server, database, queue, or microservice layer in the current app. Renderer code calls the Electron preload bridge (`window.cfs.*`), the main process validates IPC payloads, and pure handlers in `packages/core` own filesystem and CLI operations.