[acamarata]

What changed

• frontend/platforms/desktop/package.json: electron ^41.10.6 -> ^42.11.18 (42.x latest; covers fixes up to 42.11.9). This manifest is not a pnpm workspace member and electron is not in pnpm-lock.yaml, so the alerts were manifest-only. electron-builder ^25.1.8 left as is.
• package.json + pnpm-lock.yaml overrides: ip-address >=10.7.4, @vitest/mocker >=4.1.12 <5.0.0 (override blocks match).
• Lockfile hand edited (resolver would not move transitives without a wide re-resolve): ip-address 10.7.1 -> 10.7.4, @vitest/mocker 4.1.11 -> 4.1.12 (+ its exact dep @vitest/spy 4.1.12). Integrity from the npm registry. Diff: 19 insertions, 14 deletions.

Stale alerts (already fixed on origin/main)

• zod: lockfile has only 4.6.7 (>= 4.6.6), from fix(deps): zod 4.6.7 for GHSA-mrhx-c7xc-m3w5 #208.
• @sentry/nextjs: lockfile has only 11.9.0 (>= 10.75.2) plus override @sentry/nextjs@<10.75.2.

Commands and results

• pnpm install --frozen-lockfile --ignore-scripts: ok; pnpm install --lockfile-only: no change
• pnpm why -r ip-address @vitest/mocker: only 10.7.4 and 4.1.12
• TZ=America/New_York pnpm test in desktop (7 passed), packages/ui (110 passed); frontend-vite has no tests
• pnpm type-check: packages/ui clean; frontend-vite 169 TS errors, identical count on a clean origin/main worktree (already red, D-1475). desktop has no type-check script.
• No lint run: only manifests/lockfile changed. Not run: electron build/package (no electron 42 migration check of main-process code).

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/electron	^42.11.18	Unknown	Unknown
npm/@vitest/mocker	4.1.12	Unknown	Unknown
npm/@vitest/spy	4.1.12	Unknown	Unknown
npm/ip-address	10.7.4	🟢 6.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• frontend/platforms/desktop/package.json
• pnpm-lock.yaml

[github-actions]

Coverage after merging fix/advisory-wave3 into main will be

30.14%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
src
middleware.ts	0%	0%	0%	0%	100, 100, 108, 116–117, 117–118, 122–123, 123–124, 128–129, 129–130, 133, 141, 143–144, 144, 144, 144–145, 151–152, 152–154, 154, 154, 154–156, 156–157, 157, 157, 16, 162, 164, 172, 179–181, 196, 198, 198, 198, 200, 204, 204, 21, 210, 210, 210, 210, 210, 210, 217, 217, 220, 230, 233, 236–240, 246, 246–247, 254, 256, 26, 262–263, 266, 266–267, 272–273, 278, 282, 282, 282, 282, 282, 284, 288, 290, 290–292, 295, 295–296, 303, 306, 306, 306, 306, 306, 306, 312–313, 313, 313, 317–318, 318, 318–319, 322, 322, 324, 324–325, 325, 325, 325, 325, 331–332, 334–335, 339, 339, 341, 341–345, 349, 349, 349, 349–350, 350, 352–355, 360–361, 365–366, 372, 40, 45, 50, 55, 60, 66–67, 67–68, 70, 70, 70, 78, 85, 92, 99
src/app
error.tsx	0%	100%	0%	0%	16–17, 19, 3–5
layout.tsx	0%	0%	0%	0%	10, 107, 123, 147, 150, 2, 20, 20, 20, 22, 22, 22, 226, 226, 24, 3–5, 8
loading.tsx	0%	100%	0%	0%	1, 7
not-found.tsx	0%	100%	0%	0%	1, 7
page.tsx	0%	0%	0%	0%	3, 35–38, 4, 40, 40, 40, 42–43, 43, 46, 46–48, 5, 52, 52, 52, 52, 52, 54, 54–55, 57, 6, 60–61, 65, 7, 73
src/app/(authenticated)/bookmarks
page.tsx	0%	100%	0%	0%	10–12, 14, 9
src/app/activity
page.tsx	0%	0%	0%	0%	10, 113, 113, 134, 142, 142, 147, 16, 162, 162, 162, 167, 167, 167, 17, 171, 18, 184, 186, 186, 189, 191, 191, 191, 191–193, 198, 205, 205, 210, 210, 222, 229, 229, 58, 74, 77, 80, 80–81, 9, 91–92
src/app/admin
loading.tsx	0%	0%	0%	0%	1, 104, 2–3, 38, 42, 42, 77, 9, 91
page.tsx	0%	0%	0%	0%	100–101, 103–104, 104, 104, 104, 104–105, 109–111, 111, 111, 111, 111–112, 115, 115, 115, 115, 115–116, 17–19, 199, 20–21, 239, 248, 248, 251, 251, 257, 261, 261, 28–29, 3, 30–31, 36, 39, 4, 43, 5, 52, 6–7, 90, 97–99
src/app/admin/advanced
page.tsx	0%	0%	0%	0%	106–110, 112–113, 113, 113, 113, 113–114, 118, 118, 118, 118, 118–119, 14–15, 25–26, 33–38, 392, 394, 41–45, 48, 77
src/app/admin/analytics
page.tsx	0%	0%	0%	0%	100, 100, 100, 100, 100, 103–107, 117, 124–125, 125, 130, 133, 133, 133–135, 135–137, 141, 141, 141–143, 143–145, 15, 154–159, 16, 160, 160, 163, 167–168, 168, 168–169, 169, 169, 17, 171, 171, 171, 173, 177, 18, 181–182, 182–183, 191, 193, 196, 196, 196–197, 200, 200, 208–209, 209–210, 216, 219, 219, 224–226, 226, 226–228, 228, 228, 230, 25, 256–257, 259, 26, 263, 265–266, 269, 271–279, 282, 282, 3, 313, 33, 331, 331, 34–36, 4, 41, 44, 49, 5, 52, 57, 60, 65, 68, 73, 76, 81, 84, 88, 96–98
src/app/admin/audit
page.tsx	0%	0%	0%	0%	116–117, 119–120, 123, 123, 123, 123, 123, 123, 125, 127, 129–130, 132, 134, 136, 138, 140, 143–144, 147, 149, 149, 149, 151, 151, 155, 163, 163, 171, 171, 177, 177, 189, 19, 196–198, 206, 209, 21, 211–212, 215–216, 216, 216, 216, 216–217, 22, 222–223, 225–229, 23, 233–234, 236–240, 243–244, 247–250, 252–255, 258, 258, 258, 258, 258–259, 263–267, 28, 289, 289, 291, 291, 299, 30, 303, 305, 305, 307, 307, 31, 322, 322, 43, 50, 59–60, 67, 7, 73, 79, 8, 80, 88, 9
src/app/admin/audit/security
page.tsx	0%	0%	0%	0%	10, 114, 12, 122, 13, 136, 136, 136, 140, 148, 148, 148, 15,

[github-actions]

PR Checks Summary

Check	Status
Lint & Format	✅ success
Type Check	✅ success
Unit Tests	✅ success
Build	✅ success

---

✅ All checks passed! Ready for review.