[Juliusolsson05]

Why

Dependabot has been failing every npm run since 2026-09-22 01:45 UTC, security updates included. The Actions logs (runs 35677018418, 35799604717, 35833987779) all abort with:

lockfile.dependencies.electron-updater must be an object (dependency_file_not_parseable)

The hand merge in 523f3050 left a lockfile-v1 top-level "dependencies": { "electron-updater": "^6.6.2" } block at the end of the v3 file, and put electron-updater under the root entry's dependencies, while package.json has it under devDependencies. npm ignores both, so CI stayed green. Meanwhile three alerts went unpatched:

Alert	Severity	Scope
builder-util-runtime < 9.7.0 via electron-updater: cross-origin redirect leaks PRIVATE-TOKEN / mixed-case Authorization	high	the self-updater we ship
vitest < 4.1.11: path traversal via @vitest/mocker redirect mock	medium	dev
@vitest/mocker (same advisory)	medium	dev

Change

1. 1c47e8ec: lockfile repair, by hand. Deletes the stray block and moves electron-updater back to the root entry's devDependencies. No regeneration: npm 10 and npm 11 place an optional esbuild peer differently (chore(deps): security updates from #991 with a lockfile both CI gates accept #1042), so a regenerated lock passes one CI gate and fails the other.
2. 3939df83: the patched versions.
   • electron-updater 6.6.2 → 6.8.9. It pins builder-util-runtime 9.7.0, which is already the hoisted copy, so the vulnerable nested 9.3.1 goes away.
   • vitest and @vitest/coverage-v8 4.1.7 → 4.1.11.
   • Re-resolving the tree lets vitest use the app's own vite 7.3.6 (vitest already accepted ^6 || ^7 || ^8; the old nested copy was an artefact of how the lock was built). That drops the nested vite 8.0.14 + rolldown + esbuild 0.28 tree, which was the exact package chore(deps): security updates from #991 with a lockfile both CI gates accept #1042 had to work around. It also clears the two vite alerts (Persist status mode and tighten command flows #10 high, Fix mac release workflow #11 medium), which only matched that nested 8.0.14.

The lock was produced with npm 11 --package-lock-only and checked entry by entry against main. Only these packages changed: 1 entry added (@vitest/mocker hoisted), 48 removed (the nested vite/rolldown/esbuild tree and nested builder-util-runtime), 9 version changes (the vitest family and electron-updater). No same-version entry changed.

UpdateService relies on electron-updater behaviour that still holds in 6.8.9. AppUpdater's constructor still derives allowPrerelease from the running version (AppUpdater.js:218), so forcing it off afterwards still works. setFeedURL, autoInstallOnAppQuit and allowDowngrade keep their shapes.

Verification

• npm ci --include=dev --ignore-scripts under npm 10.9.0 (Node 22.12) and npm 11.11.0 (Node 24): both succeed, and both leave the lockfile byte-identical.
• npx tsc -b: clean.
• vitest run --project unit on vitest 4.1.11: 487 files, 4,278 tests pass.
• vitest run src/main/updates: pass.

Not verifiable here: a real self-update on a packaged, signed build. The next preview nightly exercises the updater feed.

3. 30137cc2: dependabot.yml. Monaco, the four packages shared with workflow-mcp, vscode-languageserver-protocol and esbuild are ignored for routine minor/patch updates only (the same mechanism the file already uses for majors). Each one needs a migration, tracked in chore(deps): migrate monaco-editor 0.52 → 0.57 (namespaces and worker paths moved) #1201–chore(deps): bump esbuild 0.25 → current, on its own #1204. Without this, the fixed Dependabot would reopen the same red group as chore(deps): Bump the minor-and-patch group across 1 directory with 30 updates #987.

Review (round 1, one Codex reviewer): MERGE-READY

It independently checked:

• all 929 lock records against Dependabot's own JsonLock::Record parser;
• npm ci under npm 10.9 and 11.11, with a byte-identical lock;
• a probe of the real electron-updater 6.8.9 AppUpdater and providers for the Preview and Stable feeds;
• a real HttpExecutor probe confirming PRIVATE-TOKEN / AuThOrIzAtIoN are stripped on a cross-origin redirect;
• 746 unit and renderer test files on the new stack.

Finding	Verdict	Disposition
No CI check stops a malformed lock from coming back (npm ignores it)	valid, minor	Declined: this repo avoids enforcement scaffolding; the commit message records the trap
"vitest 4.1.11 accepts vite 7" was wrong; 4.1.7 already did	valid	Corrected above
"Clears the open alerts" overstates it: nested vitest 4.1.10 remains in three submodules	valid	Corrected below

Left for follow-ups

• Alerts fix: restore dictation live preview #78 and fix(dictation): force the built-in Mac microphone #67 stay open until the submodules move. The vitest copies nested under packages/agent-transcript-parser, agent-voice-dictation and workflow-mcp (4.1.10) come from those submodules' own ranges and move when the submodules are bumped.
• chore(deps): Bump the minor-and-patch group across 1 directory with 30 updates #987 (the 30-package minor/patch group) is closed in favour of this PR plus separate migration issues. Once this merges, Dependabot re-opens the safe bumps by itself.

Refs #987

🤖 Generated with Claude Code