dependencies update rollup (2026-10-14) - #337

* chore(deps): update rust to v1.99.1

* chore(deps): update dependency third_party/emsdk to v6.0.13

* chore(deps): update pypa/gh-action-pypi-publish action to v1.14.3

* chore(deps): update pnpm to v12.18.0

* chore(deps): update js dependencies (#339, #345, #346, #348, #349)

- electron 44.7.2 -> 45.2.3 (^45.0.0; supersedes #342 for 44.10.2)
- electron-updater 6.8.9 -> 6.8.12, electron-builder 26.15.3 -> 26.18.1
  (published under the v26 dist-tag; latest still points at 6.8.11 / 26.18.0)
- vite 8.3.4 -> 8.3.6, @vitejs/plugin-react 6.1.2 -> 6.2.1
- react / react-dom 19.3.0 -> 19.3.1, react-redux 9.3.0 -> 9.3.1,
  @reduxjs/toolkit 2.13.0 -> 2.14.0
- tslib 2.8.1 -> 2.9.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): update dependency wasm-bindgen/wasm-pack to v0.15.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): update rust crates in Cargo.lock

- wasm-bindgen 0.2.129 -> 0.2.130
- crossbeam-epoch 0.9.18 -> 0.9.21 (RUSTSEC-2026-0204)
- anyhow 1.0.102 dropped from the lock file (RUSTSEC-2026-0190); it was
  not part of any build
- libdeflater 1.25.2 -> 1.26.1, zopfli 0.8.3 -> 0.8.4 and other
  semver-compatible updates

cc is held at 1.11.0 because 1.11.1 was published less than a day ago.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): update dependency third_party/zlib to v1.4 (security)

zlib 1.4 fixes several memory safety issues in inflate, deflate, gzip and
minizip (CVE-2026-85091 and others).

zlib 1.4 names the MSVC static library libzs.lib instead of zs.lib, so the
Windows ZLIB_LIBRARY path handed to libpng is updated to match.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): update dependency valgrind to v3.28.0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): update pnpm/action-setup action to v6.1.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): update dtolnay/rust-toolchain action to 683b588

Picks up "Safely handle action inputs" (dtolnay/rust-toolchain#187), which
stops interpolating action inputs directly into shell commands, plus retry
on release-server checksum failures.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): drop the [email protected] minimumReleaseAge exemption

Electron is now 45.2.3, and 44.7.2 has long passed the one-day window.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* build(deps): use libaom v3.15.3 for the AVIF encoder (security)

libavif v1.4.2, the latest release, fetches libaom v3.14.1. libaom
v3.15.0 to v3.15.3 fix a heap double-free in multi-threaded encoding, an
out-of-bounds layer_context access and several integer overflows found by
fuzzing, and libavif main already moved to v3.15.3 with no other change.

Declare libaom before adding libavif so FetchContent takes v3.15.3. The
override only applies while the libavif submodule pins an older tag, so it
stops having any effect once a libavif release catches up.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* docs(changelog): record the 2026-11-06 dependency rollup

Security entries now come first in the Unreleased section and are marked
[SECURITY]; AGENTS.md documents the rule. The Electron 44.7.2 entry from
#337 is folded into the Electron 45.2.3 one, the [email protected]
minimumReleaseAge exemption entry is dropped together with the exemption,
and the withdrawn sprintf-js advisory is noted.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* docs(skills): add the rollup-dependencies Claude Code skill

The skill captures the dependency rollup procedure used for this branch:
cutting a dated branch, taking inventory of Renovate PRs, rate-limited
Dependency Dashboard updates and dependencies Renovate does not track,
reviewing advisories and upstream changes, applying updates with the
release-age policy, verifying builds per platform, and writing the
CHANGELOG and PR. Pushing and opening PRs require the user's approval;
merging is out of scope.

scripts/cargo_lock_report.py lists Cargo.lock changes with their crates.io
publish age and checks the lock file against OSV.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* docs(changelog): give 14.2.1 and 14.2.2 their own sections

The Unreleased section on main already shipped in 14.2.2 (2026-10-15), and
14.2.1 (2026-09-29) never got a section. Rename the former to 14.2.2 with
its original wording, add 14.2.1 from the dependency updates between the
tags, and keep only this rollup's changes under Unreleased. Security
entries of every release, including 10.0.2, now come first and carry
[SECURITY].

The rollup-dependencies skill now checks whether Unreleased has already
been released before touching it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix(deps): update vulnerable transitive dependencies (security)

- undici 7.30.0 -> 7.30.2 (@electron/get) and 6.29.0 -> 6.29.1 (node-gyp):
  GHSA-qrxm-fqhp-jwvm, GHSA-2m5v-pch6-74hx, GHSA-4w7w-5xrc-9h26,
  GHSA-xjj6-f33q-929c, GHSA-mqg3-3v4r-cm32 and others
- fast-uri 3.1.8 -> 3.1.9 (electron-builder > ajv): GHSA-w74x-v6f9-j3xg,
  GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp

All are build-time tools and not shipped in the app. undici 7.30.2 was
taken once it passed the one-day minimumReleaseAge window.

minimatch (GHSA-g3hv-75wg-m249) remains: it is fixed only in 11.0.1 and
electron-builder still depends on the 9.x and 10.x lines.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): update dependency third_party/emsdk to v7.0.0

Emscripten 7.0.0 updates libc++/compiler-rt to LLVM 23.1.3, removes
EMCC_ONLY_FORCED_STDLIBS, splits libemcc out of libclang_rt.builtins and
raises the default minimum browser versions (Chrome 93, Firefox 92,
Safari 15.4). The build does not use the removed variable, -nostdlib,
side modules or WasmFS, and the GUI WebAssembly target runs in Electron's
Chromium 156.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* chore(deps): update rust crates in Cargo.lock

- cc 1.11.0 -> 1.11.1, held back in the previous update because it was
  less than a day old
- serde_spanned 1.1.2 -> 1.1.3

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* docs(changelog): record the Emscripten 7.0.0 update

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix(build): pass the project directory to electron-builder

WindowsElectron (x64) failed in CI with "Cannot find package.json in the
...\build": electron-builder resolves the project from its working
directory, and on the Windows runner it was started in the build
directory. Pass --projectDir explicitly so packaging no longer depends
on how the generator launches custom commands.

Reproduced locally by running electron-builder from the build directory,
which fails the same way without --projectDir and packages with it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix(skills): make cargo_lock_report.py report failed lookups

A failed git or OSV lookup was counted as one young crate or one advisory
and the script still exited 0. Count failed lookups separately, print them
in the summary, and exit 2 when the report is incomplete, 1 when a crate
is younger than the window or has an advisory, and 0 otherwise.

Raised in the Copilot review of #350.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <[email protected]>