fix(deps): resolve Dependabot alerts #402, #403, #404, #405, #406

[dantheuber]

Alerts

• #402 medium, @xmldom/xmldom — XML fragment injection via EntityReference.nodeName under requireWellFormed serialization. The repo does not import xmldom; it is reached only through plist inside app-builder-lib (electron-builder), which writes its own generated plist documents. The repo never calls createEntityReference, so the vulnerable path is not reachable from this codebase.
• #403 high, fast-uri — host confusion via percent-encoded scheme normalization. Not reached: fast-uri is only used by ajv inside app-builder-lib to resolve $refs in the static electron-builder config schema; no untrusted URIs are involved.
• #404 high, fast-uri — SSRF via repeated hostname percent-decoding. Not reached, same path as #403.
• #405 high, fast-uri — SSRF via malformed IPv6 normalization. Not reached, same path as #403.
• #406 high, fast-uri — host confusion via skipped IDN canonicalization. Not reached, same path as #403.

Both packages are development-scope transitives of electron-builder@26.15.7 (electron-builder > app-builder-lib > plist > @xmldom/xmldom and electron-builder > app-builder-lib > ajv > fast-uri). Nothing under src/ references either package.

Changes

• @xmldom/xmldom 0.8.14 -> 0.8.15 (clears #402). Parent plist@3.1.0 requires ^0.8.8, so the lockfile entry alone moves. 0.8.15 is the lowest patched release on the 0.8 line.
• fast-uri 3.1.5 -> 3.1.6 (clears #403, #404, #405, #406). Parent ajv@8.20.0 requires ^3.0.1, so the lockfile entry alone moves. 3.1.6 is the first patched version; 3.1.7 was deliberately not taken.
• package.json is untouched. No source files changed. No overrides were needed. The lockfile diff is exactly the two entries (version, resolved, integrity), 6 lines each.

Verification

• npm ci: clean install from the updated lockfile, 720 packages, postinstall electron-builder install-app-deps completed.
• npm run typecheck && npm run test: typecheck (node and web) passed; vitest 83 files, 922 tests, all passed.
• npm run lint: 0 errors (41 pre-existing warnings, unchanged).
• npm run build: typecheck plus electron-vite build succeeded.
• npx electron-builder --dir --publish never: linux x64 unpacked package built successfully. This is the only code path that loads plist/@xmldom/xmldom and ajv/fast-uri, and it ran clean with the new versions.
• npm audit before (main lockfile): 2 vulnerabilities (1 moderate @xmldom/xmldom <=0.8.14, 1 high fast-uri 3.0.0 - 3.1.5 covering all four advisories). After: found 0 vulnerabilities.

Risk assessment

Changelog review:

• @xmldom/xmldom 0.8.15: security-only release. Eight fixes (entity-reference, doctype and PI-target validation under requireWellFormed; quadratic namespace/attribute/whitespace/normalize paths). Release notes state serialized output is byte-identical; the only observable change is a newly reported recoverable parse error for an end tag with trailing content. No API or default changes. plist only builds and serializes its own documents.
• fast-uri 3.1.6: security release for the four advisories above, plus a batch of RFC 3986 conformance fixes (encoding of serialized components, reserved path characters, percent-escape validation, URN handling, websocket query delimiters, equality case handling). All are fix: commits with no declared breaking change and no API change. The only consumer here is ajv resolving $refs in electron-builder's bundled JSON schema, which contains plain relative fragments; the packaging run above confirms schema validation still works.

Auto-merge checklist:

• Repo policy allows auto-merge: pass.
• Clean install, verify command, build, lint, tests all passed with no workarounds: pass.
• Every moved package changed by a patch within the same major (0.8.14 -> 0.8.15 is patch-only on 0.x; 3.1.5 -> 3.1.6 is patch): pass.
• No source changes; diff is lockfile only: pass.
• Lockfile diff confined to the two fixed packages, nothing else moved: pass.
• Changelogs list no breaking or behavior change in anything the repo uses: pass.

Decision

Clear to merge automatically: every condition holds. The version bump, CI, and merge follow.

[github-actions]

📊 Coverage Report

Metric	Coverage
Statements	100%
Branches	100%
Functions	100%
Lines	100%

[github-actions]

🧪 E2E Test Results

✅ 36 passed, 0 failed, 0 skipped

Test Suite	Result
App Launch	✅
Clipboard	✅
Context Menu	✅
Image Clipboard	✅
Quick Clips	✅
Quick look	✅
Quick look — clipboard writes	✅
Quick look — rendered html	✅
Settings window	✅
Theme	✅
Settings — Tools tab	✅
Quick look — pattern scanning	✅
Quick look — clip templates	✅