chore(client): clear 12 npm advisories — electron-builder 26, electron 42.11.1

npm audit reported 12 findings (11 high, 1 critical), every one transitive
and every one reached through electron-builder. The critical was tar
(<=7.5.20), a family of path-traversal and symlink-poisoning advisories.

electron-builder is a devDependency and build.files is src/** and ui/**,
so none of it ships: the exposure was to whoever builds a release, not to
users. Real, since a build machine producing signed artefacts is worth
attacking, but it should not have been read as "the client has a critical
vulnerability".

electron-builder ^26.15.3 takes the audit to 0 on its own. It is a major,
so it was measured rather than assumed: a --dir Linux build passed before
and after, and the config used here (appId, files, linux.target,
deb/rpm.depends) is nowhere near where 26's breaking changes are. The
produced app.asar is not byte-identical to 25's, which matters only for
18.7's hash-and-compare story and is a release note, not a defect.

electron ^42.11.1 is a patch bump inside the range already declared, where
Electron ships its security backports. The built binary was launched under
xvfb: two processes alive after 25s, empty log. That is the part that
counts — test_desktop_shell.py pins the security contract by reading
source, so it would stay green through any runtime regression.

protobufjs's override floor goes ^7.5.5 -> ^7.6.5. The override itself is
load-bearing and must stay: removing it drops castv2-client's protobufjs
to 6.11.6, which carries a critical RCE advisory — and unlike everything
above, protobufjs ships inside the application. But ^7.5.5 permitted 7.5.5,
which is inside a high advisory's range (<=7.6.4); npm happened to resolve
7.6.6, so the protection was incidental rather than structural.

Electron 44 is deliberately not taken here: two majors and a different
Chromium, and nothing in the suite would notice a regression. It needs its
own launch session.

Audit and evidence: ~/next/npm-audit.md (not in the repo).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbwJDbNTkiRUh7HTWEoyss

0 files changed, 0 insertions, 0 deletions