[siracusa5]

Summary

Consolidates the routine desktop and CodeQL updates from Dependabot PRs #206, #207, and #208, now closed as superseded. There are no open Dependabot security alerts, and fresh full-tree npm audits remain clean in all three apps.

Changes

• Update Electron to 45.1.0, including the fixes after Dependabot's proposed 45.0.0.
• Update the pinned Supabase client to 2.118.0, electron-updater to 6.8.11, and electron-builder to 26.18.0.
• Update both CodeQL action steps to 4.39.1.
• Preserve the serial Electron test warmup and document the asynchronous safeStorage migration required before Electron 46.

Affected area

• Core engine / MCP / write path
• Console
• Site
• Playground or local demo surfaces
• Docs / specs / contributor workflow
• Packs

Desktop runtime, updater, and packaging dependencies are updated. PR #209 handles future Dependabot grouping/cooldown configuration separately.

Validation

Local checks used Node 22.23.4; GUI checks used temporary app profiles. The local Keychain authorization block was resolved by the user, then the unchanged runtime tests were rerun.

• Root npm test: all 76 suites pass.
• Desktop npm test: all 186 tests pass, including engine lifecycle, quit persistence, and window lifecycle.
• Desktop navigation guards and CLI-status checks pass.
• Console production renderer build passes.
• Real preload-dependent relaunch smoke passes: engine origin and IPC token rotate, the old engine becomes unreachable, authenticated API returns 200 and unauthenticated API returns 401, renderer sandbox stays on.
• 3,000-document isolation check passes: 6 ms main-loop lag against the 400 ms limit.
• Unsigned local arm64 inspection app builds with the updated packager; its bundled CLI reports version 0.10.0 and returns valid JSON help from the packaged resources.
• Full-tree npm audits in console, site, and desktop, plus desktop production-only audit: zero findings.
• Independent dependency, security, and documentation review: no introduced blockers.
• Cross-platform CI passes on 3fdd3b5: full engine suites on Node 22/24, Windows engine, console, site, Mac/Linux desktop, CodeQL, DCO, and the required gate.

Existing optional UI-smoke limitation

The additional smoke:ui check fails when it snapshots the lazy Settings view before it leaves its loading fallback. Static comparison with unchanged main also confirms stale assertions: five navigation entries are expected where the current sidebar defines six, and the Overview check refers to sections the current UI no longer renders. This optional harness needs a separate readiness/expectation update; it is not claimed as passing. The lifecycle, IPC/relaunch, navigation, sandbox/token, and isolation checks above pass.

Compatibility

• Root commands still work.
• No root or engine npm dependencies were added.
• Package and lockfile root versions remain 0.10.0.
• Generated renderer and inspection-app files remain ignored.

Electron 45's removed sandboxed-preload Node globals are not used by this app's preload. Its synchronous safeStorage APIs still work in 45 but are deprecated; upgrading to 46 requires a separate API migration. These dependency changes reach installed users through the next app release.

Sign-off

• Every commit is signed off per the Developer Certificate of Origin.