fix(deps): patch high and critical dependency advisories

.github/dependency-audit-baseline.json

@@ -1,5 +1,12 @@
 {
   "auditLevel": "high",
-  "reviewedAt": "2026-08-04",
-  "acceptedAdvisories": []
+  "reviewedAt": "2026-10-06",
+  "acceptedAdvisories": [
+    {
+      "id": "GHSA-vfj7-8cjw-p6xm",
+      "package": "braces",
+      "reason": "No patched release exists (all 3.x affected). Reached only through build tooling (micromatch) with repository-defined glob patterns.",
+      "severity": "high"
+    }
+  ]
 }

README.md

@@ -53,8 +53,8 @@ git push --follow-tags
 ## Dependency Audit
 
 `bun run audit` rejects new high or critical advisory IDs and severity regressions.
-The reviewed baseline currently accepts 19 high-severity observations across 12
-advisory IDs and no critical advisories. Observation counts remain visible in the
+The reviewed baseline currently accepts one high-severity advisory (`braces`,
+which has no patched release yet). Observation counts remain visible in the
 output, while acceptance is always tied to a specific package and advisory ID.
 Keep the baseline explicit until upstream transitive fixes are available, and
 remove entries as advisories resolve.

apps/desktop/package.json

@@ -55,7 +55,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "electron": "^43.2.0",
+    "electron": "^43.7.7",
     "electron-builder": "^26.15.3",
     "electron-builder-squirrel-windows": "^26.15.3",
     "jsdom": "^30.0.1",
@@ -70,7 +70,7 @@
     "typescript": "~7.0.2",
     "ultracite": "7.10.0",
     "vite": "^8.2.0",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.11",
     "zustand": "^5.0.14"
   },
   "build": {

apps/web/package.json

@@ -18,7 +18,7 @@
     "@fontsource-variable/inter": "^5.3.0",
     "@fontsource-variable/jetbrains-mono": "^5.3.0",
     "@tailwindcss/vite": "^4.3.3",
-    "astro": "^7.1.6",
+    "astro": "^7.3.5",
     "tailwindcss": "^4.3.3"
   },
   "devDependencies": {