Update project dependencies

[cassi-volkova]

Summary

Consolidates Dependabot updates #57, #103, #104, #141, #142, #143, #144, #201, #202, and #203 into one compatibility-tested Workspace UI change.

The combined lockfile was repaired for reproducible npm 10 installation, the updated coverage provider was hoisted correctly, Electron 43 package placement was re-resolved, and files affected by Prettier 3.9 were reformatted with the project command.

Validation

Validated exact commit 982522f0caac65c12d8f518b06f190e5cc315e1d:

• clean npm ci, TypeScript, ESLint, Prettier, and production builds pass;
• 4,717 web tests and 22 Electron tests pass;
• GitHub static checks and Playwright E2E pass;
• Electron 43 packages successfully as AppImage, DEB, and RPM for x64 and arm64;
• the packaged x64 application passes a desktop runtime smoke test;
• baseline-only complexity warnings and audit advisories are unchanged or reduced by this PR.

The detailed upstream review, package hashes, coverage results, and baseline comparison are available in the PR discussion.

Decision: dependency update is safe to merge and ready for review.

[gemini-code-assist]

Code Review

This pull request updates various dependencies and devDependencies across multiple package.json files in the workspace, including the root package.json, packages/electron, packages/web, and packages/workspace-api. Key updates include upgrading electron, vite, tailwindcss, eslint, and other utility and testing libraries to newer versions. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[cassi-volkova]

Dependency compatibility validation report

Tested commit: 982522f0caac65c12d8f518b06f190e5cc315e1d.

Upstream change review

I reviewed the release notes and source compare ranges linked by the ten source Dependabot PRs (#57, #103, #104, #141, #142, #143, #144, #201, #202, and #203).

Risk-based findings:

• Electron 42.4.0 -> 43.0.0 is the primary runtime risk. Electron 43 moves to Chromium 150, Node 24.17, and V8 15, changes Linux frameless-window rounding and download-folder behavior, and contains startup/preload/IPC changes. Official release notes: https://www.electronjs.org/blog/electron-43-0
• Production UI/security packages are patch updates: Radix Dialog 1.1.17, Radix Dropdown Menu 2.1.18, DOMPurify 3.4.11, and Sentry React 10.58.0. They affect dialogs/menus, HTML sanitization, and error reporting, so the complete unit and E2E suites were used rather than package-import-only checks.
• Prettier 3.9.4 intentionally changes JavaScript/TypeScript formatting. Official notes: https://prettier.io/blog/2026/06/27/3.9.0.html. The new formatter rejected 47 existing files; those files were reformatted with the project command and revalidated with TypeScript, ESLint, and all tests.
• Vite, Vitest/coverage, Playwright, ESLint/plugins, Tailwind/PostCSS, commitlint, lint-staged, Knip, Orval, esbuild, electron-builder, and the remaining grouped updates affect build/test/static tooling. Their corresponding project gates were executed.
• GitHub Actions updates affect checkout, artifact download, and release publication. Workflow syntax and normal CI execution are green; tag-only artifact/release jobs remain skipped by repository design on pull requests.

Compatibility fixes included

The combined Dependabot lockfile was not directly reproducible with npm 10. I fixed three concrete integration problems while preserving the requested versions:

1. Restored two commitlint transitive lock entries required by clean npm ci.
2. Hoisted @vitest/coverage-v8 so the root Vitest executable can resolve the coverage provider.
3. Re-resolved the Electron 43 package placement with the updated root @types/node graph.

A clean npm ci now succeeds.

Verification performed

• TypeScript typecheck: passed.
• ESLint: passed with 0 errors (470 warnings are accepted by the current configuration).
• Prettier 3.9.4 format check: passed after applying the canonical formatter.
• Web unit/coverage suite: 472 files, 4,717 tests passed.
• Coverage generation passed: 78.79% statements, 69.60% branches, 80.29% functions, 81.11% lines.
• Electron unit suite: 22 tests passed.
• Electron TypeScript check: passed.
• Electron production build passed with Vite 8.1.3 and esbuild 0.28.1.
• GitHub Lint, Typecheck, Test check: passed.
• GitHub Playwright E2E check: passed.
• Linux packaging with electron-builder 26.15.3 and Electron 43.0.0 passed for x64 and arm64:
  • AppImage x64: bec065d51a6fa812ae0f9ba64a2be0e21ea8f69aaf04073845ba341902e23917
  • AppImage arm64: 0d82d20b966952289c359910a7a92a0a14c775391811121b4a2f7bddc31ef4c3
  • DEB x64: 279476520a4af75535f6ab1ed159589e70533d47e9fa5438245e930e1372732c
  • DEB arm64: 6c3bd2c0f08fe7c3baade600a890c04b021f2398c1e315435b7ca033044fbe5e
  • RPM x64: e7fcf4536fb6b11e422a5259fc277ba6874be8e460b4ab771877f089cc38e37d
  • RPM arm64: fd85d6bf01aa1a488cfc648d565ad1eb611ae947c896d68933215db60ba0c933
• Packaged x64 runtime smoke stayed alive for the complete 12-second observation window on the active Wayland desktop and exited only because of the intentional timeout. The only runtime message was a non-fatal VAAPI initialization warning.

Baseline-only failures

• npm run lint:cc reports the same five cognitive-complexity warnings on this branch and unchanged master; none of the reported application functions are changed by the dependency update.
• The web-workspace audit remains non-zero with 3 high advisories. The unchanged master baseline has the same 3 high advisories; this branch reduces the total workspace findings from 22 to 8. These advisories are not introduced by this PR and require separate dependency/security scope.

Result

The requested dependency versions are installable and reproducible, the formatting/tooling compatibility changes are included, the complete web and Electron test surfaces pass, Electron 43 builds and packages for both Linux architectures, and the packaged application starts successfully. The PR is ready for review.