build(deps): batch dependency updates (#159)

## Summary

Consolidates 8 Dependabot PRs into a single update:

- **GitHub Actions**: `actions/upload-artifact` 6.0.0 → 7.0.0,
`actions/download-artifact` 7.0.0 → 8.0.1, `actions/setup-node` 6.2.0 →
6.3.0
- **Go**: `golang.org/x/mod` 0.33.0 → 0.34.0
- **Frontend**: `dompurify` 3.3.1 → 3.3.3, `@tanstack/virtual-core`
3.13.19 → 3.13.21, `svelte` 5.53.7 → 5.53.10, `svelte-check` 4.4.4 →
4.4.5

Closes #146, #147, #148, #149, #150, #151, #152, #153

## Test plan

- [ ] CI passes (Go tests, frontend build, lint)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: wesm

.github/workflows/desktop-release.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238  # v6.2.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
         with:
           node-version: "24"
 
@@ -107,7 +107,7 @@ jobs:
           cp desktop/src-tauri/target/release/bundle/macos/*.app.tar.gz.sig staging/
           ls -la staging/
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: agentsview-desktop-macos
           path: staging/*
@@ -133,7 +133,7 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238  # v6.2.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
         with:
           node-version: "24"
 
@@ -185,7 +185,7 @@ jobs:
           cp desktop/src-tauri/target/release/bundle/nsis/*.nsis.zip.sig staging/
           ls -la staging/
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: agentsview-desktop-windows
           path: staging/*
@@ -198,7 +198,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           path: artifacts
           pattern: agentsview-desktop-*

.github/workflows/release.yml

@@ -114,7 +114,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           path: artifacts
           merge-multiple: true

frontend/package-lock.json

@@ -15,8 +15,8 @@
     "e2e": "playwright test"
   },
   "dependencies": {
-    "@tanstack/virtual-core": "3.13.19",
-    "dompurify": "3.3.1",
+    "@tanstack/virtual-core": "3.13.21",
+    "dompurify": "3.3.3",
     "marked": "17.0.4"
   },
   "devDependencies": {
@@ -25,8 +25,8 @@
     "@tsconfig/svelte": "5.0.8",
     "@types/dompurify": "3.2.0",
     "jsdom": "28.1.0",
-    "svelte": "5.53.7",
-    "svelte-check": "4.4.4",
+    "svelte": "5.53.10",
+    "svelte-check": "4.4.5",
     "typescript": "5.9.3",
     "vite": "7.3.1",
     "vitest": "4.0.18"

frontend/package.json

@@ -9,7 +9,7 @@ require (
 	github.com/mattn/go-sqlite3 v1.14.34
 	github.com/stretchr/testify v1.11.1
 	github.com/tidwall/gjson v1.18.0
-	golang.org/x/mod v0.33.0
+	golang.org/x/mod v0.34.0
 )
 
 require (

go.mod

@@ -18,8 +18,8 @@ github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
 golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=