desktopfix(deps): resolve all medium/high/critical Dependabot vulnerabilities
Bumps ~40 packages across pnpm overrides, direct deps, and the
better-auth catalog entry to close ~100 open Dependabot alerts,
including major bumps to electron-builder (25→26, fixes app-builder-lib
and builder-util-runtime advisories), the @tiptap/* family (3.26→3.31,
ReDoS/prototype-pollution fixes), and @faker-js/faker in scripts/.
better-auth is pinned to ~1.6.33 rather than the newer 1.7.x line:
1.7.x drops MCP-plugin exports @zero/server depends on.
extract-zip (transitive, via electron-builder) has two high-severity
symlink-traversal advisories with no patched version published
upstream (still 2.0.1) — left as an accepted, build-time-only risk
since there's nothing to bump to.
Co-Authored-By: Claude Sonnet 5 <<email>>Sep 15, 2026, 7:27 AMmailMerge pull request #2846 from CedarCopilot/remove/task-group-hard-pin
remove: unused task-group hard-pin feature (zero production usage)Sep 20, 2026, 1:24 PM54 defectsserverMerge pull request #2849 from CedarCopilot/feat/create-aop-and-update-selection-procedure
feat: add create-aop and update-selection-procedure config-write actionsSep 20, 2026, 6:04 PM334 defectsold_cloudflare_email.mdfeat: v0 postgres thread objectApr 6, 2026, 11:43 PM