fix(desktop): update Electron to 42.11.18 for certificate advisory

apps/desktop/package.json

@@ -26,7 +26,7 @@
     "dist:linux": "node scripts/prepare-runtime.mjs && node scripts/prepare-build.mjs && electron-builder --config electron-builder.yml --linux --x64 --publish never"
   },
   "devDependencies": {
-    "electron": "42.11.9",
+    "electron": "42.11.18",
     "electron-builder": "26.15.3"
   }
 }

tests/desktop/release-packaging.test.mjs

@@ -12,6 +12,7 @@ import { resolveLocalesDir } from '../../apps/desktop/src/main/i18n.mjs';
 const here = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(here, '..', '..');
 const desktopPackage = JSON.parse(readFileSync(join(repoRoot, 'apps', 'desktop', 'package.json'), 'utf-8'));
+const desktopLock = JSON.parse(readFileSync(join(repoRoot, 'apps', 'desktop', 'package-lock.json'), 'utf-8'));
 const rootPackage = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf-8'));
 const electronBuilderYaml = readFileSync(join(repoRoot, 'apps', 'desktop', 'electron-builder.yml'), 'utf-8');
 
@@ -168,3 +169,36 @@ describe('R4.2 Debian 元数据契约', () => {
     expect(yamlScalar(linux, 'artifactName')).toBe('Mebular-${version}-${arch}.${ext}');
   });
 });
+
+// R4.3：Electron < 42.11.16 存在高危证书校验 advisory，修复版本 42.11.18；
+// Electron 虽在 devDependencies，但会被 electron-builder 打进安装包，故锁定精确版本并设下限。
+describe('R4.3 Electron 安装包版本下限', () => {
+  const MINIMUM_ELECTRON = '42.11.18';
+
+  function parseVersion(value) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(String(value));
+    return match ? match.slice(1, 4).map(Number) : null;
+  }
+
+  function compareVersions(left, right) {
+    const a = parseVersion(left);
+    const b = parseVersion(right);
+    if (!a || !b) return NaN;
+    for (let i = 0; i < 3; i += 1) {
+      if (a[i] !== b[i]) return a[i] - b[i];
+    }
+    return 0;
+  }
+
+  it('electron 是精确版本且不低于 42.11.18（不含 ^/~ 回退空间）', () => {
+    const electron = desktopPackage.devDependencies?.electron;
+    expect(electron).toMatch(/^\d+\.\d+\.\d+$/);
+    expect(compareVersions(electron, MINIMUM_ELECTRON)).toBeGreaterThanOrEqual(0);
+  });
+
+  it('package-lock 中 electron 与 package.json 一致', () => {
+    const locked = desktopLock.packages?.['node_modules/electron']?.version;
+    expect(locked).toBe(desktopPackage.devDependencies.electron);
+    expect(compareVersions(locked, MINIMUM_ELECTRON)).toBeGreaterThanOrEqual(0);
+  });
+});