build(deps): refresh rendering, desktop, and build dependencies

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ permissions:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   NODE_VERSION: "26"
-  PNPM_VERSION: "12.6.0"
+  PNPM_VERSION: "12.7.0"
 
 concurrency:
   group: ci-${{ github.ref }}

.github/workflows/crabbox-hydrate.yml

@@ -31,7 +31,7 @@ permissions:
 
 env:
   NODE_VERSION: "26"
-  PNPM_VERSION: "12.6.0"
+  PNPM_VERSION: "12.7.0"
 
 jobs:
   hydrate:

.github/workflows/desktop.yml

@@ -15,7 +15,7 @@ permissions:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   NODE_VERSION: "26"
-  PNPM_VERSION: "12.6.0"
+  PNPM_VERSION: "12.7.0"
   CSC_IDENTITY_AUTO_DISCOVERY: "false"
 
 concurrency:

.github/workflows/release.yml

@@ -14,7 +14,7 @@ permissions:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   NODE_VERSION: "26"
-  PNPM_VERSION: "12.6.0"
+  PNPM_VERSION: "12.7.0"
 
 jobs:
   release:

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## Unreleased
 
 - Corrected the source-install pnpm version and quickstart caller-authentication count to match the current toolchain and authentication guide. Thanks @KrasimirKralev.
+- Updated DOMPurify, Vite, Electron 43, desktop packaging, Wrangler, Node.js types, and pnpm while preserving runtime minimums and the 48-hour dependency release-age gate; Docker builds now include every workspace manifest for frozen-lockfile validation.
 
 ## 0.6.0 - 2026-09-24
 

Dockerfile

@@ -2,9 +2,11 @@ FROM node:26-alpine@sha256:0b36e8c136b94cd4fcf02188228e76c31ad5872eef3fec8cbd2ee
 ARG CLICKCLACK_WEB_VERSION=dev
 ENV CLICKCLACK_WEB_VERSION=$CLICKCLACK_WEB_VERSION
 WORKDIR /src
-RUN npm install -g pnpm@12.6.0
+RUN npm install -g pnpm@12.7.0
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY apps/desktop/package.json apps/desktop/package.json
 COPY apps/web/package.json apps/web/package.json
+COPY examples/bot-ts/package.json examples/bot-ts/package.json
 COPY packages/protocol/package.json packages/protocol/package.json
 COPY packages/sdk-ts/package.json packages/sdk-ts/package.json
 RUN pnpm install --frozen-lockfile

Dockerfile.cloudflare

@@ -2,9 +2,11 @@ FROM node:26-alpine@sha256:0b36e8c136b94cd4fcf02188228e76c31ad5872eef3fec8cbd2ee
 ARG CLICKCLACK_WEB_VERSION=cloudflare
 ENV CLICKCLACK_WEB_VERSION=$CLICKCLACK_WEB_VERSION
 WORKDIR /src
-RUN npm install -g pnpm@12.6.0
+RUN npm install -g pnpm@12.7.0
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY apps/desktop/package.json apps/desktop/package.json
 COPY apps/web/package.json apps/web/package.json
+COPY examples/bot-ts/package.json examples/bot-ts/package.json
 COPY packages/protocol/package.json packages/protocol/package.json
 COPY packages/sdk-ts/package.json packages/sdk-ts/package.json
 RUN pnpm install --frozen-lockfile

README.md

@@ -63,7 +63,7 @@ The complete documentation is at **[docs.clickclack.chat](https://docs.clickclac
 
 ## Development
 
-Source builds use Go 1.27.1, Node.js 24 or newer, and pnpm 12.6.0. The module minimum remains Go 1.26.6 so managed CodeQL can build with its preinstalled compiler; the `toolchain` directive selects Go 1.27.1 for normal builds.
+Source builds use Go 1.27.1, Node.js 24 or newer, and pnpm 12.7.0. The module minimum remains Go 1.26.6 so managed CodeQL can build with its preinstalled compiler; the `toolchain` directive selects Go 1.27.1 for normal builds.
 
 ```sh
 pnpm install --frozen-lockfile

apps/api/internal/webassets/dist/200.html

@@ -110,7 +110,7 @@
 		<link href="/_app/immutable/chunks/DY4e0N_F.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/DK3Fl9T5.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/Dt-HX3Vu.js" rel="modulepreload">
-		<link href="/_app/immutable/entry/app.CPdIMxi0.js" rel="modulepreload">
+		<link href="/_app/immutable/entry/app.Byk191uY.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/uBIymjUX.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/xihTtKlq.js" rel="modulepreload">
 		<link href="/_app/immutable/nodes/0.D4IHQq8_.js" rel="modulepreload">
@@ -133,7 +133,7 @@
 
 					Promise.all([
 						import("/_app/immutable/entry/start.C5Qg5koL.js"),
-						import("/_app/immutable/entry/app.CPdIMxi0.js")
+						import("/_app/immutable/entry/app.Byk191uY.js")
 					]).then(([kit, app]) => {
 						kit.start(app, element);
 					});