[styayur]

Integrate the concrete security fixes from #47–#50, plus the compatible desktop-builder patch #44: Brotli 1.2.1, Electron 44.9.1, desktop Undici 6.29.1 (node-gyp) and 7.30.1 (top-level), and fast-uri 3.1.9. Relevant upstream advisories include GHSA-9v8h-qqgm-4m35 (Brotli decoder), GHSA-xjj6-f33q-929c (Undici), GHSA-jr5w-w6x2-84p9 (Electron certificate mitigation), and the four current fast-uri advisories patched in 3.1.9.

Local isolated Python 3.12 runtime: 98 API tests pass, and complete pip_audit runtime resolution reports zero known vulnerabilities. Web install/typecheck, canonical 45-component/46-license-file notice validation, deterministic visual/layout/export tests including 497 integrity assertions, desktop-mode production build, desktop install and proxy tests pass. Test databases and files are synthetic/isolated; LMDB remains 2.3.0. No user database migration, signing credential, release/tag or published asset is touched.

This is deliberately Draft and not merge-ready. Fresh npm audits still report moderate minimatch/glob build-tool findings: 15 desktop findings and 4 web development findings. The existing gate requires a zero-finding desktop/production graph, so it must stay enabled. Latest builder 26.18.0 still contains legacy glob/minimatch function-API consumers; globally overriding them to the incompatible modern API would be unsafe. The current advisories/patched dependency paths require further compatible upstream evaluation. No allowlist expansion, threshold reduction, --force, --legacy-peer-deps or continue-on-error is introduced.

Current combined-head CI has passed the API suite, Windows packaged renderer smoke and Android candidate build, with CodeQL also successful. The web job still fails at the unchanged dependency gate; its later browser checks do not run. Existing PRs remain open until this integration is actually green, merged and verified. The Brotli vulnerability remains a default-branch risk until a valid merge is possible; branch-only remediation is not reported as completed.

[styayur]

The unchanged dependency gate requires zero desktop/production findings. The current integration fixes Brotli/Electron/Undici/fast-uri, but npm still reports 15 moderate desktop and 4 moderate web-tool findings. No compatible complete patched upstream builder graph is currently published.

Created isolated Draft #54 with Brotli 1.2.1, Electron 44.9.1, builder 26.18.0, Undici 6.29.1 and 7.30.1 in their exact desktop paths, and fast-uri 3.1.9. 98 API tests and full pip audit pass. Current API/Windows packaged renderer/Android candidate/CodeQL CI pass. Web gate correctly fails. Inspected modern upstream asar/universal/EJS alternatives and the remaining electron-winstaller -> temp 0.9.4 -> rimraf 2.6.3 -> glob 7.2.3 -> function-export minimatch 3.1.5 chain; no callback-compatible upgrade exists within that chain. A blind minimatch 11 or rimraf 6 override changes the legacy callable APIs. No policy expansion or API shim/version masquerading was applied.

Keep #54 Draft and originals open. Recheck a released builder/winstaller/temp chain or an upstream advisory-range correction, then rerun the full zero-finding gate, real browser tests, Windows packaged renderer and Android candidate checks on the exact combined head. A different packaging toolchain would need its own full migration acceptance. Default-branch Brotli remains an unresolved risk until a valid merge; branch-only fixes are not reported as resolved.

Evidence: #54 https://github.com/styayur/calligra/actions/runs/41487847608 GHSA-g3hv-75wg-m249 github/advisory-database#10811 https://github.com/electron/asar/releases