[styayur]

Integrate the independent compatible updates proposed by #36–#44 and #46–#50 onto the security-repaired default branch, so the combined dependency graph is validated once on both desktop platforms and the declared compiler floor.

• Rust lock updates: tree-sitter 0.27.1, sha2 0.11.1, tokio-util 0.7.20, serde_json 1.0.154, uuid 1.28.0.
• Frontend tooling/API patches: Tauri CLI 2.12.3, dialog API 2.8.3, lucide-react 1.59.0, react-virtual 3.14.21 and Node typings 26.6.5.
• Actions: checkout 7, artifact upload 7, cache 6 and Go setup 7. Existing runtime selections, cache/artifact paths, permissions and formal release triggers remain intact; no release is dispatched.
• Group future compatible Cargo/npm updates and Actions updates. Ignore automated changes to the toolchain ref that defines the MSRV. Rust 1.90 validation remains exactly in place, with stable validation running separately. chore(deps): bump dtolnay/rust-toolchain from 1.90.0 to 1.120.0 #45 was closed with evidence because replacing 1.90 by nonexistent 1.120 would remove the support-floor check.

The scoped patched DOMPurify resolution from #51 is retained. No audit threshold, security rule or license policy is relaxed. Local frontend checks are running; all CI, including security, Windows/Linux, CodeForge regression and Rust 1.90 MSRV, must pass before merge. Existing update PRs remain open until this integration is merged and verified on main.

[styayur]

The integration has been reviewed against the original dependency/action proposals. All security gates and the Rust 1.90 support-floor check are retained. The existing patched Monaco sanitizer resolution remains in force, and action upgrades preserve the actual checkout/cache/artifact/release call paths and permissions.

All current-head GitHub checks must be complete and successful before this merge, including both Windows/Linux desktop validation, Rust 1.90 MSRV, CodeForge regression, frontend audit, cargo audit and secret scan: https://github.com/styayur/codeforge-engine/pull/52/checks . No release/tag publishing workflow is dispatched.

Original PRs #36–#44 and #46–#50 will be closed with this replacement link only after verifying this integration commit and successful CI on main. Dependabot grouping reduces repeated incompatible lockfile branches; the compiler-floor action ref is excluded from automated version changes so the minimum-supported compiler is not silently raised.