[kalvinnchau]

Upgrade the three priority dependencies with published security advisories:

Dependency	Change	Reason
rustls	0.23.44 → 0.23.46	Used by native HTTP, WebSocket, and updater traffic. Fixes TLS handshake encryption-boundary handling and unauthenticated key-share prediction poisoning. The latter can remove hybrid post-quantum protection from later connections depending on server policy; neither advisory is an authentication bypass.
prosemirror-view	1.41.8 → 1.42.3	Fixes paste-triggered XSS, CVE-2026-104847. The current composer intercepts paste and drop, so this closes a vulnerable dependency without claiming a demonstrated composer exploit.
source-map-js	1.2.1 → 1.2.2	Fixes event-loop denial of service through malicious indexed source maps, CVE-2026-93749. This is development/build hardening; inspected paths are development dependencies.

rustls references: RUSTSEC-2026-0285, RUSTSEC-2026-0349. These records list GHSA aliases, not CVE aliases. The release also fixes 0346, 0347, and 0348; their required application configurations were not established in the audit.

ProseMirror view requires model ≥1.25.8. Update the direct model pin from 1.25.4 to 1.25.8 and keep a single resolved model version. Adapt clipboard serialization to the new model contract: let ProseMirror serialize text nodes and return a neutral span for unlinked tokens. A regression test verifies plain-text preservation, HTML escaping, and copy/paste round-tripping. It fails before the compatibility change and passes afterward.

The shared Goose test fixture also gains its missing empty effort field. This fixes two TypeScript errors reproduced on unchanged main and allows the required typecheck to run without bypassing hooks.

Validation:

• npm audit: zero reported vulnerabilities. OSV query for rustls 0.23.46: no advisories returned.
• TypeScript and changed-file Biome checks passed; production Vite bundling passed.
• Clipboard regression failed before the serializer correction and passed after it. All four launch-boundary tests passed after correcting the fixture.
• Existing composer-bold and mention-edit Playwright journeys: 14 passed across Chromium and WebKit. No browser cases added or removed.
• Full Vitest at 33ab0688, through the mandatory pre-push hook with BUZZ_TEST_WORKERS=2: 10,079 passed, 9 skipped, across 663 passing and 2 skipped files. The initial unrestricted run had 27 failures; the complete two-worker run passed without weakened assertions or retries.
• Native workspace test attempt: preceding crates passed 78 tests; native library had 448 passed, 1 failed, 3 ignored. host_command::tests::aborting_the_read_kills_descendants failed twice with aborted command left a descendant running; later workspace suites did not run after that failure.
• Mandatory pre-push TypeScript, full unit suite, design checks, and workspace/all-target Clippy passed. The earlier full pnpm test invocation ended during Node integration without a final summary, so Node integration is recorded as incomplete.

Human validation: Kalvin confirmed completing the requested native desktop smoke test on cyberpunk/security-deps (head 33ab0688) on October 16, 2026, with no issues reported. The checklist covered connection/reconnection, rich-text editing and undo/redo, copy/cut/paste, draft restoration and message editing, and native attachment/update checks where available. This records human-reported functional testing, not exploit reproduction or cross-platform certification. Windows and Linux manual validation remain unverified; the automated-test limitations above remain recorded.

Collected broad-test evidence from the initial upgrade run (before the subsequent fixture correction): full Vitest reported 10,052 passed, 27 failed, 9 skipped across 646 passing, 17 failing, and 2 skipped files. No baseline reproduction of those failures is claimed. The original combined pnpm test log stops during Node integration without a final summary or recoverable exit code; the full chain is incomplete, not passed. Vitest test-list collection also produced no usable inventory. Subsequent validation should be reported separately against its actual code state.

[wpfleger96]

🤖 thanks for this. checked the lockfiles: only rustls, prosemirror-model/view and source-map-js move, one resolved model version, and the rustls 0.23.46 checksum matches crates.io with the same dependency set as 0.23.44. the serializer change is the right adaptation: model 1.25.5+ serializes text nodes itself and no longer types a bare string as a valid top-level spec, so the text entry was dead and the unlinked-token span keeps the same clipboard text.

nonblocking: main already got the same effort: "" fixture fix in #1262, so that hunk drops out on merge and the paragraph about it in the description goes stale.