v0.7.1 — Security patch

Security patch release. No feature or behaviour changes. It picks up the advisories published since 0.7.0, including a critical Astro RCE and a js-yaml advisory in the desktop auto-updater path. pnpm audit is back to 0 vulnerabilities.

Changed

• Electron 43.4.1 → 43.7.3. This stays on the 43.x line and brings in upstream Chromium security fixes. electron-builder is unchanged at 26.15.7.
• Patch and minor bumps:
  • Desktop: zod 4.6.5.
  • Web: react / react-dom 19.3.0, i18next 26.4.2, react-i18next 17.0.15, lucide-react 1.47.0, tailwind-merge 3.7.0, vite 8.3.0, @vitejs/plugin-react 6.1.1.
  • Landing: astro 7.3.3, @astrojs/react 6.0.6, @astrojs/sitemap 3.7.4, satori 0.33.5, sharp 0.35.4.
  • Root tooling: eslint 10.11.0, typescript-eslint 8.70.1, globals 17.12.0, lint-staged 17.5.1, prettier 3.9.8.

Security

• astro 7.2.4 → 7.3.3 (landing): closes GHSA-26w7-cxv4-gfx2, a critical RCE in AVIF image optimisation via libheif. The landing site is static, so the exposure was limited to build time and the dev server.
• sharp 0.35.3 → 0.35.4: closes GHSA-rgj7-g3m4-5g8c, a high-severity libheif overflow.
• js-yaml override floor raised to 4.3.2 (GHSA-2883-xcg3-v3hh). This is the highest-priority fix for end users, because electron-updater parses update manifests fetched over the network with js-yaml at runtime.
• Other override floors raised:
  • fast-uri to 3.1.6 (4 high-severity advisories).
  • svgo to 4.1.0, now capped below v5.
  • devalue to 5.9.2 (GHSA-9rgm-9g3h-6x36). Dependabot reported this one; pnpm audit didn't.
• New overrides:
  • @xmldom/xmldom ≥0.8.15 <0.9 (10 advisories). It's capped because plist only declares ^0.8.8.
  • fflate ≥0.7.5 <0.8. satori still exact-pins 0.7.3.
  • joi ≥18.2.5 <19 (low severity, dev-only).