[scttbnsn]

The desktop runtime lock and npm workspace lock still select versions covered by the dependency findings. Update both runtime trees together so staging uses the reviewed patched versions.

Package	Selected version
sanitize-html	2.18.1
undici	8.12.3
source-map-js	1.2.2
zod	4.6.7

The root lock also updates the existing Undici 6.x/7.x copies to compatible patched versions. Root dependency ranges are unchanged. The selected trees no longer match the nineteen advisory ranges checked for this repair; this is scoped dependency remediation, not a claim that all dependencies are vulnerability-free.

The pre-commit hook also references two deleted static-dashboard tests. Replace those paths with the current app-foundation, dashboard-retirement and YAML guards. Add a regression that rejects references to missing or untracked guard tests. Pre-push gates and branch protection stay intact.

Validation:

• Full Node suite on this exact candidate: 5,448 passed, 20 skipped.
• 112 focused document/network/HTML-security/ACP and packaging checks passed against the selected dependency trees.
• Clean desktop dependency install and root lock consistency checks passed.
• Biome and Knip passed.

The full npm test command now limits concurrency to two workers while retaining
the same tests and skips. This avoids overloading the process-lifecycle fixtures
and applies equally to the local hook and CI.

This PR contains six files. Browser startup, PDF distribution and document-folder changes are separate local work. Signed native releases and artifact publication remain separate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
careerrat-website	Ready	Preview	Oct 25, 2026 4:01pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: CodesWhat/careerrat
• Branch: dev/v0.16
• File: .coderabbit.yaml
• Commit: 25c0628
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: d808273f-321d-4012-86f2-901cb64cfb2a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[scttbnsn]

Codex adversarial review on 7fca594, since CodeRabbit skips the dev base.

Verdict: approve, no material findings. It checked both lockfiles against their manifests (no leftover vulnerable undici, sanitize-html, zod or source-map-js copies, no unrelated resolved/integrity drift), confirmed the replacement lefthook guards exist and pass, and read the release-safety change as additive. 148 targeted tests passed in its sandbox. One export test couldn't write there; the full suite is covered by the tests check on this head.

Trace: Codex session 01a17501-06c1-7ee1-a0db-07ed3ab06eda.

[biggest-littlest]

Approving 7fca594: Codex adversarial review clean, all required checks green on this head.

[ALARGECOMPANY]

Approving 7fca594: Codex adversarial review clean, all required checks green on this head.