Security: patch-level dependency overrides, electron 42.11.12; add Gitea CI

- Lockfile-only/overrides bumps within the same major for vulnerable
  transitive build/test tooling (see pnpm-overrides.md)
- electron 42.0.1 -> 42.11.12 (same major) for runtime advisories
- .gitea/workflows/ci.yml: single job (build admin, tests, audit)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,84 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+    tags-ignore: ["**"]
+  workflow_dispatch:
+  schedule:
+    - cron: "41 5 * * *" # nightly: dependency audit + full test run
+
+# One job on purpose: the shared runner pool is small, so everything runs
+# sequentially on a single runner instead of a matrix.
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    env:
+      CI: "true"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: install pnpm
+        run: |
+          npm install -g pnpm@10.33.3
+          pnpm --version
+
+      - name: install dependencies
+        # Lifecycle scripts are skipped: the desktop postinstall compiles
+        # electron-app native modules, which the admin build and ember tests
+        # do not need.
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: install headless chrome
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v google-chrome >/dev/null 2>&1; then
+            SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
+            $SUDO apt-get update -qq || true
+            $SUDO apt-get install -y -qq --no-install-recommends \
+              libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libgbm1 \
+              libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
+              libpango-1.0-0 libcairo2 libx11-6 libxcb1 libxext6 fonts-liberation \
+              || true
+            $SUDO apt-get install -y -qq --no-install-recommends libasound2t64 \
+              || $SUDO apt-get install -y -qq --no-install-recommends libasound2 || true
+            npx --yes @puppeteer/browsers@2 install chrome@stable --path "$RUNNER_TEMP/chrome"
+            CHROME_BIN=$(find "$RUNNER_TEMP/chrome" -type f -name chrome -perm -u+x | head -n 1)
+            mkdir -p "$HOME/bin"
+            ln -sf "$CHROME_BIN" "$HOME/bin/google-chrome"
+            echo "$HOME/bin" >> "$GITHUB_PATH"
+          fi
+          "${HOME}/bin/google-chrome" --version 2>/dev/null || google-chrome --version
+
+      - name: build admin ui
+        run: pnpm --filter admin build
+
+      - name: test addons
+        run: |
+          for a in core auth rose; do
+            echo "::group::addons/$a"
+            (cd addons/$a && npx ember test --test-port 0)
+            echo "::endgroup::"
+          done
+          echo "::group::addons/api"
+          (cd addons/api && npx ember exam --test-port 0 --split=4 --parallel=1)
+          echo "::endgroup::"
+
+      - name: test desktop ui
+        run: cd ui/desktop && npx ember test --test-port 0
+
+      - name: test admin ui
+        run: cd ui/admin && npx ember exam --test-port 0 --split=4 --parallel=1
+
+      - name: dependency audit
+        # Fails on critical advisories only; remaining high/moderate advisories
+        # are build/test tooling and are tracked in pnpm-overrides.md.
+        run: |
+          pnpm audit --audit-level=critical
+          (cd ui/desktop/electron-app && pnpm audit --audit-level=critical)

package.json

@@ -52,9 +52,44 @@
       "ember-try-config>package-json": "^10.0.1",
       "ember-loading>ember-concurrency": "^4.0.0",
       "tmp": "^0.2.7",
-      "tar": "^7.5.10",
+      "tar": "^7.5.22",
       "nomnom>underscore": "^1.13.8",
-      "ember-cli>markdown-it": "^14.2.0"
+      "ember-cli>markdown-it": "^14.3.2",
+      "diff@>=5.0.0 <6.0.0": "^5.2.2",
+      "qs@>=6.0.0 <7.0.0": "^6.16.0",
+      "follow-redirects@>=1.0.0 <2.0.0": "^1.16.1",
+      "postcss@>=8.0.0 <9.0.0": "^8.5.29",
+      "ws@>=8.0.0 <9.0.0": "^8.22.0",
+      "brace-expansion@>=5.0.0 <6.0.0": "^5.0.12",
+      "brace-expansion@>=2.0.0 <3.0.0": "^2.1.7",
+      "brace-expansion@>=1.0.0 <2.0.0": "^1.1.21",
+      "form-data@>=4.0.0 <5.0.0": "^4.0.6",
+      "js-yaml@>=3.0.0 <4.0.0": "^3.15.2",
+      "js-yaml@>=4.0.0 <5.0.0": "^4.3.2",
+      "morgan@>=1.0.0 <2.0.0": "^1.12.1",
+      "@babel/core@>=7.0.0 <8.0.0": "^7.29.7",
+      "engine.io@>=6.0.0 <7.0.0": "^6.6.11",
+      "shell-quote@>=1.0.0 <2.0.0": "^1.12.0",
+      "body-parser@>=1.0.0 <2.0.0": "^1.20.8",
+      "linkify-it@>=5.0.0 <6.0.0": "^5.0.2",
+      "seroval@>=1.0.0 <2.0.0": "^1.6.9",
+      "socket.io-parser@>=4.0.0 <5.0.0": "^4.2.7",
+      "ip-address@>=10.0.0 <11.0.0": "^10.7.4",
+      "axios@>=1.0.0 <2.0.0": "^1.20.0",
+      "nanoid@>=5.0.0 <6.0.0": "^5.1.16",
+      "nanoid@>=3.0.0 <4.0.0": "^3.3.20",
+      "postcss-selector-parser@>=7.0.0 <8.0.0": "^7.1.6",
+      "browserslist@>=4.0.0 <5.0.0": "^4.29.3",
+      "immutable@>=5.0.0 <6.0.0": "^5.1.9",
+      "colord@>=2.0.0 <3.0.0": "^2.10.0",
+      "baseline-browser-mapping@>=2.0.0 <3.0.0": "^2.11.28",
+      "source-map-js@>=1.0.0 <2.0.0": "^1.2.2",
+      "proxy-addr@>=2.0.0 <3.0.0": "^2.0.8",
+      "compression@>=1.0.0 <2.0.0": "^1.8.2",
+      "handlebars@>=4.0.0 <5.0.0": "^4.7.10",
+      "websocket-driver@>=0.7.0 <0.8.0": "^0.7.5",
+      "@humanfs/node@>=0.16.0 <0.17.0": "^0.16.8",
+      "@xmldom/xmldom@>=0.8.0 <0.9.0": "^0.8.15"
     },
     "ignoredBuiltDependencies": [
       "@parcel/watcher",

pnpm-overrides.md

@@ -13,6 +13,15 @@ These overrides force specific versions of transitive dependencies, primarily fo
 | `ember-try-config>package-json` | `^10.0.1` | `ember-try-config` pins an older `package-json`.                                                                                                                                                                               | Check whether a newer `ember-try-config` release widens its `package-json` range to include v10+.                                                                                                                                                        |
 | `ember-loading>ember-concurrency` | `^4.0.0` | `ember-loading` declares `"ember-concurrency": "^2.0.3"`.                                                                                                                                                                      | The override and the patch (`patches/ember-loading.patch`) are a pair — the override forces v4 to be installed, the patch updates the source to use v4. Both must be removed together if `ember-loading` ever ships a version that natively supports v4. |
 | `tmp` | `^0.2.7` | 10+ packages pin old versions of `tmp` (`broccoli`, `can-symlink`, `ember-cli-typescript`, `external-editor`, `fixturify-project`, `sane`, `testem`, and others)                                                               | Check whether the main Ember toolchain packages (`broccoli`, `ember-cli`, `testem`) have been updated to allow `tmp ^0.2.x`.                                                                                                                             |
-| `tar` | `^7.5.10` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges.                                                                                                                                                  | Check whether a newer `ember-electron` brings in versions of `@electron/rebuild` and `cacache` that allow `tar ^7.x`.                                                                                                                                    |
+| `tar` | `^7.5.22` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges.                                                                                                                                                  | Check whether a newer `ember-electron` brings in versions of `@electron/rebuild` and `cacache` that allow `tar ^7.x`.                                                                                                                                    |
 | `nomnom>underscore` | `^1.13.8` | `nomnom` pins `"underscore": "~1.6.0"`. All other consumers already declare ranges that include 1.13.8.                                                                                                                        | `nomnom@1.8.1` is the last published version and the package is abandoned. `jsonlint` is the actual consumer, currently pinned to `^1.6.3` which still depends on `nomnom`.                                                                              |
-| `ember-cli>markdown-it` | `^14.2.0` | `ember-cli` (`~5.12.0`) pins old ranges. | Once `ember-cli` has been updated to at least `6.3.0` then this override can be removed. |
+| `ember-cli>markdown-it` | `^14.3.2` | `ember-cli` (`~5.12.0`) pins old ranges. | Once `ember-cli` has been updated to at least `6.3.0` then this override can be removed. |
+
+## Security overrides added by the Threshold fork
+
+The overrides keyed `<name>@>=X.0.0 <Y.0.0` were generated from `pnpm audit` (see the "About this fork" section in the README). Each one only raises a transitive dependency to the latest patched release **within the same major line** (patch/minor, lockfile-only effect). They are build/test tooling dependencies (`ember-cli`, `testem`, `stylelint`, `openapi-generator`, ...), not shipped code. Remove an entry once the dependents release versions that no longer need it; re-run `pnpm audit` after removing.
+
+Packages covered: `@babel/core`, `@humanfs/node`, `@xmldom/xmldom`, `axios`, `baseline-browser-mapping`, `body-parser`, `brace-expansion`, `browserslist`, `colord`, `compression`, `diff`, `engine.io`, `follow-redirects`, `form-data`, `handlebars`, `immutable`, `ip-address`, `js-yaml`, `linkify-it`, `morgan`, `nanoid`, `postcss`, `postcss-selector-parser`, `proxy-addr`, `qs`, `seroval`, `shell-quote`, `socket.io-parser`, `source-map-js`, `websocket-driver`, `ws`.
+
+Known unfixed without a major bump or an upstream fix: `svgo@1` (via `ember-inline-svg`), `@faker-js/faker@8` (api addon mirage data), `uuid@8` (testem), `diff@7` (sinon), `postcss-selector-parser@6` (stylelint), `basic-ftp@5` (openapi-generator), `extract-zip@2`, `http-cache-semantics@4`, `braces@3`, `sprintf-js@1` (no patched release).
+

ui/desktop/electron-app/package.json

@@ -44,7 +44,7 @@
     "@electron-forge/maker-dmg": "^7.11.0",
     "@electron-forge/maker-squirrel": "^7.11.0",
     "@electron-forge/maker-zip": "^7.11.0",
-    "electron": "42.0.1",
+    "electron": "42.11.12",
     "esbuild": "^0.25.4",
     "unzipper": "^0.11.5"
   },