- Lockfile-only/overrides bumps within the same major for vulnerable transitive build/test tooling (see pnpm-overrides.md) - electron 42.0.1 -> 42.11.12 (same major) for runtime advisories - .gitea/workflows/ci.yml: single job (build admin, tests, audit) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>