fix: raise dependency floors for security audit advisories

pnpm audit reported 34 advisories (15 high) against the resolved tree:
undici, fast-uri, ip-address, dompurify, serialize-javascript,
markdown-it, brace-expansion, and electron. Raise the existing override
floors and add scoped ones (fast-uri pinned to ^3, brace-expansion per
major, markdown-it capped <15 because vitepress-plugin-llms deep-imports
markdown-it/lib/token.mjs, removed in 15). Bump electron 43.4.0 to
43.5.0 (GHSA high, patched >=43.5.0). Refresh the flake pnpmDeps hash
for the new lockfile.

Author: elkaix

apps/desktop/package.json

@@ -20,7 +20,7 @@
     "@types/node": "^26.1.2",
     "@types/semver": "^7.7.0",
     "builder-util-runtime": "9.7.0",
-    "electron": "43.4.0",
+    "electron": "43.5.0",
     "electron-builder": "26.15.3",
     "electron-updater": "6.8.9",
     "semver": "^7.7.4",

flake.nix

@@ -165,7 +165,7 @@
               inherit (finalAttrs) pname version src pnpmWorkspaces;
               inherit pnpm;
               fetcherVersion = 3;
-              hash = "sha256-rCIilrxF8ys9ijp89rJwRULX3vurOSzGwPDum0N6Ut8=";
+              hash = "sha256-hSNyk78iehCbiSl7iRr9Tt7ivEyRHQSJxUDFaZQ69FU=";
             };
 
             nativeBuildInputs = [

package.json

@@ -79,18 +79,23 @@
   },
   "pnpm": {
     "overrides": {
-      "undici": ">=7.28.0",
+      "undici": ">=8.10.2",
       "shell-quote": ">=1.9.0",
-      "serialize-javascript": ">=7.0.3",
+      "serialize-javascript": ">=7.1.2",
       "vite": ">=6.4.3",
-      "dompurify": ">=3.4.8",
-      "ip-address": ">=10.3.1",
+      "dompurify": ">=3.4.16",
+      "ip-address": ">=10.7.1",
       "smol-toml": ">=1.7.1",
       "esbuild": ">=0.28.1",
       "fastify": ">=5.12.1",
       "vitest": ">=4.1.11",
       "@vitest/mocker": ">=4.1.11",
-      "diff": ">=8.0.3"
+      "diff": ">=8.0.3",
+      "fast-uri@^3.0.0": "^3.1.8",
+      "markdown-it": ">=14.3.1 <15",
+      "brace-expansion@1.x": "^1.1.21",
+      "brace-expansion@2.x": "^2.1.7",
+      "brace-expansion@5.x": "^5.0.12"
     }
   }
 }