chore: update dependencies to latest compatible versions

[Mohamed Mansour (mohamedmansour)]

Summary

This change is based on main at aa1d9905e2d540da6e13557d672427d260237e70, which already includes the merged rustls security fix from #533. The old security commit is not included in this PR's commit range.

Update third-party Rust requirements, the pnpm catalog, the two example tsx requirements, and lockfiles using live registry metadata and Cargo/pnpm tooling, including supported stable major releases. Also migrate repository tooling and CI to the explicitly requested pnpm 12.3.4, adapting #506 to the current pipeline structure. Preserve all WebUI/local package versions, workspace links, catalog references, optional peer compatibility ranges, the Rust toolchain pin, and Node.js 22. No framework runtime changes, public API changes, or new audit exceptions.

Registry-versus-resolution verification on 2026-09-14 confirms 44 of 51 direct Rust dependencies at latest stable, with seven audit-constrained exceptions below. Public npm version histories and the installed graph confirm all 23 application dependency names resolve to their highest stable releases, plus the intentional typescript-6 compatibility-test alias at the latest stable 6.x release, 6.0.3. The primary TypeScript version remains 7.0.2.

Notable upgrades include comrak 0.55.0, actix-web 4.15.0, tokio 1.53.1, napi 3.12.4, napi-derive 3.6.5, Electron 44.3.0, Playwright 1.63.0, esbuild 0.28.2, Node types 26.5.1, FAST Element 3.0.3, tsx 4.23.13, and CodeMirror updates. Electron's latest tag points to a 45 alpha; this PR deliberately selects the highest stable release instead.

pnpm 12 and pipeline migration

• Root packageManager is pnpm@12.3.4. This is the user's explicit selection and the highest stable version available in the configured registry, not the latest public release, 12.4.1.
• GitHub's shared build action uses immutable pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b (v2.1.0) with pnpm 12.3.4, node@22, caching enabled, and dependency installation kept as a separate step. This maintained action installs the native pnpm executable directly and verifies npm's signature and checksum.
• Both Azure installation sites—hotfix validation and release assembly—replace Corepack bootstrap with the official installer pinned to 12.3.4 and PNPM_HOME/bin on PATH. Existing frozen installs, store caching, and shell failure handling are preserved. Upgrade repository tooling to pnpm 12 #506 contained only the older assembly location; this change also covers the newer validation stage.
• pnpm 12 generates an environment YAML document before the application lock document. The environment document records pnpm and eight platform binaries. The entire 172-entry application document is unchanged by the tooling migration and CI repairs.

The earlier portability fix removed machine-specific npm tarball URLs; the subsequent library refresh updated Electron/Node types and deduplicated compatible type packages. All 172 application resolutions remain SHA-512-only. The nine new package-manager resolutions use pnpm's officially generated SHA-1 hashes, which are weaker than SHA-512; each was independently compared with the exact version's public npm dist.shasum and matched. Neither document contains registry-specific tarball URLs. The native checksum-refresh command did not upgrade the environment-document hashes; no manual cache edits or invented policy bypasses were used. The 172-entry supply-chain result below must not be interpreted as verification of those nine manager entries.

CI repairs

The first pipeline migration exposed two distinct failures, addressed in 36c657a0:

• macOS bootstrap: the v1 action referenced by Upgrade repository tooling to pnpm 12 #506 hardcodes a legacy @pnpm/exe bootstrap. Its Node SEA installer rejects Intel macOS before the requested pnpm 12.3.4 is installed, affecting the macOS build and both macOS wheel jobs. The maintained v2.1.0 action removes that bootstrap and selects pnpm 12's native platform package directly. No platform was skipped and pnpm was not downgraded. Source/input-contract checks are complete; macOS execution must still be confirmed by the new CI run.
• All-offscreen startup fixture: this E2E failure already existed on the pre-pnpm-12 dependency head. The test mocked every observer entry as offscreen but left #visible at the viewport origin, where legitimate pointer-over activation could hydrate it. Real pointer movement reproduced the exact ['visible'] failure locally. The test now positions the compiled fixture offscreen before bootstrap, asserts all tracked roots are actually beyond the viewport plus lead margin, and exercises pointer movement. The original one-startup-cohort and empty-hydrated assertions remain. No framework runtime behavior was changed.

Rust versions constrained by the existing audit policy

The initial all-latest resolution failed the unchanged cargo deny duplicate-crate policy. Existing latest napi/prost/pyo3 and other upstream dependencies still require syn 2, while these newer releases introduce syn 3. The selected versions are the newest releases that avoid those incompatible duplicate chains; these are patch-release holds, not omitted major-version upgrades.

Direct dependency	Selected	Latest stable	Exact reason for holding
serde	1.0.228	1.0.229	serde 1.0.229 -> serde_core =1.0.229 -> serde_derive =1.0.229 -> syn ^3; the core crate's exact derive edge participates in Cargo resolution.
thiserror	2.0.18	2.0.20	Both thiserror-impl 2.0.19 and 2.0.20 require syn ^3; the implementation version is exact.
clap	4.6.3	4.6.6	clap 4.6.4..4.6.6 -> clap_derive =4.6.4 -> syn ^3.0.2.
futures-util	0.3.33	0.3.34	futures-util 0.3.34 -> futures-macro =0.3.34 -> syn ^3.0.
wasm-bindgen	0.2.127	0.2.128	The exact-version macro chain ends at wasm-bindgen-macro-support 0.2.128 -> syn ^3.0.
js-sys	0.3.104	0.3.105	js-sys 0.3.105 -> wasm-bindgen =0.2.128, requiring the preceding blocked macro chain.
rcgen	0.14.9	0.14.10	rcgen 0.14.10 -> pem ^4 -> base64 0.23; actix-http and awc still require base64 0.22.

The lockfile also retains compatible transitive releases for these transitions: tokio-macros 2.7.1, displaydoc 0.2.6, zerovec-derive 0.11.3, the ICU 2.2 family with zerovec 0.11.6, potential_utf 0.1.5, tinystr 0.8.3, multiversion 0.8.0, and the coupled futures 0.3.33 packages. No audit policy was weakened. The pre-existing, unused example-local Cargo.lock is unchanged; the Rust example belongs to the workspace and resolves through the root lockfile.

Validation under pnpm 12.3.4

• Ordinary activation reports 12.3.4. After both CI repairs, cargo xtask check passed in 135.6 seconds under this toolchain, including formatting, clippy, protocol drift, unchanged dependency audits, workspace tests, native builds, all three WASM variants, all examples, benchmark smoke validation, and docs. This is a fresh pnpm-12 run, not a claim based on the earlier pnpm-11 gate.
• The corrected startup regression passed 10 consecutive runs with retries disabled. The full compiled-fixture framework browser suite then passed 314 tests with 2 pre-existing skips and retries disabled on Windows. E2E TypeScript checking also passed. No assertions, retries, thresholds, or test coverage were weakened.
• Supported pnpm install --offline --frozen-lockfile --no-trust-lockfile, using cached public-registry metadata with no-downgrade policy unchanged: all 172 application entries passed supply-chain verification, and pnpm 12 installed the 127 applicable packages and ran approved lifecycle scripts.
• Native/projection 72 passed against this checkout's rebuilt addon; framework units 346 passed; router units 113 passed. Electron example build and binary-version smoke passed with 44.3.0.
• pnpm audit read both YAML documents, reporting 181 dependencies and zero advisories. This advisory scan is separate from integrity/policy verification.
• YAML structural assertions confirm matching 12.3.4 pins in the root manifest, GitHub setup, both Azure install scripts, and environment lock document, while preserving Node 22, caching, and frozen installs. Existing release-pipeline regression tests: 2 passed. The updated action's declared inputs and native downloader implementation were checked against the pinned upstream source.
• Automated comparisons confirm the full application lock document did not change during tooling migration or CI repairs, all nine generated manager hashes match public npm metadata for their exact versions, and no registry-specific tarball URLs were introduced.
• Earlier broad-upgrade validation: targeted Rust tests node 41, press 122, wasm 29; streaming server tests 10; router Playwright 33 passed / 4 existing skips. No new skips or weakened tests.
• MSRV metadata check covers 111 new/upgraded resolved Rust packages. The highest declared minimum among them is Rust 1.88; no resolved package declares a minimum above the workspace's 1.93. Twelve upgraded crates omit rust-version, so this metadata check is not a claim of a full Rust 1.93 build.

Local registry limitation

The configured registry provides pnpm 12.3.4 but omits public 12.4.1 and the newest Electron 44.3.0 / Node types 26.5.1 metadata. An online strict install therefore correctly rejected the two missing application releases; a bounded public-registry native verification attempt did not complete, and native public metadata requests report transport errors. The successful pnpm-12 install used its supported offline mode with previously cached public-registry metadata while keeping policy verification enabled. Fresh online installation in this local environment remains dependent on registry availability/transport; no TLS or supply-chain protections were disabled, and no application dependencies were downgraded.