Resolves#483
vite moves from 6.4.3 to 6.4.4 in package-lock.json only; package.json
keeps ^6.4.3 (decision of Max). The node_modules/vite stanza changes its
version, resolved URL and integrity (equal to npm view), nothing else:
npm update kept 6.4.3, and npm install vite@^6.4.3 resolved 6.4.4 but
rewrote the range to ^6.4.4, so only its vite stanza was kept. npm ci
passes under npm 11.21.0 and 10.9.4 and installs 6.4.4; npm 11.21.0
leaves the lock byte-identical. npm audit goes from the three
launch-editor advisories to none; the build output equals main's except
the two changelog copies. The dated npm audit reading in CLAUDE.md and
docs/architecture.md moves to 2026-10-20.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Refs #484
cargo update --precise for the two crates only: Cargo.lock moves four
lines (version and checksum of each), no package added or removed, same
crates.io source, Cargo.toml untouched. cargo-audit 0.22.2 (the CI
binary) goes from two vulnerabilities to none, with the same 18 allowed
warnings. rustls-webpki validates the updater's certificate chain on
Linux only; webpki-root-certs is compiled for neither shipped target.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
