[matsvarn]

Security dependency bumps.

• Node SEA runtime 26.8.2 to 26.12.1 (2026-10-21 security release, ten CVEs). This includes CVE-2026-111497, a Brotli decoder out-of-bounds write with RCE potential, the TLS hostname bypasses, and CVE-2026-106074, where SEA builds bake the crypto.randomUUID()/randomInt() entropy cache into the executable so every process repeats the same values. SEA_NODE_VERSION, VP_NODE_VERSION in release-desktop.yml, and docs/operations/release.md move together.
• Electron 44.4.2 to 44.9.1. It blocks the compromised eMudhra intermediate CAs (Mozilla bug 2083449, NSS 3.131.1) and carries upstream Chromium security fixes. The minimumReleaseAgeExclude entry in pnpm-workspace.yaml moves with it. electron-builder 26.15.6 doesn't pin an Electron version, and the build scripts read it from apps/desktop/package.json.
• sharp 0.35.4 to 0.35.5 in apps/marketing and scripts, which fixes the librsvg SVG use-after-free (CVE-2026-96889). pnpm-lock.yaml now resolves only sharp@0.35.5.

Checked locally on linux-x64: build-exe with a checksum-verified Node 26.12.1 host produces dist-exe/t3, which runs and embeds v26.12.1. vpr typecheck, vp check, knip:check, build:marketing, build:desktop, and the preload bundle check all pass. ensure:electron installed 44.9.1.

Users only get the patched runtime after a desktop release.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	−26 B (−0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−27 B (−0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	56.2 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	−42 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−7 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−35 B (−0.5%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.1 KiB	57.0 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 4a61673 · PR result: 68aa1ad · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.