[ardakrt]

Authly's pinned dependencies have accumulated security advisories. Update the existing major versions and vulnerable transitive dependencies: the resulting lockfile reports 0 npm audit vulnerabilities, down from 12 affected packages (10 high, 2 moderate).

Changes

• Electron 43.3.0 → 43.8.4, electron-updater 6.8.9 → 6.8.11, Zod 4.4.3 → 4.6.7, Vite 7.3.6 → 7.3.7, and Vitest 4.1.10 → 4.1.12.
• Refresh vulnerable transitive versions of js-yaml, undici (all installed major lines), http-cache-semantics, @xmldom/xmldom, fast-uri, source-map-js, brace-expansion, and Vitest internals within their allowed dependency ranges.
• Add npm audit --audit-level=high to the existing Windows/Linux CI matrix so future high and critical advisories fail verification.

Validation

GitHub Actions CI passes on the exact PR head ef2883c:

• Clean npm ci and dependency audit: 0 vulnerabilities on both Windows and Linux.
• npm run verify passes on both platforms: formatting, ESLint, 42/42 tests across 15 files, both TypeScript projects, production builds, and the real Electron smoke test (AUTHAPP_SMOKE_READY).
• CodeQL analysis passes.
• git diff --check passes.

The change is limited to package manifests, the lockfile, and the CI audit step.