fix(fork): update dependencies with released security fixes

.github/fork/dependency-consumers.test.cjs

@@ -0,0 +1,22 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { createRequire } = require('node:module');
+const { dirname, join } = require('node:path');
+const { pathToFileURL } = require('node:url');
+
+const mobileRequire = createRequire(join(__dirname, '../../apps/mobile/package.json'));
+const nativeRequire = createRequire(mobileRequire.resolve('@react-navigation/native'));
+const navigationDir = dirname(nativeRequire.resolve('@react-navigation/core'));
+const screens = { Chat: 'chat' };
+
+test('navigation decodes query parameters through the upgraded decoder', async () => {
+  const { getStateFromPath } = await import(pathToFileURL(join(navigationDir, 'getStateFromPath.js')));
+  const state = getStateFromPath('/chat?message=hello%20world', { screens });
+  assert.equal(state.routes[0].params.message, 'hello world');
+});
+
+test('navigation encodes route parameters after dependency upgrades', async () => {
+  const { getPathFromState } = await import(pathToFileURL(join(navigationDir, 'getPathFromState.js')));
+  const state = { routes: [{ name: 'Chat', params: { message: 'hello world' } }] };
+  assert.equal(getPathFromState(state, { screens }), '/chat?message=hello%20world');
+});

FORK.md

@@ -146,6 +146,25 @@ otherwise.
   not-compromised/t3code#6 (nightly schedule revival).
 - **Retire when:** never.
 
+### Dependency security fixes
+
+- **Commits:** `fix(fork): update dependencies with released security fixes`
+- **Must still be true:**
+  - The workspace lockfile resolves the dependencies named in #8 to releases
+    that fix the reported advisories.
+  - Security overrides use compatible minimum-version ranges, allowing newer
+    patch/minor releases within the chosen compatibility line. Remove them
+    when upstream raises its dependency requirements to fixed versions.
+  - The desktop build, markdown rendering, D-Bus integration and bundled
+    provider SDK consumers remain compatible. Navigation keeps query-string
+    7's namespace API while its decoder resolves to a fixed ESM release.
+- **Boundary exception:** the owner's dependency-update request permits
+  security overrides in `pnpm-workspace.yaml` and regenerated `pnpm-lock.yaml`.
+  Stock npm servers and the TestFlight app still receive dependencies from
+  upstream; this fork update changes their bundled fork counterparts only.
+- **Detail:** not-compromised/t3code#8, not-compromised/t3code#10.
+- **Retire when:** upstream's dependency requirements exclude the vulnerable versions.
+
 ## Verification
 
 A run is good when the release exists with `T3-Code-*.AppImage` and

patches/query-string@7.1.3.patch

@@ -0,0 +1,11 @@
+diff --git a/index.js b/index.js
+index 4cf3c5e..3c4f9d3 100644
+--- a/index.js
++++ b/index.js
+@@ -1,5 +1,5 @@
+ 'use strict';
+ const strictUriEncode = require('strict-uri-encode');
+-const decodeComponent = require('decode-uri-component');
++const decodeComponent = require('decode-uri-component').default;
+ const splitOnFirst = require('split-on-first');
+ const filterObject = require('filter-obj');