[canvascoding]

Remediates the stored baseline of 124 Dependabot alerts across npm, document Python and optional dictation dependencies. Every baseline vulnerable range was checked against the resulting locks; npm and all 64 pinned Python packages currently audit with zero known findings.

• Patch web/auth/MCP/editor/mail dependencies, Electron and both Python locks in sequential, separately validated commits.
• Build Sharp against patched librsvg/libvips/Cairo with pinned sources and the required corresponding-source/license artifacts.
• Add the provider's nullable token-revocation column. Live OAuth testing exposed an existing gap: refresh revocation now also atomically invalidates issued MCP bearer JWTs through the existing grant marker.
• Repair the Python HEIF fallback API and add focused runtime/browser regressions.
• Add read-only PR/main dependency-security CI with pinned Actions and audit tooling.

Validation:

• Normal clean npm ci; all-level npm audit: 0. pip-audit: 64 packages, 0 findings, none skipped. Complete binary/hash resolutions pass for Linux amd64 and arm64.
• Full host production builds and Linux arm64 image builds, compiled Yjs identity/content canary, patched native linkage and actual SVG/HEIF/PDF/crypto processing pass.
• Final Playwright: 10 passed, 1 skipped (onboarding is intentionally disabled in this fixture). Includes live PKCE consent/refresh/immediate JWT and refresh-token revocation, rich blocks, image controls, private/public PDFs, HEIF and Mermaid math.
• Desktop/mobile UI and actual dictation model download, reload recovery and microphone ASR pass. The optional Faster-Whisper installer, real Hub/FileLock integration, planted-file integrity and warm-worker ASR also pass.
• 38 Electron tests passed, including the locally ad-hoc-signed app/helper microphone checks; real Electron setup/connect/relaunch, Node/Chromium TLS rejection, sandbox and IPC boundaries pass.
• Actual PDF/PNG/PPTX exports with MathJax and KaTeX, MIME round trips, smoke/file-operation integration, MCP HTTP and HTML/PDF security boundaries pass. Screenshots and exports were visually inspected.
• License inventory: 0 blockers. Full lint: 0 errors, 729 warnings; all changed code passes focused lint without warnings.

Detailed remediation, versions and evidence

Limits: native runtime execution was Linux/macOS arm64; amd64 Python wheels were resolved/hash-verified. Local ad-hoc signing is not Developer ID signing/notarization. Electron 42's supported-major migration remains follow-up work. The report identifies the pre-existing missing historical MCP test command and the directly executed current provider migration coverage.

No release/tag/deployment or merge is included. GitHub alerts close only after the default branch is updated and its dependency graph is reanalyzed.