[Angnuo (angnuoli)]

Summary

• Replace closed Dependabot PR build(deps-dev): bump js-cookie from 3.0.5 to 3.0.7 in /desktop/renderer #15 with a focused update based on current main (eabeeef).
• Update renderer's transitive development dependency js-cookie from 3.0.5 to 3.0.8. Version 3.0.7 fixes GHSA-qjx8-664m-686j; 3.0.8 additionally restores ES5 compatibility and removes the inadvertent Node >=20 restriction.
• Change only js-cookie's lockfile entry: version, integrity, and removal of the upstream engines field. Preserve unrelated dependencies and lockfile metadata. The parent dependency remains js-beautify.
• This addresses a vulnerable development dependency; application-level exploitability has not been established.

Validation

• Current configured npm mirror provides js-cookie 3.0.8. Downloaded the tarball without executing scripts and verified SHA1 against registry metadata; the lockfile uses the downloaded package's SHA512 integrity.
• Renderer npm ci: passed (392 packages). npm's existing script allowlist warned about esbuild/vue-demi; no script policy was changed.
• Security regression smoke checks: 3.0.5 reproduces the JSON proto cookie-attribute injection as a negative control; 3.0.8 blocks the same payload through set, withAttributes, and remove. Normal cookie set/get also passed.
• Compatibility smoke checks: 3.0.8 UMD output parses as ES5; package metadata has no Node engine restriction. Installed code exactly matches the tested tarball; js-beautify resolves js-cookie 3.0.8 and its HTML-formatting smoke check passes.
• Renderer tests: 54 files passed; 797 tests passed, 2 skipped.
• Renderer lint: 0 errors, 106 existing warnings.
• Desktop TypeScript and renderer production build: passed (Vite 6.4.4), with existing bundle/annotation warnings.
• Prettier on the changed lockfile and git diff --check: passed.
• Structural comparison confirms only the intended js-cookie entry changed. Desktop manifest/lockfile and renderer manifest are unchanged; worktree is clean after validation.

Existing baseline and CI limitations

• Desktop npm ci still fails on main's existing jschardet lock mismatch (locked 3.1.4 versus the formatter's latest dependency resolving to 4.0.0). This PR does not modify desktop dependencies or fix that separate issue, and does not claim a successful whole-project clean install.
• For local validation only, desktop prerequisites were installed using --ignore-scripts --no-save --package-lock=false. Electron 33.4.11 runtime was reused from the existing local installation after matching package versions and the executable's SHA256. No npm security policy was weakened.
• Last checked before merge: GitHub PR Build remains queued on the self-hosted Windows runner; CLA passed. Remote CI is not being reported as passed. Merge uses the normal manual squash path without an administrator override or auto-merge.

References

• GHSA-qjx8-664m-686j
• https://github.com/js-cookie/js-cookie/releases/tag/v3.0.8