[Angnuo (angnuoli)]

Summary

• Replace the conflicting Dependabot PR build(deps-dev): bump form-data from 4.0.5 to 4.0.6 in /desktop #30 on current main.
• Update the desktop publishing dependency form-data from 4.0.5 to 4.0.6, which fixes CRLF injection in multipart field names and filenames (GHSA-hmw2-7cc7-3qxx).
• Update hasown to 2.0.4 to satisfy form-data's actual published dependency metadata. Keep the existing compatible mime-types 2.1.35 resolution.
• Change only the two package entries in desktop/package-lock.json. Preserve the jschardet clean-install resolution from fix(deps): restore jschardet resolution for npm ci #275; no manifest, application code, registry or script-policy changes.

Validation

• Normal desktop npm ci with a fresh cache, including the root postinstall, and a separate normal renderer npm ci: passed; both lockfiles stayed unchanged during installation.
• One-off security regression: 4.0.5 negative controls reproduce field-name and filename header injection; 4.0.6 escapes CR/LF/quotes and blocks both cases.
• Multipart compatibility checks: ordinary bodies match 4.0.5 byte-for-byte; binary data, lengths, headers and streamed upload pass. electron-publish resolves 4.0.6, and installed form-data source/metadata match the verified package tarball.
• Renderer tests: 54 files passed, 797 tests passed and 2 skipped.
• Weixin Node runtime tests: 8 passed.
• Desktop TypeScript and renderer production build: passed.
• Renderer lint: 0 errors, 106 existing warnings. Lockfile Prettier and git diff --check: passed.

Existing validation limits

• Desktop lint still reports the two pre-existing errors (no-control-regex and the unused readJsonObject helper), plus 60 warnings. The affected source files are unchanged from main.
• Existing npm allowScripts policy was preserved. Electron/node-pty/electron-winstaller install scripts remain unapproved; Electron-dependent desktop tests and installer packaging were not run.
• Other pre-existing audit findings are outside this narrowly scoped security update; this PR does not claim to resolve the full dependency audit.