Three things, separable by commit.

Open files from a deterministic temp path

Opening a file downloaded it into the user's Downloads folder, so a copy of everything the user merely looked at piled up beside the things they chose to save. It went there because the middleware's FileDownload had closed its temp scope to us and an opened file had to land somewhere findable.

It goes back under the system temp scope, but on a path that is the same every time. Main resolves a temporary request to a folder of its own per object, so the checksum reuse that shipped alongside this actually fires — a fresh folder per open would leave another copy behind on every open, which is exactly what the reuse exists to prevent. electron-dl uniquifies rather than replaces, so the request also asks to overwrite. Between them, the same file opened twice moves no bytes and occupies one path.

Only files the system can view take that route. Anything else is revealed in the file manager rather than opened, and still lands in the download folder where the user can find it again. That decision is made up front from object.fileExt; the existing canAutoOpen(path) check on the landed path stays as the final gate, so a file whose real extension disagrees still can't be executed.

Main owns the layout so the renderer never spells the path: Download.open sends an empty directory plus the flag, DownloadManager.directory resolves it, run creates it (electron-dl only joins paths), and prune sweeps folders nothing has landed in for a week — macOS purges its own temp scope, Windows and Linux don't.

11 new tests, both sides of the IPC boundary. Suite goes 1061 -> 1072 passing with the same 90 failures develop already has.

Electron 41.10.7 and the security bumps that ship

Electron 41 is end of life — 41.10.7 was its final release, cut the day 44.0.0 shipped, and the supported line is now 42/43/44. Moving off 41 changes what the app runs on: 44 drops macOS 12 and statically links ANGLE, which the graph's WebGL renderer needs testing against. That goes to a beta of its own after this release. Until then 41.10.7 is at least the last of the line, and it corrects a working tree that had drifted to a stale 41.9.0 binary.

Two of these ship to users, both rated high:

Package

Fixes

electron-builder
26.8.1 → 26.16.1
GHSA-7g7r-gx96-252g — uncontrolled search path elements in the AppImage app-builder-lib builds

electron-updater
6.8.3 → 6.8.9
GHSA-p2f4-r6v6-j797 — builder-util-runtime → 9.7.0, cross-origin redirect no longer forwards Authorization/PRIVATE-TOKEN. Our publish provider is generic and unauthenticated, but this is the auto-updater

The rest sanitize or render content the user didn't write:

Package

Fixes

dompurify
3.3.3 → 3.4.15
a run of sanitizer bypasses, all above 3.4.12

mermaid
11.15.0 → 11.17.2
prototype pollution and DoS in diagram rendering (<11.16.1)

lodash
4.17.23 → 4.18.1
prototype pollution in _.unset / _.omit

All minor or patch. The major upgrades on offer — React 19, TypeScript 7, Vite 8, mobx 7, mermaid 12 — are the wrong risk this close to a release and are left alone. Every version picked clears the repo's min-release-age=7d.

Middleware 0.51.3

Additive: API v2 set_type, sidebar widgets, object discussions, create-from-template, plus a fix for bootstrap renaming a space store still being created. No proto changes the v1 client path depends on.

Verification

• 
  bun run typecheck — 0 errors


• 
  bun run lint — 0 errors (23 pre-existing no-multi-spaces warnings in unrelated test files)


• 
  npx vitest run — 1072 passed, 90 failed (identical set to develop)


• 
  bun run build:dev — builds clean with the upgraded mermaid/dompurify/lodash


• 
  bun install rebuilt keytar against 41.10.7 without incident (N-API, ABI-stable)

Open behaviour was tested manually by @requilence.

Note for the reviewer

bun install warns incorrect peer dependency "[email protected]" — electron-builder 26.16.1 wants a matching squirrel version that doesn't exist yet (latest is 26.15.3). We build Windows with nsis, not squirrel, so it's inert.