chore(deps): dependency hygiene cleanup

- Bump the qs (6.16.1) and fast-uri (3.1.9) override pins off the vulnerable releases.
- Drop the artillery devDependency; the load:workflow scripts run it through bunx.
- Move @xyflow/react to devDependencies in workflow-persistence (type-only import).
- Remove the minimatch and brace-expansion overrides: forcing minimatch 10 broke
  CommonJS consumers like @electron/asar, and every major line now resolves to a
  patched backport.
- Remove redundant socket.io, baseline-browser-mapping, drizzle-orm, and joi (artillery-only) overrides,
  sharp from trustedDependencies (no lifecycle scripts), and the temporary electron
  release-age exclude. The electron@latest canary bypasses the age gate explicitly.
- Declare buffer, process, chai, and tinyrainbow, which the sandbox bundle build
  imports but only resolved through hoisting.

Author: waleedlatif1

.github/workflows/desktop-e2e.yml

@@ -168,9 +168,11 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      # The bunfig age gate would resolve `latest` to the newest week-old release; the canary
+      # exists to test the release that just shipped. Already-locked packages stay locked.
       - name: Switch to electron@latest
         working-directory: apps/desktop
-        run: bun add --no-save -d electron@latest
+        run: bun add --no-save -d --minimum-release-age=0 electron@latest
 
       - name: Bundle main and preload
         working-directory: apps/desktop

apps/sim/package.json

@@ -14,9 +14,9 @@
     "dev:clean": "rm -rf .next/dev/cache",
     "dev:webpack": "bun run build:cli-runtime && next dev --webpack",
     "load:workflow": "bun run load:workflow:baseline",
-    "load:workflow:baseline": "BASE_URL=${BASE_URL:-http://localhost:3000} WARMUP_DURATION=${WARMUP_DURATION:-10} WARMUP_RATE=${WARMUP_RATE:-2} PEAK_RATE=${PEAK_RATE:-8} HOLD_DURATION=${HOLD_DURATION:-20} artillery run scripts/load/workflow-concurrency.yml",
-    "load:workflow:waves": "BASE_URL=${BASE_URL:-http://localhost:3000} WAVE_ONE_DURATION=${WAVE_ONE_DURATION:-10} WAVE_ONE_RATE=${WAVE_ONE_RATE:-6} QUIET_DURATION=${QUIET_DURATION:-5} WAVE_TWO_DURATION=${WAVE_TWO_DURATION:-15} WAVE_TWO_RATE=${WAVE_TWO_RATE:-8} WAVE_THREE_DURATION=${WAVE_THREE_DURATION:-20} WAVE_THREE_RATE=${WAVE_THREE_RATE:-10} artillery run scripts/load/workflow-waves.yml",
-    "load:workflow:isolation": "BASE_URL=${BASE_URL:-http://localhost:3000} ISOLATION_DURATION=${ISOLATION_DURATION:-30} TOTAL_RATE=${TOTAL_RATE:-9} WORKSPACE_A_WEIGHT=${WORKSPACE_A_WEIGHT:-8} WORKSPACE_B_WEIGHT=${WORKSPACE_B_WEIGHT:-1} artillery run scripts/load/workflow-isolation.yml",
+    "load:workflow:baseline": "BASE_URL=${BASE_URL:-http://localhost:3000} WARMUP_DURATION=${WARMUP_DURATION:-10} WARMUP_RATE=${WARMUP_RATE:-2} PEAK_RATE=${PEAK_RATE:-8} HOLD_DURATION=${HOLD_DURATION:-20} bunx artillery@2.0.34 run scripts/load/workflow-concurrency.yml",
+    "load:workflow:waves": "BASE_URL=${BASE_URL:-http://localhost:3000} WAVE_ONE_DURATION=${WAVE_ONE_DURATION:-10} WAVE_ONE_RATE=${WAVE_ONE_RATE:-6} QUIET_DURATION=${QUIET_DURATION:-5} WAVE_TWO_DURATION=${WAVE_TWO_DURATION:-15} WAVE_TWO_RATE=${WAVE_TWO_RATE:-8} WAVE_THREE_DURATION=${WAVE_THREE_DURATION:-20} WAVE_THREE_RATE=${WAVE_THREE_RATE:-10} bunx artillery@2.0.34 run scripts/load/workflow-waves.yml",
+    "load:workflow:isolation": "BASE_URL=${BASE_URL:-http://localhost:3000} ISOLATION_DURATION=${ISOLATION_DURATION:-30} TOTAL_RATE=${TOTAL_RATE:-9} WORKSPACE_A_WEIGHT=${WORKSPACE_A_WEIGHT:-8} WORKSPACE_B_WEIGHT=${WORKSPACE_B_WEIGHT:-1} bunx artillery@2.0.34 run scripts/load/workflow-isolation.yml",
     "build": "bun run build:cli-runtime && bun run build:sandbox-bundles && bun run build:xlsx-worker && NODE_OPTIONS='--max-old-space-size=8192' next build",
     "build:sandbox-bundles": "bun run ./lib/execution/sandbox/bundles/build.ts",
     "build:xlsx-worker": "bun build ./lib/file-parsers/xlsx-worker-entry.ts --target=node --format=esm --packages=bundle --outfile=./dist/xlsx-worker.mjs",
@@ -315,12 +315,15 @@
     "@vitest/coverage-v8": "^5.0.4",
     "@vitest/expect": "5.0.4",
     "@vitest/spy": "5.0.4",
-    "artillery": "2.0.34",
+    "buffer": "5.6.0",
+    "chai": "6.3.0",
     "node-gyp": "12.4.0",
     "postcss": "^8.5.30",
     "postcss-load-config": "6.0.1",
+    "process": "0.11.10",
     "react-email": "6.11.1",
     "tailwindcss": "^4.3.3",
+    "tinyrainbow": "3.2.0",
     "tw-animate-css": "^1.4.0",
     "typescript": "^7.0.2",
     "vitest": "^5.0.4"