Release 4.5.1 security dependency and desktop runtime update

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -17,20 +17,20 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 35
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22.12.0
+          node-version-file: '.node-version'
           cache: npm
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - run: npm ci
       - run: npm run test:all
       - run: npm run test:ui-renderer
       - run: powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-release.ps1 -SkipTests
       - run: powershell -NoProfile -ExecutionPolicy Bypass -File scripts/verify-release.ps1
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: uefn-transaction-manager-windows-x64
           path: |

.github/workflows/promote-update.yml

@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22.12.0
+          node-version-file: '.node-version'
           cache: npm
       - run: npm ci
       - name: Verify, promote feeds, and prune obsolete R2 update files

.github/workflows/prune-updates.yml

@@ -20,10 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22.12.0
+          node-version-file: '.node-version'
           cache: npm
       - run: npm ci
       - name: Verify current payload and prune obsolete R2 files

.github/workflows/release.yml

@@ -18,12 +18,12 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22.12.0
+          node-version-file: '.node-version'
           cache: npm
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - run: npm ci
@@ -101,7 +101,7 @@ jobs:
           else {
             gh release create $env:GITHUB_REF_NAME @assets --draft --verify-tag --title "UEFN Transaction Manager $version" --notes-file release-notes.md
           }
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: uefn-transaction-manager-${{ github.ref_name }}-internal-release-metadata
           path: |

.node-version

@@ -0,0 +1 @@
+26.12.1

.npmrc

@@ -0,0 +1 @@
+engine-strict=true

README-USER.txt

@@ -1,4 +1,4 @@
-UEFN TRANSACTION MANAGER 4.5.0
+UEFN TRANSACTION MANAGER 4.5.1
 
 GET STARTED
 

README.md

@@ -1,10 +1,10 @@
 <div align="center">
   <img src="public/uem-mark.svg" alt="UEFN Transaction Manager icon" width="112" height="112">
   <h1>UEFN Transaction Manager</h1>
-  <p>Current release: 4.5.0. Windows installer and portable downloads are available below.</p>
+  <p>Current release: 4.5.1. Windows installer and portable downloads are available below.</p>
   <p><strong>A visual tool for building and managing Fortnite in-island transactions in UEFN.</strong></p>
   <p>
-    <img alt="Version 4.5.0" src="https://img.shields.io/badge/version-4.5.0-24c7dd?style=flat-square">
+    <img alt="Version 4.5.1" src="https://img.shields.io/badge/version-4.5.1-24c7dd?style=flat-square">
     <img alt="Windows" src="https://img.shields.io/badge/platform-Windows-5b8cff?style=flat-square">
     <img alt="UEFN" src="https://img.shields.io/badge/built%20for-UEFN-8b5cf6?style=flat-square">
     <a href="https://discord.gg/playadept"><img alt="ADEPT Discord" src="https://img.shields.io/discord/790712680482603038?label=Discord&logo=discord&logoColor=white&color=5865F2&style=flat-square"></a>

docs/DISTRIBUTION.md

@@ -1,14 +1,14 @@
 # UEFN Transaction Manager distribution and update infrastructure
 
-Transaction Manager 4.5.0 separates human downloads from machine updates and keeps portable upgrades in-place.
+Transaction Manager 4.5.1 separates human downloads from machine updates and keeps portable upgrades in-place.
 
 The cross-project Cloudflare inventory is maintained in the private [ADEPT-Interactive/infrastructure](https://github.com/ADEPT-Interactive/infrastructure) repository. This public document remains limited to the UTM update contract and intentionally contains no account credentials or secret values.
 
-Current supported public release: `v4.5.0`.
+Current supported public release: `v4.5.1`.
 
 ## Current supported release
 
-`v4.5.0` is the current supported public release. `v4.4.1` remains publicly retained as the preceding release. `v4.4.0` remains publicly retained as the prior stabilization baseline; `v4.3.7` remains publicly retained as the prior regression-recovery baseline; `v4.3.6` remains publicly retained as the prior identity-preservation baseline; `v4.3.5` remains publicly retained as the prior renderer baseline; `v4.3.2` remains publicly retained as the earlier portable-updater acceptance baseline. Their tags, releases, and Git history remain intact.
+`v4.5.1` is the current supported public release. `v4.4.1` remains publicly retained as the preceding release. `v4.4.0` remains publicly retained as the prior stabilization baseline; `v4.3.7` remains publicly retained as the prior regression-recovery baseline; `v4.3.6` remains publicly retained as the prior identity-preservation baseline; `v4.3.5` remains publicly retained as the prior renderer baseline; `v4.3.2` remains publicly retained as the earlier portable-updater acceptance baseline. Their tags, releases, and Git history remain intact.
 
 ## Human downloads
 
@@ -34,12 +34,12 @@ A reserved future beta path is `uem/beta/`. The preferred R2 bucket is `adept-so
 
 ```text
 uem/stable/latest.yml
-uem/stable/UEFN-Transaction-Manager-Setup-4.5.0.exe
-uem/stable/UEFN-Transaction-Manager-Setup-4.5.0.exe.blockmap
-uem/stable/manifests/4.5.0.yml
-uem/stable/manifests/portable-4.5.0.json
+uem/stable/UEFN-Transaction-Manager-Setup-4.5.1.exe
+uem/stable/UEFN-Transaction-Manager-Setup-4.5.1.exe.blockmap
+uem/stable/manifests/4.5.1.yml
+uem/stable/manifests/portable-4.5.1.json
 uem/stable/portable-latest.json
-uem/stable/UEFN-Transaction-Manager-4.5.0-Portable.zip
+uem/stable/UEFN-Transaction-Manager-4.5.1-Portable.zip
 ```
 
 After verified promotion, automatic retention removes recognized older release objects from `uem/stable/`, keeping the active payload and feed objects listed above. Newer staged versions and unrecognized keys are preserved. `latest.yml` and `portable-latest.json` are the two mutable pointers; their referenced artifacts remain immutable. Git history and retained GitHub releases provide historical acceptance baselines and manual recovery downloads.
@@ -82,9 +82,9 @@ Before deletion, cleanup reads both mutable feeds directly from R2 and requires
 Preview or retry cleanup of an already published release with the same R2 credentials:
 
 ```powershell
-node scripts/publish-updates.mjs prune --version 4.5.0
+node scripts/publish-updates.mjs prune --version 4.5.1
 # Execute the same verified plan:
-node scripts/publish-updates.mjs prune --version 4.5.0 --apply true
+node scripts/publish-updates.mjs prune --version 4.5.1 --apply true
 ```
 
 The command verifies the public current-release payload before planning and defaults to a dry run. Logs include selected keys, object count, and bytes reclaimable. Successful publication retains approximately one release's payload in R2, plus any newer drafts. Failed drafts newer than the public release are intentionally preserved for separate review.
@@ -107,7 +107,7 @@ The helper uses `region=auto` and the account R2 endpoint. Values are read from
 
 ## Recovery and cutoff
 
-Before promotion, fix staged objects and rerun verification. If a bad mutable manifest is promoted, restore a previously verified manifest only after confirming that its referenced immutable artifacts remain available. Recovery must leave the public stable origin on the last verified payload until a separately authorized release is ready. The retained 4.4.1, 4.4.0, 4.3.7, 4.3.6, 4.3.5, and 4.3.2 public releases are not the stable pointer after 4.5.0 promotion.
+Before promotion, fix staged objects and rerun verification. If a bad mutable manifest is promoted, restore a previously verified manifest only after confirming that its referenced immutable artifacts remain available. Recovery must leave the public stable origin on the last verified payload until a separately authorized release is ready. The retained 4.4.1, 4.4.0, 4.3.7, 4.3.6, 4.3.5, and 4.3.2 public releases are not the stable pointer after 4.5.1 promotion.
 
 The compatibility namespace and updater path continue to support existing installs, including older 4.0.1 clients; the public 4.3.2 release remains only as the explicitly retained updater baseline. New versions use the ADEPT endpoint and retain the established `uem/stable/` path.
 
@@ -122,7 +122,7 @@ The compatibility namespace and updater path continue to support existing instal
 7. Review hashes, unsigned SmartScreen wording, and release notes.
 8. Publish the release only after review; the separate workflow promotes `latest.yml` last.
 
-The installer is unsigned unless a secure Authenticode certificate is supplied through the release environment. The human release notes disclose Windows SmartScreen behavior. Stable 4.5.0 retains the established installer and portable update contracts.
+The installer is unsigned unless a secure Authenticode certificate is supplied through the release environment. The human release notes disclose Windows SmartScreen behavior. Stable 4.5.1 retains the established installer and portable update contracts.
 
 ## Rename compatibility boundary
 

docs/GENERATED_PUBLIC_API_CONTRACT.md

@@ -1,6 +1,6 @@
 # Generated Verse Public API Contract
 
-Status: Current v4.5.0 public release contract.
+Status: Current v4.5.1 public release contract.
 
 This document defines the one supported Verse surface generated by UEFN Transaction Manager. The managed Verse file is regenerated from project data and must not be edited manually. Creator-authored gameplay, save logic, and reward effects belong in the creator's own Verse.
 
@@ -118,7 +118,7 @@ A disposable probe compiled on 42.40 on 2026-10-16 confirmed that native `event.
 
 This does **not** mean callback subscriptions are impossible before 43.00. Epic's [Verse fields event tutorial](https://dev.epicgames.com/community/learning/tutorials/woOK/fortnite-using-verse-fields-events-in-a-umg-user-widget) and the UI template implement them with a spawned recurring `Await()` loop, a callback, and a cancellation event. An equivalent helper specialized to UTM's `tuple(player, int)` payload, exposing a named callback registration method and preserving the private backing event and existing await method, compiled on 42.40 with zero diagnostics. It returns a custom cancellation object; this probe did not establish compatibility with the native `cancelable` interface. A generic helper variant encountered compiler limitation 3502 for that payload, so the template helper should not be assumed to work unchanged in every generated context.
 
-UTM 4.5.0 provides the named callback registration helpers described above, implemented using await tasks without an `event.Subscribe` extension. The generated callbacks and copied integration examples compiled on UEFN 42.40. The existing await API remains available. Compiler acceptance is not evidence of a runtime performance improvement or native 43.00 compatibility.
+UTM 4.5.1 provides the named callback registration helpers described above, implemented using await tasks without an `event.Subscribe` extension. The generated callbacks and copied integration examples compiled on UEFN 42.40. The existing await API remains available. Compiler acceptance is not evidence of a runtime performance improvement or native 43.00 compatibility.
 
 UTM generates private native events and public `Await<Stem>…Event()` methods, with no custom `Subscribe` extension. The announced change does not require renaming or removing those methods. Keep the current contract for existing consumers and 42.x projects.
 

electron/main.ts

@@ -619,10 +619,10 @@ async function showFatalError(error: Error): Promise<void> {
 }
 
 function configureIpc() {
-  ipcMain.handle('uem:clipboard:write-text', (event, text: unknown) => {
+  ipcMain.handle('uem:clipboard:write-text', async (event, text: unknown) => {
     assertTrustedSender(event);
     if (typeof text !== 'string' || text.length > 8 * 1024 * 1024) throw new Error('Clipboard text must be a string of at most 8 MiB.');
-    clipboard.writeText(text);
+    await clipboard.writeText(text);
   });
   ipcMain.handle('uem:editor:reconnect', async event => {
     assertTrustedSender(event);