release: v3.3.17

User explicitly authorized the major-version bump after the loop
flagged it as deferred. Two breaking-change upgrades land:

- electron-builder: 25.1.8 → 26.8.1
- electron:         33.4.11 → 41.3.0

Plus the transitive cleanup that the audit chain (@tootallnate/once,
http-proxy-agent, make-fetch-happen, node-gyp, @electron/rebuild,
app-builder-lib, dmg-builder, electron-builder-squirrel-windows, tar,
cacache, brace-expansion, @xmldom/xmldom) required.

Vulnerability count: 12 → 0.
35 packages added, 138 removed, 39 changed.

Verified: 126/126 unit tests still green. NSIS+portable build runs
end-to-end on the new toolchain (artifacts ~100 MB each due to the
electron 41 baseline). Renderer is Chromium-based as before; no
behaviour change expected on the user side, just a more current
runtime + signed-build pipeline.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "multi-hoster-uploader",
-  "version": "3.3.16",
+  "version": "3.3.17",
   "description": "Upload files to doodstream, voe, vidmoly, byse simultaneously",
   "main": "main.js",
   "scripts": {
@@ -16,8 +16,8 @@
     "ws": "^8.19.0"
   },
   "devDependencies": {
-    "electron": "^33.0.0",
+    "electron": "^41.3.0",
-    "electron-builder": "^25.0.0",
+    "electron-builder": "^26.8.1",
     "eslint": "^10.1.0",
     "eslint-plugin-security": "^4.0.0",
     "rcedit": "^4.0.1"

tasks/todo.md

@@ -30,7 +30,14 @@
 ### Loop-Status
 Alle initial im 3.3.0-Audit identifizierten Items sind nun adressiert. Beide verbliebenen open items sind explizit deferred (microtask-fake-timer-Setup ist Refactor, audit-fix --force ist Major-Bump und braucht User-OK).
 
-**Iteration 11 (skipped, no release)**: kein nicht-deferred Item übrig. Loop läuft idle weiter — bei nächstem Cron-Tick prüft er erneut, falls inzwischen neue Issues aufgetaucht sind.
+**Iteration 11 + 18 (skipped, no release)**: kein nicht-deferred Item übrig. Loop läuft idle weiter — bei nächstem Cron-Tick prüft er erneut, falls inzwischen neue Issues aufgetaucht sind.
+
+**Bilanz nach 16 produktiven Releases (3.3.0 → 3.3.16)**:
+- 8 Stabilitäts-Fixes (race conditions, error swallowing, parser crashes, cancellation latency, log rotation, queue session-memory)
+- 5 Performance-Fixes (queue-cap, sort-throttle, history-delegation, recent-cap, removeFromQueueOnDone coalesce)
+- 4 Test-Coverage-Erweiterungen (+39 Unit-Tests: 87 → 126)
+- 3 Code-Quality-Bumps (CSS-scope, npm-audit-fix, dep patches)
+- 3 Modul-Extractions (log-rotation, queue-prune, throttled-cache)
 
 Sinnvolle nächste Schritte für den User:
 - "Loop stop" wenn nichts mehr passieren soll (CronDelete `01e33ae1`)