fix: harden the Electron 43 release runtime

Upgrade Electron, electron-builder, and electron-updater to patched versions, align the supported Node.js toolchain, and preserve secure file drops through the context-isolated webUtils bridge.

Cover the Electron 43 file-path migration with a real temporary-file drag-and-drop regression test and retain zero-vulnerability lockfile resolution.

src/preload.ts

@@ -1,4 +1,4 @@
-import { contextBridge, ipcRenderer } from 'electron';
+import { contextBridge, ipcRenderer, webUtils } from 'electron';
 import { CustomClip, MergeGroupItem, MergeGroup, QueueItem, DownloadProgress } from './types';
 
 // Types
@@ -83,6 +83,7 @@ contextBridge.exposeInMainWorld('api', {
     selectFolder: () => ipcRenderer.invoke('select-folder'),
     selectVideoFile: () => ipcRenderer.invoke('select-video-file'),
     selectMultipleVideos: () => ipcRenderer.invoke('select-multiple-videos'),
+    getPathForFile: (file: File): string => webUtils.getPathForFile(file),
     saveVideoDialog: (defaultName: string) => ipcRenderer.invoke('save-video-dialog', defaultName),
     openFolder: (path: string) => ipcRenderer.invoke('open-folder', path),
     openFile: (path: string) => ipcRenderer.invoke('open-file', path),

src/renderer-globals.d.ts

@@ -336,6 +336,7 @@ interface ApiBridge {
     selectFolder(): Promise<string | null>;
     selectVideoFile(): Promise<string | null>;
     selectMultipleVideos(): Promise<string[] | null>;
+    getPathForFile(file: File): string;
     saveVideoDialog(defaultName: string): Promise<string | null>;
     openFolder(path: string): Promise<void>;
     openFile(path: string): Promise<boolean>;

src/renderer-streamers.ts

@@ -402,8 +402,7 @@ function initCutterDragDrop(): void {
         // First video-ish file wins
         const allowed = /\.(mp4|mkv|ts|mov|avi)$/i;
         const file = files.find((f) => allowed.test(f.name)) || files[0];
-        // Electron extends File with .path even with contextIsolation:true
-        const filePath = (file as unknown as { path?: string }).path || '';
+        const filePath = window.api.getPathForFile(file);
         if (!filePath) return;
 
         const loader = (window as unknown as { loadCutterFromPath?: (p: string) => Promise<void> }).loadCutterFromPath;