build: update electron to 43 and keep node_modules out of the asar

Electron 40 is affected by GHSA-9f4c-93c8-jc8g (CVSS 7.2): a sandboxed iframe
can bypass the allow-popups restriction through the OpenURL navigation path.
Motionity renders no iframes, so the practical exposure was near zero, but
Electron only patches its latest three majors — on 40 there would be no fix for
the next advisory either. npm audit now reports zero vulnerabilities.

electron/main.js needed no changes: it uses only APIs stable across 40 to 43.

While verifying the packaged output, the asar turned out to carry @ffmpeg's
transitive dependencies (node-fetch, whatwg-url, regenerator-runtime and
friends). The app loads the vendored UMD bundle from src/vendor/ffmpeg/ and
requires nothing outside electron and node builtins, so build.files now excludes
node_modules wholesale instead of naming @ffmpeg — the same result without
having to track a dependency tree that is not ours.

Verified: electron-builder 26.15.3 packages electron 43.4.0, and the asar
contains the five vendored ffmpeg files and zero node_modules entries.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PACKAGING.md

@@ -36,9 +36,10 @@ Two consequences worth knowing:
   Pixabay, Unsplash and Google Fonts requests the editor makes.
 - The two `@ffmpeg/*` packages are `dependencies`, not `devDependencies`, so the
   Docker vendor stage can `npm ci --omit=dev` without pulling in electron. That
-  would make electron-builder bundle them into the asar as well, so
+  makes electron-builder want to bundle them into the asar too, so `build.files`
-  `build.files` excludes `node_modules/@ffmpeg/**` — the copies under
+  excludes `node_modules/**` outright — the packaged app requires nothing but
-  `src/vendor/ffmpeg/` are the ones the app loads.
+  `electron` and node builtins, and the copies it loads live in
+  `src/vendor/ffmpeg/`.
 
 The Docker build runs `npm ci` and the vendor step inside the image, so it is
 the one target where you can skip both locally.

package-lock.json

@@ -13,7 +13,7 @@
         "@ffmpeg/ffmpeg": "^0.11.6"
       },
       "devDependencies": {
-        "electron": "^40.0.0",
+        "electron": "^43.4.0",
         "electron-builder": "^26.0.0"
       }
     },
@@ -1468,11 +1468,10 @@
       }
     },
     "node_modules/electron": {
-      "version": "40.10.6",
+      "version": "43.4.0",
-      "resolved": "https://registry.npmjs.org/electron/-/electron-40.10.6.tgz",
+      "resolved": "https://registry.npmjs.org/electron/-/electron-43.4.0.tgz",
-      "integrity": "sha512-TGjlkOU9Lg6K4KjDbsErywCWCIDaNgLh0q+xj0nlpRoQhevI7VBIxBTtJI/V30lypyLAaXMpnP9O9jui1/qRFw==",
+      "integrity": "sha512-3qxGF0CeQbiox5oWV1JlbWGQ1VerbmDhTFqW4sJ8h7uqTHniFYPObXJcDna0DMh32et0fFyKzz0YY8lJv3t5jg==",
       "dev": true,
-      "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
         "@electron-internal/extract-zip": "^1.0.1",
@@ -1480,7 +1479,8 @@
         "@types/node": "^24.9.0"
       },
       "bin": {
-        "electron": "cli.js"
+        "electron": "cli.js",
+        "install-electron": "install.js"
       },
       "engines": {
         "node": ">= 22.12.0"

package.json

@@ -27,7 +27,7 @@
     "@ffmpeg/ffmpeg": "^0.11.6"
   },
   "devDependencies": {
-    "electron": "^40.0.0",
+    "electron": "^43.4.0",
     "electron-builder": "^26.0.0"
   },
   "build": {
@@ -43,7 +43,7 @@
       "scripts/server.cjs",
       "src/**/*",
       "!src/**/*.map",
-      "!node_modules/@ffmpeg/**"
+      "!node_modules/**"
     ],
     "win": {
       "target": [