[gansx]

Problem

The desktop candidate build stopped in Generate version-matched notices, original licenses and SBOM because the exact installed versions [email protected] and [email protected] (pulled through exceljs -> [email protected]) did not ship license text.

Fix

• Pin ExcelJS's transitive unzipper dependency to 0.11.2, which removes the obsolete binary -> buffers/chainsaw chain and ships its own license material.
• Update the lockfile and remove the now-unused legacy package entries.
• Remove the stale license-policy exceptions for those packages so a regression fails the policy check instead of being silently accepted.
• Add a distribution-material regression test for the dependency boundary.

Validation

• pnpm install --frozen-lockfile --ignore-scripts
• Desktop distribution materials, installer, and native-vendor tests: 29/29 passed
• Daemon deliverables/ExcelJS read-write tests: 10/10 passed
• Dependency security tests passed
• pnpm run check:licenses
• pnpm run check:public
• git diff --check

The local materials run no longer reports buffers or chainsaw gaps. It remains blocked locally only because this workstation does not have the cloud workflow's gstack candidate resources; the cloud build will regenerate those resources before packaging.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-30T10:42:49.015393Z We couldn’t complete this review. Comment @codex review to try again.	0292458	New commits
🔒 Security Review	✅ Completed 2026-10-30T10:51:26.576218Z	0292458	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.