chore(deps): resolve Dependabot alerts (electron, lodash, xmldom)

Bump electron to 39.8.7 (>=39.8.5 per advisories), lodash to 4.18.0, @types/lodash to 4.17.24, and pin @xmldom/xmldom to 0.8.12 via resolutions for transitive plist usage.

Made-with: Cursor

package.json

@@ -31,7 +31,7 @@
     "i18next-browser-languagedetector": "7.1.0",
     "i18next-http-backend": "2.2.2",
     "json-stringify-pretty-compact": "4.0.0",
-    "lodash": "4.17.23",
+    "lodash": "4.18.0",
     "memoizee": "0.4.15",
     "react": "19.1.2",
     "react-ace": "14.0.1",
@@ -130,7 +130,7 @@
     "@electron-forge/maker-zip": "7.8.0",
     "@electron/rebuild": "3.7.2",
     "@reforged/maker-appimage": "5.1.1",
-    "@types/lodash": "4.17.23",
+    "@types/lodash": "4.17.24",
     "@types/memoizee": "0.4.9",
     "@typescript/native-preview": "^7.0.0-dev.20251226.1",
     "@vitejs/plugin-react": "6.0.0",
@@ -145,7 +145,7 @@
     "crypto-browserify": "3.12.1",
     "cz-conventional-changelog": "3.3.0",
     "decompress": "4.2.1",
-    "electron": "36.9.5",
+    "electron": "39.8.7",
     "element-source": "0.0.4",
     "husky": "4.3.8",
     "isomorphic-fetch": "3.0.0",
@@ -190,7 +190,8 @@
     "@remix-run/router": "1.23.2",
     "undici": "7.24.0",
     "diff": "^8.0.3",
-    "lodash": "4.17.23",
+    "lodash": "4.18.0",
+    "@xmldom/xmldom": "0.8.12",
     "seroval": "1.4.1",
     "tar": "7.5.11",
     "yauzl": "3.2.1",