chore: release 5.4.1 (#145)

Promote from dev to stable: iOS 27 in the `--ios-version` enum (#131/#134 —
the iPhone 17 devices were already dropped), bplist-parser 0.5 named exports
(#143), the CLA action fork (#135/#136) and the grouped dependency bumps.

`Release-As: 5.4.1` because the promotion commit is a `chore:` and would
otherwise cut no release at all. 5.4.1 rather than the 5.5.0 the iOS 27 `feat:`
would roll, so the stable line matches the beta line already published as
5.4.1-beta.1.

Carries only the source delta — package.json version, CHANGELOG.md and the
release-please manifests stay as release-please left them on production.

Release-As: 5.4.1

Author: finalerock44

.github/workflows/cla.yml

@@ -2,10 +2,23 @@ name: CLA Assistant
 
 # Gates merges on a signed Contributor License Agreement.
 #
-# Uses CLA Assistant Lite (contributor-assistant/github-action): signatures are
-# stored as a JSON file committed to a branch of THIS repo (no third-party
-# service holds the data). Contributors sign by commenting the configured phrase
-# on their PR; the action records it and flips the check green.
+# Uses CLA Assistant Lite: signatures are stored as a JSON file committed to a
+# branch of THIS repo (no third-party service holds the data). Contributors sign
+# by commenting the configured phrase on their PR; the action records it and
+# flips the check green.
+#
+# ACTION SOURCE: devicecloud-dev/cla-assistant-action, our fork of the upstream
+# contributor-assistant/github-action, which was archived read-only on
+# 2026-03-23. We forked because GitHub's Node 20 deprecation began force-running
+# node20 actions on Node 24, under which the upstream step does its work, logs
+# "All contributors have signed the CLA", and THEN exits non-zero — failing a
+# required check on every PR (first hit 2026-09-02, last green 2026-08-31). The
+# fork's only change is `using: node24`; dist is unmodified. See its FORK.md.
+#
+# The fork must stay PUBLIC: this repo is public, and a public repo's workflow
+# cannot resolve an action from a private one — it fails at resolution with
+# "Unable to resolve action ... not found", before any CLA logic runs, even with
+# the org access policy set. Do not flip it private.
 #
 # AUTH: mints a token from the shared automation GitHub App (the same App
 # release-please uses), so signature commits show as the bot and there's no
@@ -50,7 +63,7 @@ jobs:
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
-      - uses: contributor-assistant/github-action@v2.6.1
+      - uses: devicecloud-dev/cla-assistant-action@v2.6.2
         if: env.HAS_APP == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package.json

@@ -8,7 +8,7 @@
     "@clack/prompts": "^1.6.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@supabase/supabase-js": "^2.108.2",
-    "bplist-parser": "^0.3.2",
+    "bplist-parser": "^0.5.0",
     "chalk": "^6.0.0",
     "citty": "^0.2.2",
     "js-yaml": "^5.2.2",
@@ -31,9 +31,9 @@
     "chai": "^6.2.2",
     "eslint": "^10.5.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-unicorn": "^73.0.0",
+    "eslint-plugin-unicorn": "^74.0.0",
     "husky": "^9.1.7",
-    "mocha": "^11.7.6",
+    "mocha": "^12.0.0",
     "prettier": "^3.8.4",
     "shx": "^0.4.0",
     "tsx": "^4.22.4",
@@ -93,7 +93,7 @@
       "fast-xml-parser": ">=5.5.7",
       "flatted": ">=3.4.2",
       "lodash": ">=4.18.0",
-      "@xmldom/xmldom": ">=0.9.10",
+      "@xmldom/xmldom": ">=0.9.12",
       "minimatch@<3.1.4": "3.1.4",
       "minimatch@>=5.0.0 <5.1.8": "5.1.8",
       "minimatch@>=9.0.0 <9.0.7": "9.0.7",
@@ -109,8 +109,9 @@
       "brace-expansion@>=3.0.0 <5.0.9": "5.0.9",
       "ws@>=8.0.0 <8.21.0": "8.21.0",
       "esbuild@<0.28.1": ">=0.28.1",
-      "fast-uri@>=3.0.0 <3.1.5": "3.1.5",
-      "hono@>=4.0.0 <4.12.34": "4.12.34",
+      "qs@<6.16.0": "6.16.0",
+      "fast-uri@>=3.0.0 <3.1.6": "3.1.6",
+      "hono@>=4.0.0 <4.13.5": "4.13.5",
       "micromatch>picomatch": "^2.3.2",
       "tinyglobby>picomatch": "^4.0.4"
     },