diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f35ed01f..a9cc122e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -145,6 +145,18 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+      # rfd rides into the tree on tauri-plugin-dialog, which pins ^0.16, and we
+      # declare it directly only for the fatal-startup dialog in lib.rs (there is
+      # no AppHandle yet, so the plugin API is unusable at that point). Cargo
+      # unifies features only within a semver-compatible group, so bumping our
+      # direct dep to 0.17 forks rfd in two: the plugin keeps 0.16 with its
+      # backend features, ours gets 0.17 with none, and rfd 0.17's build.rs then
+      # aborts the Linux build demanding `gtk3` or `xdg-portal` (PR #1405). Even
+      # where it links, it just builds rfd twice. Our version must track the
+      # plugin's -- drop this entry once tauri-plugin-dialog moves to 0.17.
+      # Patch updates within 0.16.x still flow through.
+      - dependency-name: "rfd"
+        update-types: ["version-update:semver-minor"]
 
   # GitHub Actions
   - package-ecosystem: github-actions
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index b0a577e4..6d35dc97 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -59,7 +59,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c # v1
+        uses: anthropics/claude-code-action@24dcd50c0568f0fc9e9211213a4fd2d9eb15c4e0 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
diff --git a/Client/src-tauri/Cargo.lock b/Client/src-tauri/Cargo.lock
index 78efa3b7..118f0a5c 100644
--- a/Client/src-tauri/Cargo.lock
+++ b/Client/src-tauri/Cargo.lock
@@ -2472,9 +2472,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "lru-slab"
diff --git a/Client/src-tauri/Cargo.toml b/Client/src-tauri/Cargo.toml
index ee2f18cb..333d4bcd 100644
--- a/Client/src-tauri/Cargo.toml
+++ b/Client/src-tauri/Cargo.toml
@@ -93,6 +93,14 @@ zeroize = "1"
 # Encodes the DPAPI ciphertext for the JSON fallback store. Already in the tree
 # via the tauri/rustls stack, so this costs no extra build.
 base64 = "0.22"
+# Native message box for the fatal-startup path in lib.rs, where the Tauri app
+# never built and tauri-plugin-dialog has no AppHandle to run through. Already
+# in the tree via that same plugin, so this costs no extra build -- but only
+# while the versions match: the plugin pins ^0.16, and Cargo unifies features
+# only within a semver-compatible group. Moving this to 0.17 forks rfd into two
+# crates, and the copy without the plugin's backend features fails rfd 0.17's
+# build.rs on Linux. Pinned to the plugin in .github/dependabot.yml; bump both
+# together or neither.
 rfd = { version = "0.16", default-features = false }
 
 # Desktop-only plugins (no mobile bundle target). single-instance carries the
diff --git a/Client/src/stores/messages.store.ts b/Client/src/stores/messages.store.ts
index f2fe52b9..a4cefaa6 100644
--- a/Client/src/stores/messages.store.ts
+++ b/Client/src/stores/messages.store.ts
@@ -207,7 +207,20 @@ function sanitizePassApprox(s: string): string {
       .replace(/'/g, "'")
       .replace(/ /g, " ")
       .replace(/&/g, "&");
-  const stripTags = (input: string): string => input.replace(/<[^>]*>/g, "");
+  // Repeated rather than a single pass: a lone `replace` can in principle
+  // splice a fresh `<...>` out of the text either side of what it removed.
+  // echoNormalize's own fixpoint loop already absorbed that, so this is
+  // output-identical -- it just puts the repetition where a reader (and
+  // CodeQL's js/incomplete-multi-character-sanitization) can see it.
+  const stripTags = (input: string): string => {
+    let out = input;
+    while (out.includes("<")) {
+      const next = out.replace(/<[^>]*>/g, "");
+      if (next === out) break;
+      out = next;
+    }
+    return out;
+  };
   return unescapeOnce(stripTags(unescapeOnce(s)));
 }