chore(deps): electron-builder 26.15.3 (clears a high advisory), audit fix, and the mac-tester pointer - #38
Merged
Merged
Conversation
…it can apply `npm audit` flagged app-builder-lib <= 26.14.0 as high: an uncontrolled search path in the AppImage it builds (GHSA-7g7r-gx96-252g). This project does not ship an AppImage, so the exposure was small, but the fix is a version bump on a dev-only tool and there is no reason to sit on it. Verified rather than assumed, because a build tool that fails at release time fails when it is least convenient: `npm run pack` on Windows against 26.15.3 produced dist/win-unpacked with the asar integrity resource updated and the signing step run, and the advisory is gone from `npm audit`. `npm audit fix` on top clears three brace-expansion DoS advisories that come in transitively through @electron/asar and @electron/universal. Lockfile only. Two high advisories are left and both need a major, so neither belongs in a housekeeping commit: electron itself (<= 40.10.2) and extract-zip underneath it. That upgrade is 11 majors of window behaviour for an overlay app, and it cannot ride on green CI: startInputHook() wraps require('uiohook-napi') in a try/catch with a retry, so a native module that fails to load under a new Electron ABI still boots, still renders, and silently stops reacting to typing.
The mac call linked issue #20, which was written for v0.2.0 under the old repo name and told testers to right-click and Open. That advice is wrong now: those builds were not unsigned but broken-signed, which macOS reports as "damaged" with no override, and the ad-hoc signing that fixed it shipped since. A tester following it would have hit a dead end and concluded the app was broken.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This was referenced Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #36, which went conflicting once #34 and #35 landed on the same lockfile.
electron-builder 25.1.8 → 26.15.3
npm auditflagsapp-builder-lib <= 26.14.0high: an uncontrolled search path in the AppImage it builds (GHSA-7g7r-gx96-252g). This project ships no AppImage, so exposure was small, but it is a dev-only tool and the fix is a bump.Verified, not assumed, because a build tool that breaks at release time breaks when it is least convenient:
npm run packon Windows against 26.15.3 produceddist/win-unpackedwith the asar integrity resource updated and the signing step runnpm auditnpm audit fixClears three
brace-expansionDoS advisories that arrive transitively through@electron/asarand@electron/universal. Lockfile only.The mac-tester line in the README
It pointed at issue #20, written for v0.2.0 under the old repo name, telling testers to right-click and Open. That advice is actively wrong now: those builds were not unsigned but broken-signed, which macOS reports as "damaged" with no override, and the ad-hoc signing that fixed it has shipped since. Anyone following it would have hit a dead end and concluded the app was broken.
What is deliberately NOT here
Two high advisories remain, both needing a major: electron itself (
<= 40.10.2) andextract-zipunderneath it. That is PR #37 (33 → 44), and it cannot ride on green CI.startInputHook()wrapsrequire('uiohook-napi')in a try/catch with a retry, so a native module that fails to load under a new Electron ABI still boots, still renders a frame, and silently stops reacting to typing. Eleven majors of window behaviour for an overlay app that leans on always-on-top levels, workspace visibility and click-through needs a real smoke test, not a rubber stamp.Test plan
npm test214 pass / 4 skipped (the skips are the POSIX-shell iPad tests, which run on the Linux CI job)npm run lintcleannpm run packbuilds a Windows package with the new buildernpm audit: app-builder-lib and brace-expansion gone