From 271107203d7c4765145b8c7ed48eeb0d07dd6eed Mon Sep 17 00:00:00 2001 From: Kawa Date: Wed, 12 Aug 2026 15:49:55 +0200 Subject: [PATCH] build: update electron to 43 and keep node_modules out of the asar MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Electron 40 is affected by GHSA-9f4c-93c8-jc8g (CVSS 7.2): a sandboxed iframe can bypass the allow-popups restriction through the OpenURL navigation path. Motionity renders no iframes, so the practical exposure was near zero, but Electron only patches its latest three majors — on 40 there would be no fix for the next advisory either. npm audit now reports zero vulnerabilities. electron/main.js needed no changes: it uses only APIs stable across 40 to 43. While verifying the packaged output, the asar turned out to carry @ffmpeg's transitive dependencies (node-fetch, whatwg-url, regenerator-runtime and friends). The app loads the vendored UMD bundle from src/vendor/ffmpeg/ and requires nothing outside electron and node builtins, so build.files now excludes node_modules wholesale instead of naming @ffmpeg — the same result without having to track a dependency tree that is not ours. Verified: electron-builder 26.15.3 packages electron 43.4.0, and the asar contains the five vendored ffmpeg files and zero node_modules entries. Co-Authored-By: Claude Opus 5 (1M context) --- PACKAGING.md | 7 ++++--- package-lock.json | 12 ++++++------ package.json | 4 ++-- 3 files changed, 12 insertions(+), 11 deletions(-) diff --git a/PACKAGING.md b/PACKAGING.md index e24d21b..b4c6726 100644 --- a/PACKAGING.md +++ b/PACKAGING.md @@ -36,9 +36,10 @@ Two consequences worth knowing: Pixabay, Unsplash and Google Fonts requests the editor makes. - The two `@ffmpeg/*` packages are `dependencies`, not `devDependencies`, so the Docker vendor stage can `npm ci --omit=dev` without pulling in electron. That - would make electron-builder bundle them into the asar as well, so - `build.files` excludes `node_modules/@ffmpeg/**` — the copies under - `src/vendor/ffmpeg/` are the ones the app loads. + makes electron-builder want to bundle them into the asar too, so `build.files` + excludes `node_modules/**` outright — the packaged app requires nothing but + `electron` and node builtins, and the copies it loads live in + `src/vendor/ffmpeg/`. The Docker build runs `npm ci` and the vendor step inside the image, so it is the one target where you can skip both locally. diff --git a/package-lock.json b/package-lock.json index 0ebc187..61d5f0b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -13,7 +13,7 @@ "@ffmpeg/ffmpeg": "^0.11.6" }, "devDependencies": { - "electron": "^40.0.0", + "electron": "^43.4.0", "electron-builder": "^26.0.0" } }, @@ -1468,11 +1468,10 @@ } }, "node_modules/electron": { - "version": "40.10.6", - "resolved": "https://registry.npmjs.org/electron/-/electron-40.10.6.tgz", - "integrity": "sha512-TGjlkOU9Lg6K4KjDbsErywCWCIDaNgLh0q+xj0nlpRoQhevI7VBIxBTtJI/V30lypyLAaXMpnP9O9jui1/qRFw==", + "version": "43.4.0", + "resolved": "https://registry.npmjs.org/electron/-/electron-43.4.0.tgz", + "integrity": "sha512-3qxGF0CeQbiox5oWV1JlbWGQ1VerbmDhTFqW4sJ8h7uqTHniFYPObXJcDna0DMh32et0fFyKzz0YY8lJv3t5jg==", "dev": true, - "hasInstallScript": true, "license": "MIT", "dependencies": { "@electron-internal/extract-zip": "^1.0.1", @@ -1480,7 +1479,8 @@ "@types/node": "^24.9.0" }, "bin": { - "electron": "cli.js" + "electron": "cli.js", + "install-electron": "install.js" }, "engines": { "node": ">= 22.12.0" diff --git a/package.json b/package.json index b385129..b3e71b0 100644 --- a/package.json +++ b/package.json @@ -27,7 +27,7 @@ "@ffmpeg/ffmpeg": "^0.11.6" }, "devDependencies": { - "electron": "^40.0.0", + "electron": "^43.4.0", "electron-builder": "^26.0.0" }, "build": { @@ -43,7 +43,7 @@ "scripts/server.cjs", "src/**/*", "!src/**/*.map", - "!node_modules/@ffmpeg/**" + "!node_modules/**" ], "win": { "target": [