Electron 40 is affected by GHSA-9f4c-93c8-jc8g (CVSS 7.2): a sandboxed iframe
can bypass the allow-popups restriction through the OpenURL navigation path.
Motionity renders no iframes, so the practical exposure was near zero, but
Electron only patches its latest three majors — on 40 there would be no fix for
the next advisory either. npm audit now reports zero vulnerabilities.
electron/main.js needed no changes: it uses only APIs stable across 40 to 43.
While verifying the packaged output, the asar turned out to carry @ffmpeg's
transitive dependencies (node-fetch, whatwg-url, regenerator-runtime and
friends). The app loads the vendored UMD bundle from src/vendor/ffmpeg/ and
requires nothing outside electron and node builtins, so build.files now excludes
node_modules wholesale instead of naming @ffmpeg — the same result without
having to track a dependency tree that is not ours.
Verified: electron-builder 26.15.3 packages electron 43.4.0, and the asar
contains the five vendored ffmpeg files and zero node_modules entries.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
MP4/GIF export used to importScripts() an 18.5 MB asm.js ffmpeg build from
https://archive.org/download/ffmpeg_asm/ffmpeg_asm.js: no integrity check, no
pinning, executed in the page, and unavailable offline. vendor.mjs now copies
ffmpeg.wasm out of node_modules, where package-lock.json pins it by hash, and
no CDN fallback is left anywhere in the app.
@ffmpeg/core-st is the single-threaded core, chosen deliberately: the default
@ffmpeg/core is built with pthreads and needs SharedArrayBuffer, which requires
COOP/COEP isolation, which would break the Pixabay, Unsplash and Google Fonts
requests. That core also forces two things worth knowing:
- mainName: 'main' is mandatory. The loader defaults to proxy_main, which only
the multi-threaded build exports, so load() compiles all 23 MB and then aborts.
- Its main() calls exit(), so an instance survives exactly one command. Reusing
one dies with "Program terminated with exit(0)", so convertStreams builds and
tears one down per conversion (~110 ms, and the 23 MB heap comes back in
between). The teardown also runs on failure: an interrupted run otherwise
leaves the loader's "running" flag set and wedges every later conversion until
a page reload.
MP4 encodes with libx264 -crf 23 -pix_fmt yuv420p plus AAC rather than
mpeg4 -b:v 6400k. Same core, better quality per byte, and yuv420p is what makes
it play in Safari and QuickTime.
The two @ffmpeg packages are dependencies, not devDependencies, so the Docker
vendor stage can npm ci --omit=dev without pulling in electron; build.files
excludes them from the asar since src/vendor/ffmpeg/ already carries the copies
the app loads. WITH_FFMPEG=0 now means MP4/GIF export is unavailable and says
so, rather than silently fetching an encoder at run time.
Also deletes src/js/libraries/ffmpeg.min.js, an unreferenced ffmpeg.wasm loader
stub that would have fetched its core from unpkg, and prunes the stale
src/vendor/ffmpeg_asm.js from existing checkouts — src/vendor/ is packaged
whole, so it would have shipped 18.5 MB of dead weight in every installer.
Verified in Chromium against a real MediaRecorder WebM: core loads with
crossOriginIsolated false, MP4 24 KB decoding to 320x240 / 2.00 s, GIF 138 KB,
the two back to back, and the missing-core path reporting correctly.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
scripts/build-release.ps1 packages the desktop installers; scripts/publish.ps1
pushes the container image to git.azuze.fr and attaches the installers to the
Gitea release for the same tag. The split keeps a local build free of any
credential, and lets a failed upload be retried with -BinariesOnly
-NoBinaryBuild without paying for the build again.
Two details the plain `npm run dist:*` path gets wrong for a release:
- package.json's global artifactName resolves NSIS and portable to the same
file name, so one silently overwrites the other. The build script passes
distinct -c.nsis.artifactName / -c.portable.artifactName.
- Artifact names now carry the tag, so publish.ps1 can glob exactly one tag's
files and never ship a stale one. electron-builder's update metadata
(.blockmap, latest*.yml, the NSIS .7z payload) is swept out of dist/ so it
cannot match that glob and end up attached to the release.
The tag defaults to v<package.json version> rather than git describe, because
electron-builder stamps package.json into the app: a SHA-based tag would name
an installer whose About box disagrees with it.
Also brings scripts/server.cjs, vendor.mjs and make-icon.cjs under version
control, which the release scripts and the Docker build both call.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kawaandClaude Opus 5