kawaandClaude Opus 5
271107203d
Electron 40 is affected by GHSA-9f4c-93c8-jc8g (CVSS 7.2): a sandboxed iframe can bypass the allow-popups restriction through the OpenURL navigation path. Motionity renders no iframes, so the practical exposure was near zero, but Electron only patches its latest three majors — on 40 there would be no fix for the next advisory either. npm audit now reports zero vulnerabilities. electron/main.js needed no changes: it uses only APIs stable across 40 to 43. While verifying the packaged output, the asar turned out to carry @ffmpeg's transitive dependencies (node-fetch, whatwg-url, regenerator-runtime and friends). The app loads the vendored UMD bundle from src/vendor/ffmpeg/ and requires nothing outside electron and node builtins, so build.files now excludes node_modules wholesale instead of naming @ffmpeg — the same result without having to track a dependency tree that is not ours. Verified: electron-builder 26.15.3 packages electron 43.4.0, and the asar contains the five vendored ffmpeg files and zero node_modules entries. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Motionity
This is a fork of the original project aiming to fix issues and add features.
Running it
npm install # ffmpeg.wasm is vendored out of node_modules, so this is required
npm run vendor # downloads the third-party libraries into src/vendor/
npm start # http://127.0.0.1:8080
Three packaged distributions are available — desktop (Windows .exe, Linux
AppImage and Flatpak), a Docker image, and a bare-metal install. Build
instructions for all of them are in PACKAGING.md.
npm run dev # desktop app from source
npm run dist:win # Windows installer + portable exe
npm run dist:linux # AppImage + Flatpak
npm run docker:build # container image
Releasing
./scripts/build-release.ps1 # installers + SHA256SUMS.txt in dist/
./scripts/publish.ps1 -PublishRelease # + image push and Gitea release upload
build-release.ps1 needs no credentials. publish.ps1 needs a Gitea token with
package read/write (image push) and write:repository (release upload), read
from $env:GITEA_TOKEN or prompted for. -BinariesOnly -NoBinaryBuild retries a
failed upload without rebuilding.
One rule applies to every target: browsers expose WebCodecs (the fast exporter)
and IndexedDB (project saving) only in a secure context. http://localhost
qualifies; a plain-HTTP LAN address does not. Serve it over TLS anywhere else.