diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-03 11:25:45 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-03 11:25:45 +0200 |
| commit | 75669dcc4f060733f0fcf3b6de574b8f4630d4a1 (patch) | |
| tree | 4a3d1190374a3dfdc76396de26ac650dd3352a2c /packages/meshbay-client/package-lock.json | |
| parent | dd671eb3647801317736327ab5b7cbfaa05d3866 (diff) | |
| download | meshbay-75669dcc4f060733f0fcf3b6de574b8f4630d4a1.tar.gz | |
chore(client): build against the latest Electron, and stop defining the package twice
Chromium CVEs are fixed in Electron releases, and a client built against
an old one ships those holes to every user. That is a certain harm; a
build that breaks on a new Electron is a repairable one. build-client.sh
now bumps to the latest on every build, prints the comparison, and lets
the build fail if it cannot cope — the failure is the signal to fix, not
a reason to stay behind. It writes package.json and the lockfile on
purpose: the new pin is meant to be committed. A registry it cannot reach
is a warning, not a failure.
Exercised by pinning back to 42.9.2 and building: "==> Electron 42.9.2 ->
44.1.1", exit 0, electron=44.1.1 in the packaged output. Note npm audit
would have said nothing about any of this — Chromium CVEs fixed in
Electron do not reliably reach the npm advisory database.
Separately, package.json declared linux.target [deb, rpm] with its own
deb/rpm depends, so `npm run dist` built a second package under the same
name. The two had drifted: /opt/MeshBay/meshbay-client against
/opt/meshbay-client/meshbay, and Depends: python3-meshbay-common naming
none of the Electron runtime libraries the real DEBIAN/control lists — it
would have installed cleanly and then refused to start. Nothing in the
tree referenced `npm run dist`, which is why the drift was free to
happen. That config is gone, "dist" delegates to build-client.sh, and
test_desktop_shell.py refuses its return.
`--dir` was re-run with no linux block at all: exit 0, same binary
build-client.sh consumes. It needs appId, productName and files, nothing
else.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbwJDbNTkiRUh7HTWEoyss
Diffstat (limited to 'packages/meshbay-client/package-lock.json')
| -rw-r--r-- | packages/meshbay-client/package-lock.json | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/packages/meshbay-client/package-lock.json b/packages/meshbay-client/package-lock.json index 2cf4f09..e86a523 100644 --- a/packages/meshbay-client/package-lock.json +++ b/packages/meshbay-client/package-lock.json @@ -13,7 +13,7 @@ "castv2-client": "^1.2.0" }, "devDependencies": { - "electron": "^42.11.1", + "electron": "^44.1.1", "electron-builder": "^26.15.3" } }, @@ -1568,9 +1568,9 @@ } }, "node_modules/electron": { - "version": "42.11.1", - "resolved": "https://registry.npmjs.org/electron/-/electron-42.11.1.tgz", - "integrity": "sha512-mRYYjGDRWCyU+h4FU/0ruqxL/rXc+h2VCLhTb19KHu18HCUFWQAeFS/mFwnEKT/7GQCwlIHOhHie5ICLPXW6aw==", + "version": "44.1.1", + "resolved": "https://registry.npmjs.org/electron/-/electron-44.1.1.tgz", + "integrity": "sha512-N2WCq2sbOkqQgvXJYx2lS6UiO8bF+Yr67trDnS6JKa2WxTCRQsAjGl57SUtdW9h6r5PlduBFjIhxhgd3dzv1hg==", "dev": true, "license": "MIT", "dependencies": { |