1 files changed, 43 insertions, 0 deletions
diff --git a/packaging/build/build-client.sh b/packaging/build/build-client.sh
index d42000a..7bac10c 100755
--- a/packaging/build/build-client.sh
+++ b/packaging/build/build-client.sh
@@ -46,6 +46,49 @@ mkdir -p "$ROOT"
 # --- Build the Electron app -----------------------------------------------
 cd "$CLIENT"
 
+# --- Electron: always build against the latest release --------------------
+#
+# Chromium CVEs are fixed in Electron releases, and a client built against an
+# old one ships those holes to every user. That is a certain harm; a build that
+# breaks on a new Electron is a repairable one. So this bumps to the latest on
+# every build and lets the build fail if it cannot cope — the failure is the
+# signal to fix, not a reason to stay behind.
+#
+# It writes package.json and package-lock.json, so the build leaves the repo
+# dirty on purpose: the new pin is meant to be committed. `npm audit` will not
+# tell you any of this — Chromium CVEs fixed in Electron do not reliably reach
+# the npm advisory database, which is why this check exists at all.
+echo "    checking for a newer Electron"
+PINNED=$(node -p "require('./package-lock.json').packages['node_modules/electron'].version" 2>/dev/null || echo "unknown")
+LATEST=$(npm view electron version 2>/dev/null || echo "")
+
+if [ -z "$LATEST" ]; then
+    echo "    !! could not reach the npm registry — building against the pinned Electron $PINNED" >&2
+elif [ "$LATEST" = "$PINNED" ]; then
+    echo "    Electron $PINNED is the latest"
+else
+    echo ""
+    echo "    ==> Electron $PINNED -> $LATEST"
+    echo ""
+    npm install --save-dev --ignore-scripts "electron@$LATEST" 2>&1 | tail -2
+    # allowScripts pins an exact version; leave it matching so npm does not
+    # start refusing a script a future Electron reintroduces.
+    node -e "
+      const fs = require('node:fs');
+      const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+      if (p.allowScripts) {
+        for (const k of Object.keys(p.allowScripts)) {
+          if (k.startsWith('electron@')) {
+            delete p.allowScripts[k];
+            p.allowScripts['electron@$LATEST'] = true;
+          }
+        }
+        fs.writeFileSync('package.json', JSON.stringify(p, null, 2) + '\n');
+      }
+    "
+    echo "    package.json and package-lock.json updated — commit them"
+fi
+
 echo "    npm ci"
 npm ci --ignore-scripts 2>&1 | tail -3