1 files changed, 43 insertions, 0 deletions
diff --git a/packaging/win/bump-electron.mjs b/packaging/win/bump-electron.mjs
new file mode 100644
index 0000000..78189bf
--- /dev/null
+++ b/packaging/win/bump-electron.mjs
@@ -0,0 +1,43 @@
+// Bump the pinned Electron to the latest release, in package.json and
+// package-lock.json, and keep the `allowScripts` key matching.
+//
+// Chromium CVEs are fixed in Electron releases; a client built against an old
+// one ships those holes. This is the same policy packaging/build/build-client.sh
+// applies on Linux -- factored out to a file so build-win.ps1 does not have to
+// carry a PowerShell here-string (whose terminator rules make it fragile).
+//
+// Run from packages/meshbay-client. Writes both manifests and exits 0 whether
+// or not a bump happened; exits non-zero only on an actual error. Prints the
+// new version to stdout when it changed, nothing when it did not.
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+
+const pinned = JSON.parse(readFileSync('package-lock.json', 'utf8'))
+  .packages['node_modules/electron'].version;
+
+let latest;
+try {
+  latest = execFileSync('npm', ['view', 'electron', 'version'], { encoding: 'utf8' }).trim();
+} catch {
+  process.stderr.write('npm registry unreachable -- keeping Electron ' + pinned + '\n');
+  process.exit(0);
+}
+
+if (latest === pinned) process.exit(0);
+
+execFileSync('npm', ['install', '--save-dev', '--ignore-scripts', `electron@${latest}`],
+  { stdio: 'inherit' });
+
+const pkg = JSON.parse(readFileSync('package.json', 'utf8'));
+if (pkg.allowScripts) {
+  for (const k of Object.keys(pkg.allowScripts)) {
+    if (k.startsWith('electron@')) {
+      delete pkg.allowScripts[k];
+      pkg.allowScripts[`electron@${latest}`] = true;
+    }
+  }
+  writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
+}
+
+process.stdout.write(latest + '\n');