From 75669dcc4f060733f0fcf3b6de574b8f4630d4a1 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 3 Sep 2026 11:25:45 +0200 Subject: chore(client): build against the latest Electron, and stop defining the package twice MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Chromium CVEs are fixed in Electron releases, and a client built against an old one ships those holes to every user. That is a certain harm; a build that breaks on a new Electron is a repairable one. build-client.sh now bumps to the latest on every build, prints the comparison, and lets the build fail if it cannot cope — the failure is the signal to fix, not a reason to stay behind. It writes package.json and the lockfile on purpose: the new pin is meant to be committed. A registry it cannot reach is a warning, not a failure. Exercised by pinning back to 42.9.2 and building: "==> Electron 42.9.2 -> 44.1.1", exit 0, electron=44.1.1 in the packaged output. Note npm audit would have said nothing about any of this — Chromium CVEs fixed in Electron do not reliably reach the npm advisory database. Separately, package.json declared linux.target [deb, rpm] with its own deb/rpm depends, so `npm run dist` built a second package under the same name. The two had drifted: /opt/MeshBay/meshbay-client against /opt/meshbay-client/meshbay, and Depends: python3-meshbay-common naming none of the Electron runtime libraries the real DEBIAN/control lists — it would have installed cleanly and then refused to start. Nothing in the tree referenced `npm run dist`, which is why the drift was free to happen. That config is gone, "dist" delegates to build-client.sh, and test_desktop_shell.py refuses its return. `--dir` was re-run with no linux block at all: exit 0, same binary build-client.sh consumes. It needs appId, productName and files, nothing else. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AbwJDbNTkiRUh7HTWEoyss --- packages/meshbay-client/package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'packages/meshbay-client/package-lock.json') diff --git a/packages/meshbay-client/package-lock.json b/packages/meshbay-client/package-lock.json index 2cf4f09..e86a523 100644 --- a/packages/meshbay-client/package-lock.json +++ b/packages/meshbay-client/package-lock.json @@ -13,7 +13,7 @@ "castv2-client": "^1.2.0" }, "devDependencies": { - "electron": "^42.11.1", + "electron": "^44.1.1", "electron-builder": "^26.15.3" } }, @@ -1568,9 +1568,9 @@ } }, "node_modules/electron": { - "version": "42.11.1", - "resolved": "https://registry.npmjs.org/electron/-/electron-42.11.1.tgz", - "integrity": "sha512-mRYYjGDRWCyU+h4FU/0ruqxL/rXc+h2VCLhTb19KHu18HCUFWQAeFS/mFwnEKT/7GQCwlIHOhHie5ICLPXW6aw==", + "version": "44.1.1", + "resolved": "https://registry.npmjs.org/electron/-/electron-44.1.1.tgz", + "integrity": "sha512-N2WCq2sbOkqQgvXJYx2lS6UiO8bF+Yr67trDnS6JKa2WxTCRQsAjGl57SUtdW9h6r5PlduBFjIhxhgd3dzv1hg==", "dev": true, "license": "MIT", "dependencies": { -- cgit v1.2.3