From 06dd82aeaeb3a800a72e8f14777cb6a7026b6690 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 3 Sep 2026 09:28:24 +0200 Subject: chore(client): clear 12 npm advisories — electron-builder 26, electron 42.11.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm audit reported 12 findings (11 high, 1 critical), every one transitive and every one reached through electron-builder. The critical was tar (<=7.5.20), a family of path-traversal and symlink-poisoning advisories. electron-builder is a devDependency and build.files is src/** and ui/**, so none of it ships: the exposure was to whoever builds a release, not to users. Real, since a build machine producing signed artefacts is worth attacking, but it should not have been read as "the client has a critical vulnerability". electron-builder ^26.15.3 takes the audit to 0 on its own. It is a major, so it was measured rather than assumed: a --dir Linux build passed before and after, and the config used here (appId, files, linux.target, deb/rpm.depends) is nowhere near where 26's breaking changes are. The produced app.asar is not byte-identical to 25's, which matters only for 18.7's hash-and-compare story and is a release note, not a defect. electron ^42.11.1 is a patch bump inside the range already declared, where Electron ships its security backports. The built binary was launched under xvfb: two processes alive after 25s, empty log. That is the part that counts — test_desktop_shell.py pins the security contract by reading source, so it would stay green through any runtime regression. protobufjs's override floor goes ^7.5.5 -> ^7.6.5. The override itself is load-bearing and must stay: removing it drops castv2-client's protobufjs to 6.11.6, which carries a critical RCE advisory — and unlike everything above, protobufjs ships inside the application. But ^7.5.5 permitted 7.5.5, which is inside a high advisory's range (<=7.6.4); npm happened to resolve 7.6.6, so the protection was incidental rather than structural. Electron 44 is deliberately not taken here: two majors and a different Chromium, and nothing in the suite would notice a regression. It needs its own launch session. Audit and evidence: ~/next/npm-audit.md (not in the repo). Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AbwJDbNTkiRUh7HTWEoyss --- packages/meshbay-client/package.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'packages/meshbay-client/package.json') diff --git a/packages/meshbay-client/package.json b/packages/meshbay-client/package.json index e2ea6ab..7793d78 100644 --- a/packages/meshbay-client/package.json +++ b/packages/meshbay-client/package.json @@ -11,8 +11,8 @@ "dist": "npm run sync-ui && electron-builder --linux deb rpm" }, "devDependencies": { - "electron": "^42.0.0", - "electron-builder": "^25.0.0" + "electron": "^42.11.1", + "electron-builder": "^26.15.3" }, "build": { "appId": "org.meshbay.client", @@ -45,9 +45,9 @@ "castv2-client": "^1.2.0" }, "overrides": { - "protobufjs": "^7.5.5" + "protobufjs": "^7.6.5" }, "allowScripts": { - "electron@42.9.2": true + "electron@42.11.1": true } } -- cgit v1.2.3