From 004c70ba828b8daeca6d63420f6d55405880583c Mon Sep 17 00:00:00 2001 From: Thomas Halwax Date: Thu, 21 May 2026 15:35:27 +0200 Subject: [PATCH 1/2] fix(build): point electron-builder at Electron 42, fix ABI detection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #117 bumped the `electron` devDependency to 42.2.0 but left electron-builder.yml pinned at `electronVersion: 38.8.0`. That field is the single source of truth for both packaging and the webpack build target (webpack.config.js derives electronXX-* from it), so release builds would have bundled Electron 38 — leaving the audit advisories that #117 set out to close still present in shipped artifacts. No released artifact is affected: the Electron 42 bump is in no tagged release (latest, v3.3.0, predates it by ~2 months); this lands before the next release. - electron-builder.yml: electronVersion 38.8.0 -> 42.2.0 - bumping electronVersion surfaced that node-abi@4.26.0 (under @electron/rebuild) cannot detect the Electron 42 ABI, which fails `electron-builder install-app-deps`. Pinned node-abi to ^4.31.0 via overrides. Verified: install-app-deps rebuilds leveldown for Electron 42.2.0, webpack compiles with the electron42.2 target, lint and tests green. --- electron-builder.yml | 2 +- package-lock.json | 6 +++--- package.json | 3 ++- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/electron-builder.yml b/electron-builder.yml index 7c9f7bae..7c883241 100644 --- a/electron-builder.yml +++ b/electron-builder.yml @@ -52,4 +52,4 @@ publish: - provider: github releaseType: release -electronVersion: 38.8.0 +electronVersion: 42.2.0 diff --git a/package-lock.json b/package-lock.json index 688f7623..11ba54b1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11957,9 +11957,9 @@ } }, "node_modules/node-abi": { - "version": "4.26.0", - "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-4.26.0.tgz", - "integrity": "sha512-8QwIZqikRvDIkXS2S93LjzhsSPJuIbfaMETWH+Bx8oOT9Sa9UsUtBFQlc3gBNd1+QINjaTloitXr1W3dQLi9Iw==", + "version": "4.31.0", + "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-4.31.0.tgz", + "integrity": "sha512-Erq5w/t3syw3s4sDsUaX4QttIdBPsGKTT1DTRsCkTonGggczhlDKm/wDX3o+HPJpQ41EjXCbcmXf0tgr5YZJXw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 20682d67..42d27f4f 100644 --- a/package.json +++ b/package.json @@ -62,7 +62,8 @@ "react": "^18.0.0" }, "serialize-javascript": "^7.0.5", - "diff": "^9.0.0" + "diff": "^9.0.0", + "node-abi": "^4.31.0" }, "dependencies": { "@mdi/js": "^7.0.96", From 03e4e1a6e74f25d48dff9e097a48d2b4f81b370c Mon Sep 17 00:00:00 2001 From: Thomas Halwax Date: Thu, 21 May 2026 15:44:39 +0200 Subject: [PATCH 2/2] fix(build): make the installed electron package the single version source MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit electron-builder.yml's `electronVersion` and the `electron` devDependency were two places holding the Electron version, kept in sync by hand — the drift that the previous commit had to repair. - electron-builder.yml: drop `electronVersion`. With the field absent, electron-builder auto-detects the version from the installed `electron` dependency. - webpack.config.js: derive the build target from `require('electron/package.json').version` instead of parsing electron-builder.yml; drop the now-unused fs and yaml requires. The `electron` dependency is now the only source. Both packaging and the webpack target read it, so they cannot drift apart again. Verified: webpack compiles with the electron42.2 target, electron-builder install-app-deps auto-detects electronVersion=42.2.0. --- electron-builder.yml | 2 -- webpack.config.js | 10 ++++------ 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/electron-builder.yml b/electron-builder.yml index 7c883241..1858b829 100644 --- a/electron-builder.yml +++ b/electron-builder.yml @@ -51,5 +51,3 @@ snap: publish: - provider: github releaseType: release - -electronVersion: 42.2.0 diff --git a/webpack.config.js b/webpack.config.js index bffb5e4f..6a31a7a5 100644 --- a/webpack.config.js +++ b/webpack.config.js @@ -1,15 +1,13 @@ const path = require('path') -const fs = require('fs') const { spawn } = require('child_process') const HtmlWebpackPlugin = require('html-webpack-plugin') const webpack = require('webpack') -const YAML = require('yaml') -// Pick up Electron version [X.Y] from builder configuration: +// Pick up Electron version [X.Y] from the installed electron package. +// This is the single source of truth — electron-builder auto-detects the +// same dependency, so the build target and the packaged runtime cannot drift. const { rendererTarget, mainTarget, preloadTarget } = (() => { - const file = fs.readFileSync('./electron-builder.yml', 'utf8') - const configuration = YAML.parse(file) - const version = configuration.electronVersion.match(/(\d+\.\d+)/)[0] + const version = require('electron/package.json').version.match(/(\d+\.\d+)/)[0] return { rendererTarget: 'electron' + version + '-renderer',