Repository navigation
fix(deps): reduce npm audit findings from 25 to 4 - #43
Merged
Merged
Conversation
Runs npm audit fix without --force, which updates the lockfile only: patch and minor versions of concurrently, shell-quote, axios, undici, nanoid, postcss-selector-parser, smol-toml and their dependents. The audit goes from 25 findings to 12, all from electron-builder 25.1.8 and its dependencies.
Adds npm overrides that move tar from 6.2.1 to 7.5.22 and builder-util-runtime from 9.2.10 to 9.7.0, the versions electron-builder 26 uses. tar is only reached through native module rebuilds, which the build turns off (npmRebuild: false); builder-util-runtime 9.7.0 is already what electron-updater uses. The audit goes from 12 findings to 4. The 4 that remain are one advisory in app-builder-lib 25 itself, about the Linux AppImage it builds. Only electron-builder 26 fixes it, which the install's signing backport (scripts/install/fixBuilderSigning.ts) refuses, and which fails to merge the universal macOS build on node-pty's prebuilt binaries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits, so either can be taken alone:
npm audit fixwithout--force: lockfile only, patch and minorupdates. 25 findings → 12.
tar(6.2.1 → 7.5.22) andbuilder-util-runtime(9.2.10 → 9.7.0), the versions electron-builder 26 uses. 12 → 4,
no critical left.
The 4 that remain are one advisory in app-builder-lib 25 itself
(Linux AppImage, GHSA-7g7r-gx96-252g). Only electron-builder 26 fixes
it. I tried it: the install's signing backport (fixBuilderSigning.ts)
refuses 26, and 26 fails to merge the universal macOS build on
node-pty's prebuilt binaries. I left that upgrade to you.
Tested: the full checks and an unsigned local macOS universal build.
The Windows and Linux packages were not built.