Repository navigation
build(deps-dev): bump electron to 45.0.0 - #2042
Open
BlackHole1 wants to merge 3 commits into
Open
BlackHole1 wants to merge 3 commits into
BlackHole1 wants to merge 3 commits into
Conversation
Electron 42 bundles Node.js 24.19.0, whose libuv reports mangled filenames from `fs.watch()` when the watched directory contains 8.3 short names (libuv/libuv#5010). GitHub Actions sets TEMP to such a path (C:\Users\RUNNER~1\...), so the "watches for the types file to be updated" test in _tests/main/electron-types.spec.ts_ never saw its change event and failed on every Windows run. Electron 45 bundles Node.js 24.22.0, which carries the fix. Electron 44 dropped Windows ia32 and Linux armv7l binaries, so the release workflow no longer builds those targets, and the test and build matrix entries that already ran on arm64 hosts are relabeled arm64. The synchronous `safeStorage` methods are deprecated in Electron 45, so token storage in _src/main/github.ts_ moves to `encryptStringAsync()`, `decryptStringAsync()` and `isAsyncEncryptionAvailable()`. Tokens saved by earlier versions still decrypt, and a token is re-encrypted when `shouldReEncrypt` is reported. Signed-off-by: Kevin Cui <bh@bugs.cc>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on:
|
|
coverage: 87.379% (+0.04%) from 87.341% — build/bump-electron-45 into main |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Member
Author
|
@SocketSecurity ignore npm/electron@45.0.0 |
The `vi.hoisted()` factory is async but was never awaited, so its `import('../utils.js')` raced with the test module's own imports. Under the load of a full parallel run the devmode automock was sometimes not registered in time, `isDevMode` resolved to the real function, and all three tests failed with `mockReturnValue is not a function`. This flaked on Windows and Linux arm64 CI. Awaiting the factory at the top level makes the hoisted import finish before the module imports are evaluated.
Signed-off-by: Kevin Cui <bh@bugs.cc>
Moving to the async `safeStorage` API added an await between reading the stored token and assigning `octokit_`. A sign-out during the startup auth check (for example while a keychain prompt is open) was then undone when decryption resolved, and with `shouldReEncrypt` the deleted credentials file was written back. Sign-in and sign-out now bump `authGeneration_`, and a check that sees it change reports a result the renderer ignores and skips the re-encrypt write. Re-encrypting after a key rotation is now best-effort, so a failed write no longer turns a valid token into a signed-out state. Signed-off-by: Kevin Cui <bh@bugs.cc>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Windows test job has been failing on every PR and on
mainbecause "watches for the types file to be updated" in tests/main/electron-types.spec.ts always times out. Tests run under Electron 42, which bundles Node.js 24.19.0, and that libuv build reports mangled filenames fromfs.watch()when the watched directory path contains 8.3 short names (libuv/libuv#5010, nodejs/node#63638). GitHub Actions setsTEMPtoC:\Users\RUNNER~1\AppData\Local\Temp, sonode-watchreceives something like-abc123\electron.d.tsinstead ofelectron.d.ts, never matches the types file, and never emits the change event. Plain Node.js 24.19.0 hits the same bug as an assertion crash, and the fix landed in Node.js 24.21.0. Electron 42 is still on 24.19.0 in its latest patch, while Electron 45 bundles 24.22.0, so this bumpselectronto^45.0.0.Electron 44 stopped publishing Windows ia32 and Linux armv7l binaries, so the release workflow no longer builds Fiddle for those two targets. The test and build matrix entries labeled armv7l already ran on arm64 hosts and are relabeled arm64, which renames those check runs.
Electron 45 also deprecates the synchronous
safeStoragemethods, so GitHub token storage in src/main/github.ts now usesencryptStringAsync(),decryptStringAsync()andisAsyncEncryptionAvailable(). Tokens written by the old sync API still decrypt with the async one, and the stored token is re-encrypted on a best-effort basis whenshouldReEncryptis reported. Because decryption is now async, a sign-in or sign-out that lands while the startup auth check is decrypting would have been overwritten, so both bumpauthGeneration_and a stale check leaves the newer auth state alone. Both cases have new tests.Verified with
yarn lint,yarn format,yarn tscand the fullyarn test:cion macOS and on Windows with a CI-style shortTEMP. The electron-types test now passes on Windows.The first CI run on this PR also hit an existing flake in tests/main/devtools.spec.ts that fails on Electron 42 too. Its async
vi.hoisted()factory was never awaited, so the dynamic import inside it raced with the module imports and the devmode automock was sometimes not applied under a full parallel run. Awaiting the factory fixes it, and six consecutive full runs on Windows now pass where two of five failed before.