Repository navigation
chore(deps): upgrade Electron to 42.2.0 - #117
Merged
Merged
Conversation
Major bump from 38.8.6 to 42.2.0, resolving the remaining high-severity audit finding (electron <=39.8.4, 17 advisories). Reviewed Electron breaking changes for v39-42 against our main-process API usage (app, BrowserWindow, ipcMain/Renderer, webContents, session.webRequest, protocol.handle, Menu, dialog, shell, screen, net): no code changes required. None of the removed/deprecated APIs are used. Notes: - leveldown 6.x ships N-API prebuilds (ABI-stable), so no native module rebuild is needed for the new Node ABI. - macOS notifications now use UNNotification (v42): they require a code-signed app to display. Release builds are signed; unsigned dev builds will emit a 'failed' event instead. - nativeWindowOpen webPreference (WindowManager.js) has been a no-op since v22; left as-is, not introduced here. Validated by launching the app on Electron 42: renderer runs un-sandboxed as required by nodeIntegration, leveldown loads, preload initializes correctly.
The app:// protocol handler returned net.fetch() directly, so a request for a missing file produced a rejected handler promise instead of a proper response, surfacing as a net::ERR_FILE_NOT_FOUND error. The handler now always resolves to a Response (404 on a missing file). Also documents build hygiene in the README: a partial webpack build can leave dist/ with a mismatched bundle and source map, which freezes the renderer when DevTools is opened. A clean rebuild resolves it.
quachhung94
pushed a commit
to quachhung94/ODINv2
that referenced
this pull request
Sep 30, 2026
PR syncpoint#117 bumped the `electron` devDependency to 42.2.0 but left electron-builder.yml pinned at `electronVersion: 38.8.0`. That field is the single source of truth for both packaging and the webpack build target (webpack.config.js derives electronXX-* from it), so release builds would have bundled Electron 38 — leaving the audit advisories that syncpoint#117 set out to close still present in shipped artifacts. No released artifact is affected: the Electron 42 bump is in no tagged release (latest, v3.3.0, predates it by ~2 months); this lands before the next release. - electron-builder.yml: electronVersion 38.8.0 -> 42.2.0 - bumping electronVersion surfaced that node-abi@4.26.0 (under @electron/rebuild) cannot detect the Electron 42 ABI, which fails `electron-builder install-app-deps`. Pinned node-abi to ^4.31.0 via overrides. Verified: install-app-deps rebuilds leveldown for Electron 42.2.0, webpack compiles with the electron42.2 target, lint and tests green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades Electron from 38.8.6 to 42.2.0, resolving the last remaining high-severity npm audit finding (
electron <=39.8.4, 17 advisories).Changes
electron38.8.6 → 42.2.0 (package.json^42.2.0)app://protocol handler so it always resolves to aResponse(404 on a missing file) instead of returning a rejectednet.fetch()promise, which surfaced as anet::ERR_FILE_NOT_FOUNDerrorBreaking change review (v39–42)
Reviewed Electron's
breaking-changes.mdfor v39–42 against our main-process API usage (app,BrowserWindow,ipcMain/ipcRenderer,webContents,session.webRequest,protocol.handle,Menu,dialog,shell,screen,net). No code changes required — none of the removed or deprecated APIs are used.Notes:
leveldown6.x ships N-API prebuilds (ABI-stable) — no native module rebuild needed for the new Node ABI.UNNotification(v42) and require a code-signed app to display; release builds are signed, unsigned dev builds emit afailedevent instead.nativeWindowOpenwebPreference has been a no-op since v22 (left as-is).Validation
nodeIntegration,leveldownloads, preload initializes correctly.npm run lint: clean · test suite: 332 passing.Note on the DevTools freeze
While testing, opening Chrome DevTools froze the renderer. Investigation (stack sampling the frozen renderer — main thread blocked in
mach_msg) traced this to a mismatched bundle/source map in a partially builtdist/, not an app-code or Electron 42 defect: a clean rebuild does not freeze, andnpm run hotnever did. There is no freeze-related code fix here — the README now documents the build-hygiene workaround.