Files
pgadmin4/pkg/linux
Ashesh Vashi ed9dcf6ebf chore(deps): bump electron 41.5.0 -> 42.1.0 and pin packaged version (#9959)
Bumps the desktop runtime to electron 42 (dependabot PR #9945) and
closes a supply-chain gap in the Linux/Mac packaging scripts that
predated this bump.

Why the bump is safe:

  - macOS UNNotification API change — pgAdmin's runtime does not use
    Electron's Notification API (only a UI toast comment in
    src/js/pgadmin.js:211; no `new Notification(...)` anywhere).
  - postinstall no longer downloads electron — production packaging
    fetches the binary directly via wget from GitHub releases, never
    via electron's postinstall script.
  - Offscreen rendering scale-factor change — no OSR usage anywhere
    in runtime/src/js/.

While verifying, found that pkg/linux/build-functions.sh and
pkg/mac/build-functions.sh resolve the packaged electron version
via:

    ELECTRON_VERSION="$(npm info electron version)"

This pulls whatever currently carries the `latest` dist-tag on the
npm registry. Any newly published electron release — including a
hypothetical malicious one — would land in shipped binaries without
review, regardless of what runtime/package.json pins.

Replace with sed-based extraction from runtime/package.json and
fail loudly if extraction returns empty. The Windows installer
(pkg/win32/installer.iss.in) does not have this issue (it bundles a
pre-built tree, no electron download step).

Net change in runtime/yarn.lock is mostly deletions — electron 42
ships with @electron/get 5.x, which dropped a large transitive
dependency tree associated with the old postinstall download path.

Verified:

  - eslint (runtime): clean (silent)
  - yarn install (runtime): resolved to electron 42.2.0 within
    ^42.1.0 range
  - sed extraction smoke-tested: returns 42.1.0 from current
    runtime/package.json
2026-06-07 12:08:56 +05:30
..
2021-02-09 16:15:13 +00:00

pgAdmin Linux Build Scripts

This directory contains package build scripts and assets that are common to various Linux distributions.

You should not use them directly, but the functionality provided can be used to simplify your own build scripts (typically by sourcing build-functions.sh).