mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Ashesh Vashi
ed9dcf6ebf
Bumps the desktop runtime to electron 42 (dependabot PR #9945) and closes a supply-chain gap in the Linux/Mac packaging scripts that predated this bump. Why the bump is safe: - macOS UNNotification API change — pgAdmin's runtime does not use Electron's Notification API (only a UI toast comment in src/js/pgadmin.js:211; no `new Notification(...)` anywhere). - postinstall no longer downloads electron — production packaging fetches the binary directly via wget from GitHub releases, never via electron's postinstall script. - Offscreen rendering scale-factor change — no OSR usage anywhere in runtime/src/js/. While verifying, found that pkg/linux/build-functions.sh and pkg/mac/build-functions.sh resolve the packaged electron version via: ELECTRON_VERSION="$(npm info electron version)" This pulls whatever currently carries the `latest` dist-tag on the npm registry. Any newly published electron release — including a hypothetical malicious one — would land in shipped binaries without review, regardless of what runtime/package.json pins. Replace with sed-based extraction from runtime/package.json and fail loudly if extraction returns empty. The Windows installer (pkg/win32/installer.iss.in) does not have this issue (it bundles a pre-built tree, no electron download step). Net change in runtime/yarn.lock is mostly deletions — electron 42 ships with @electron/get 5.x, which dropped a large transitive dependency tree associated with the old postinstall download path. Verified: - eslint (runtime): clean (silent) - yarn install (runtime): resolved to electron 42.2.0 within ^42.1.0 range - sed extraction smoke-tested: returns 42.1.0 from current runtime/package.json