You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The current implementation of ELECTRON_VERSION_CHECK is using a static array for the "latest" versions (see safe_releases.json) - to compare the releases with the electron dependency in package.json (if present).
Ideally, we would want to improve this check in two ways:
Obtain the latest releases from the Electron Github/Website so that a new release won't require an update of this tool. Even better, we could warn the user if the version used is old AND contains security issues (this can be implemented by checking whether there're any [SECURITY] fixes in between releases - https://electronjs.org/releases )
Derive the current Electron version directly from the bundle (asar file), application binary, ...and all other possible ways (instead of just checking package.json). I have some ideas here - talk to @ikkisoft
The text was updated successfully, but these errors were encountered:
Just to clarify, the current safe_releases.json is meant to contain versions that are not affected by known vulnerabilities - and not necessarily the latest versions of each release family.
This file is currently updated manually, but could be done programmatically (assuming Electron releases do always include the [SECURITY] tag)
The current implementation of ELECTRON_VERSION_CHECK is using a static array for the "latest" versions (see
safe_releases.json
) - to compare the releases with the electron dependency in package.json (if present).Ideally, we would want to improve this check in two ways:
The text was updated successfully, but these errors were encountered: