Resolve desktop Electron app dependency vulnerabilities#88
Merged
Conversation
The desktop/ Electron app has its own package.json/lockfile that the root npm audit and the audit-js CI job never covered, so 5 advisories (1 moderate, 4 high) went unseen there: Electron context-isolation / window.open / commandLineSwitches issues, form-data CRLF injection, ws memory disclosure/DoS, and follow-redirects header leak. - desktop/package-lock.json: npm audit fix within semver range — electron -> 40.10.6, ws -> 8.21.1, plus transitive form-data / follow-redirects bumps. No package.json range changes; desktop npm audit now reports 0. - ci.yml: audit-js job now also audits desktop/ (npm ci --ignore-scripts skips Electron's binary download, unneeded for an audit) so this manifest can't silently regress. - dependabot.yml: add an npm entry for /desktop; the root entry only watched /, leaving the desktop manifest without update PRs. Root npm audit and pip-audit remain clean (verified on merged main). Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A28CjhQi4MxhZgfAKB4CQh
lukeinthecity
marked this pull request as ready for review
July 22, 2026 00:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sweeps the remaining Dependabot alerts. After #87 merged, the count dropped 118 → 50 — and the 50 were all in a manifest nothing was auditing: the
desktop/Electron app, which has its ownpackage.json/lockfile that the rootnpm audit, the CIaudit-jsjob, and thedependabot.ymlfrom #75 all skipped.The blind spot
desktop/npm auditshowed 5 vulnerable packages (4 high, 1 moderate):window.opentargets,commandLineSwitchesrenderer switch injection, clipboard crash(Dependabot counts every advisory × transitive occurrence, which is why its number for this tree was ~50, not 5.)
Fix
desktop/package-lock.json—npm audit fixwithin semver range: electron → 40.10.6, ws → 8.21.1, plus transitiveform-data/follow-redirectsbumps. Nopackage.jsonrange changes.desktop/npm auditnow reports 0 at all severity levels.ci.yml—audit-jsnow also auditsdesktop/(npm ci --ignore-scriptsskips Electron's ~100 MB binary download, unneeded for an audit), so this manifest can't silently regress the way it just did.dependabot.yml— added annpmentry for/desktop; the root entry only watched/, leaving the desktop manifest with no update PRs.State after this merges
All three dependency-audit surfaces are then clean:
npm audit— 0 (verified on mergedmain)pip-audit— 0 (verified on mergedmain)desktop/npm audit— 0 (this PR)The Dependabot number should collapse toward 0 once it re-scans. Anything that lingers would be an advisory with no available fix — I'll assess those individually if they appear, but there are none across the audit tools right now.
Note: I couldn't fully install/run the Electron app locally (the agent proxy blocks the Electron binary download), so this is verified at the dependency-audit level, not by launching the desktop UI. The lockfile changes are within-range patches, so runtime behavior shouldn't change — but a manual
npm startfromdesktop/on your machine is worth a smoke test before merging.🤖 Generated with Claude Code
https://claude.ai/code/session_01A28CjhQi4MxhZgfAKB4CQh
Generated by Claude Code