fix(deps): keep tar 6 for @electron/rebuild so packaging still works - #39
Conversation
Bumping tar across the 6.x major to clear GHSA-23hp-3jrh-7fpw broke the desktop release. @electron/rebuild does a default import: import tar from 'tar'; tar 6 is CommonJS and satisfies that. tar 7 is ESM with named exports only, so every platform died before it built anything: SyntaxError: The requested module 'tar' does not provide an export named 'default' Pin tar back to ^6.2.1 for @electron/rebuild alone. It is build tooling and never enters the production graph, so `pnpm audit --prod` still reports zero criticals; everything that ships stays on tar 7.5.22. This was missed because `pnpm build` does not invoke electron-builder. Only the package step does, and that runs solely in CI, so the whole pre-commit gauntlet passed on a tree that could not be packaged. Verified this time by running the packaging itself: @electron/rebuild now executes instead of failing to load. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan159 finding(s) HIGH/CRITICAL: 111 | MEDIUM: 48
…and 109 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
1 participant
What broke
The
tar@6 -> ^7.5.19override added in #38 (to clear critical advisory GHSA-23hp-3jrh-7fpw) broke the v0.9.46 desktop release on every platform:@electron/rebuilddefault-importstar. tar 6 is CommonJS and satisfies that; tar 7 is ESM with named exports only.The fix
Pin tar to
^6.2.1for@electron/rebuildalone via a scoped pnpm override. It is build tooling and never enters the production graph, so:pnpm audit --prod --audit-level criticalstill exits 0 (zero criticals)Why CI didn't catch it
Desktop Releaseonly runs on a tag. PR checks runpnpm build, which never invokeselectron-builder— so the full pre-commit gauntlet and all 13 PR checks passed on a tree that could not be packaged.Verification
Ran the packaging locally rather than trusting the build alone.
executing @electron/rebuildnow proceeds instead of failing to load; it stops later only atError: not found: make, a missing local C toolchain (CI installs it).Note:
v0.9.46is unusable — its tag points at the broken lockfile — so this ships as 0.9.47.