From 5d75235a8e9add4b8724f961d4a7fd40f9e1b0e3 Mon Sep 17 00:00:00 2001 From: dev-hari-prasad Date: Sun, 13 Sep 2026 02:51:10 +0530 Subject: [PATCH] build(win32): pin electron version from runtime/package.json instead of registry latest Make.bat previously queried the npm registry via npm info electron version to determine which Electron binary to download. This pulled whatever release held the latest dist-tag on npm, bypassing review whenever a new version was published upstream. Bring Make.bat in line with pkg/linux/build-functions.sh and pkg/mac/build-functions.sh by reading the pinned version directly out of runtime/package.json, stripping any leading caret, and failing with an explicit error if the version cannot be determined. --- Make.bat | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/Make.bat b/Make.bat index c4f714f5c77..401151912ad 100644 --- a/Make.bat +++ b/Make.bat @@ -311,7 +311,17 @@ REM Main build sequence Ends REM Get a fresh copy of electron. REM WGET - FOR /f "tokens=*" %%i IN ('npm info electron version') DO SET "ELECTRON_VERSION=%%i" + REM Resolve the electron version from runtime/package.json, NOT from + REM `npm info electron version`. The latter fetches whatever currently + REM carries the `latest` dist-tag on the npm registry, which means any + REM newly published electron release lands in shipped binaries without + REM review. Keep the build deterministic and pinned. + SET "ELECTRON_VERSION=" + FOR /f "delims=" %%i IN ('node -p "(require(process.argv[1]).devDependencies?.electron || require(process.argv[1]).dependencies?.electron || '').replace(/^\^/, '')" "%WD%\runtime\package.json"') DO SET "ELECTRON_VERSION=%%i" + IF "%ELECTRON_VERSION%"=="" ( + ECHO ERROR: Could not resolve Electron version from runtime/package.json. + EXIT /B 1 + ) :GET_NW wget https://github.com/electron/electron/releases/download/v%ELECTRON_VERSION%/electron-v%ELECTRON_VERSION%-win32-x64.zip -O "%TMPDIR%\electron-v%ELECTRON_VERSION%-win32-x64.zip"