From bb8280b753755accb58c0e4ae366481c41717c01 Mon Sep 17 00:00:00 2001 From: teknium1 <127238744+teknium1@users.noreply.github.com> Date: Sat, 8 Aug 2026 23:11:12 -0700 Subject: [PATCH] revert(desktop): roll Electron back to 40.10.2 Reverts the Electron portion of 7537de9e74 (40.10.2 -> 40.10.6, GHSA-r4w5-6pfg-jxp5). The bump broke fresh Windows installs: 40.10.3+ swapped install.js's extraction to @electron-internal/extract-zip, an MSVC-built native binding that ERR_DLOPEN_FAILEDs on machines without the VC++ Redistributable (field report Aug 9, fresh VM, confirmed). Security impact of reverting is nil for our code paths: - GHSA-r4w5-6pfg-jxp5 (Moderate 5.9): requires the legacy ProtocolResponse.url API with session-partition isolation; desktop only uses the modern protocol.handle() and no cross-session isolation. Not exposed. - GHSA-9f4c-93c8-jc8g (High 7.2): affects ALL of 40.x with no fixed 40.x release (fix is 41.10.3+); 40.10.2 vs 40.10.6 is a wash. Real mitigation is hardening our setWindowOpenHandler (follow-up PR). allowScripts version-keyed entry moved to electron@40.10.2 so the postinstall (dist download) still runs; allow-scripts-sync vitest suite passes. Electron 41.x major remains deferred/on hold. --- apps/desktop/package.json | 4 +- package-lock.json | 247 +++++++++++++++++++++++--------------- package.json | 2 +- 3 files changed, 156 insertions(+), 97 deletions(-) diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 011ac6d952..7e21884540 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -149,7 +149,7 @@ "bippy": "0.5.43", "concurrently": "10.0.4", "cross-env": "10.1.0", - "electron": "40.10.6", + "electron": "40.10.2", "electron-builder": "26.15.3", "esbuild": "0.28.1", "jsdom": "29.1.1", @@ -162,7 +162,7 @@ "wait-on": "9.0.10" }, "build": { - "electronVersion": "40.10.6", + "electronVersion": "40.10.2", "appId": "com.nousresearch.hermes", "productName": "Hermes", "executableName": "Hermes", diff --git a/package-lock.json b/package-lock.json index 609cd6fa20..362218b973 100644 --- a/package-lock.json +++ b/package-lock.json @@ -156,7 +156,7 @@ "bippy": "0.5.43", "concurrently": "10.0.4", "cross-env": "10.1.0", - "electron": "40.10.6", + "electron": "40.10.2", "electron-builder": "26.15.3", "esbuild": "0.28.1", "jsdom": "29.1.1", @@ -172,6 +172,57 @@ "node": ">=22.22.0" } }, + "apps/desktop/node_modules/@electron/get": { + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/@electron/get/-/get-2.0.3.tgz", + "integrity": "sha512-Qkzpg2s9GnVV2I2BjRksUi43U5e6+zaQMcjoJy0C+C5oxaKl+fmckGDQFtRpZpZV0NQekuZZ+tGz7EA9TVnQtQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "debug": "^4.1.1", + "env-paths": "^2.2.0", + "fs-extra": "^8.1.0", + "got": "^11.8.5", + "progress": "^2.0.3", + "semver": "^6.2.0", + "sumchecker": "^3.0.1" + }, + "engines": { + "node": ">=12" + }, + "optionalDependencies": { + "global-agent": "^3.0.0" + } + }, + "apps/desktop/node_modules/electron": { + "version": "40.10.2", + "resolved": "https://registry.npmjs.org/electron/-/electron-40.10.2.tgz", + "integrity": "sha512-Xj3Hy0Imbu4g0gDIW55w/jJYz94nMO2JRSGYA3LyAn5SwaERCelgZrA21vfH+Bi//SWAWQXddHsMwCqauyMT8g==", + "dev": true, + "hasInstallScript": true, + "license": "MIT", + "dependencies": { + "@electron/get": "^2.0.0", + "@types/node": "^24.9.0", + "extract-zip": "^2.0.1" + }, + "bin": { + "electron": "cli.js" + }, + "engines": { + "node": ">= 12.20.55" + } + }, + "apps/desktop/node_modules/electron/node_modules/@types/node": { + "version": "24.13.3", + "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz", + "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==", + "dev": true, + "license": "MIT", + "dependencies": { + "undici-types": "~7.18.0" + } + }, "apps/desktop/node_modules/ignore": { "version": "7.0.6", "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.6.tgz", @@ -181,6 +232,13 @@ "node": ">= 4" } }, + "apps/desktop/node_modules/undici-types": { + "version": "7.18.2", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz", + "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==", + "dev": true, + "license": "MIT" + }, "apps/shared": { "name": "@hermes/shared", "version": "0.0.0", @@ -1309,16 +1367,6 @@ "react": ">=16.8.0" } }, - "node_modules/@electron-internal/extract-zip": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/@electron-internal/extract-zip/-/extract-zip-1.0.4.tgz", - "integrity": "sha512-Zr1Vs7E9tpCNhZHDAbFVXc2gEVCG9RqPDjrno5+bdgB6LRAuvgyMHJut4NCVyYwtAieapMzc3fiQ3CSTi75ARg==", - "dev": true, - "license": "BSD-2-Clause", - "engines": { - "node": ">=22.12.0" - } - }, "node_modules/@electron/asar": { "version": "3.4.1", "resolved": "https://registry.npmjs.org/@electron/asar/-/asar-3.4.1.tgz", @@ -1450,53 +1498,6 @@ "node": ">= 10.0.0" } }, - "node_modules/@electron/get": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/@electron/get/-/get-5.0.0.tgz", - "integrity": "sha512-pjoBpru1KdEtcExBnuHAP1cAc/5faoedw0hzJkL3o4/IJp7HNF1+fbrdxT3gMYRX2oJfvnA/WXeCTVQpYYxyJA==", - "dev": true, - "license": "MIT", - "dependencies": { - "debug": "^4.1.1", - "env-paths": "^3.0.0", - "graceful-fs": "^4.2.11", - "progress": "^2.0.3", - "semver": "^7.6.3", - "sumchecker": "^3.0.1" - }, - "engines": { - "node": ">=22.12.0" - }, - "optionalDependencies": { - "undici": "^7.24.4" - } - }, - "node_modules/@electron/get/node_modules/env-paths": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz", - "integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==", - "dev": true, - "license": "MIT", - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/@electron/get/node_modules/semver": { - "version": "7.8.5", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", - "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", - "dev": true, - "license": "ISC", - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, "node_modules/@electron/notarize": { "version": "2.5.0", "resolved": "https://registry.npmjs.org/@electron/notarize/-/notarize-2.5.0.tgz", @@ -1834,6 +1835,7 @@ "os": [ "aix" ], + "peer": true, "engines": { "node": ">=18" } @@ -1850,6 +1852,7 @@ "os": [ "android" ], + "peer": true, "engines": { "node": ">=18" } @@ -1866,6 +1869,7 @@ "os": [ "android" ], + "peer": true, "engines": { "node": ">=18" } @@ -1882,6 +1886,7 @@ "os": [ "android" ], + "peer": true, "engines": { "node": ">=18" } @@ -1898,6 +1903,7 @@ "os": [ "darwin" ], + "peer": true, "engines": { "node": ">=18" } @@ -1914,6 +1920,7 @@ "os": [ "darwin" ], + "peer": true, "engines": { "node": ">=18" } @@ -1930,6 +1937,7 @@ "os": [ "freebsd" ], + "peer": true, "engines": { "node": ">=18" } @@ -1946,6 +1954,7 @@ "os": [ "freebsd" ], + "peer": true, "engines": { "node": ">=18" } @@ -1962,6 +1971,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -1978,6 +1988,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -1994,6 +2005,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -2010,6 +2022,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -2026,6 +2039,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -2042,6 +2056,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -2058,6 +2073,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -2074,6 +2090,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -2090,6 +2107,7 @@ "os": [ "linux" ], + "peer": true, "engines": { "node": ">=18" } @@ -2106,6 +2124,7 @@ "os": [ "netbsd" ], + "peer": true, "engines": { "node": ">=18" } @@ -2122,6 +2141,7 @@ "os": [ "netbsd" ], + "peer": true, "engines": { "node": ">=18" } @@ -2138,6 +2158,7 @@ "os": [ "openbsd" ], + "peer": true, "engines": { "node": ">=18" } @@ -2154,6 +2175,7 @@ "os": [ "openbsd" ], + "peer": true, "engines": { "node": ">=18" } @@ -2170,6 +2192,7 @@ "os": [ "openharmony" ], + "peer": true, "engines": { "node": ">=18" } @@ -2186,6 +2209,7 @@ "os": [ "sunos" ], + "peer": true, "engines": { "node": ">=18" } @@ -2202,6 +2226,7 @@ "os": [ "win32" ], + "peer": true, "engines": { "node": ">=18" } @@ -2218,6 +2243,7 @@ "os": [ "win32" ], + "peer": true, "engines": { "node": ">=18" } @@ -2234,6 +2260,7 @@ "os": [ "win32" ], + "peer": true, "engines": { "node": ">=18" } @@ -6611,6 +6638,17 @@ "integrity": "sha512-h8fgEd/DpoS9CBrjEQXR+dIDraopAEfu4wYVNY2tEPwk60stPWhvZMf4Foo5FakuQ7HFZoa8WceaWFervK2Ovg==", "license": "MIT" }, + "node_modules/@types/yauzl": { + "version": "2.10.3", + "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-2.10.3.tgz", + "integrity": "sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==", + "dev": true, + "license": "MIT", + "optional": true, + "dependencies": { + "@types/node": "*" + } + }, "node_modules/@typescript-eslint/eslint-plugin": { "version": "8.64.0", "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.64.0.tgz", @@ -9777,25 +9815,6 @@ "node": ">=0.10.0" } }, - "node_modules/electron": { - "version": "40.10.6", - "resolved": "https://registry.npmjs.org/electron/-/electron-40.10.6.tgz", - "integrity": "sha512-TGjlkOU9Lg6K4KjDbsErywCWCIDaNgLh0q+xj0nlpRoQhevI7VBIxBTtJI/V30lypyLAaXMpnP9O9jui1/qRFw==", - "dev": true, - "hasInstallScript": true, - "license": "MIT", - "dependencies": { - "@electron-internal/extract-zip": "^1.0.1", - "@electron/get": "^5.0.0", - "@types/node": "^24.9.0" - }, - "bin": { - "electron": "cli.js" - }, - "engines": { - "node": ">= 22.12.0" - } - }, "node_modules/electron-builder": { "version": "26.15.3", "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-26.15.3.tgz", @@ -10173,23 +10192,6 @@ "node": ">=6 <7 || >=8" } }, - "node_modules/electron/node_modules/@types/node": { - "version": "24.13.3", - "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz", - "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==", - "dev": true, - "license": "MIT", - "dependencies": { - "undici-types": "~7.18.0" - } - }, - "node_modules/electron/node_modules/undici-types": { - "version": "7.18.2", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz", - "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==", - "dev": true, - "license": "MIT" - }, "node_modules/emoji-regex": { "version": "10.6.0", "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz", @@ -10725,6 +10727,27 @@ "node": ">=0.10.0" } }, + "node_modules/extract-zip": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/extract-zip/-/extract-zip-2.0.1.tgz", + "integrity": "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==", + "dev": true, + "license": "BSD-2-Clause", + "dependencies": { + "debug": "^4.1.1", + "get-stream": "^5.1.0", + "yauzl": "^2.10.0" + }, + "bin": { + "extract-zip": "cli.js" + }, + "engines": { + "node": ">= 10.17.0" + }, + "optionalDependencies": { + "@types/yauzl": "^2.9.1" + } + }, "node_modules/fast-deep-equal": { "version": "3.1.3", "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", @@ -10987,6 +11010,21 @@ } } }, + "node_modules/fs-extra": { + "version": "8.1.0", + "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz", + "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==", + "dev": true, + "license": "MIT", + "dependencies": { + "graceful-fs": "^4.2.0", + "jsonfile": "^4.0.0", + "universalify": "^0.1.0" + }, + "engines": { + "node": ">=6 <7 || >=8" + } + }, "node_modules/fs-minipass": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz", @@ -15391,6 +15429,13 @@ "url": "https://github.com/sponsors/jet2jet" } }, + "node_modules/pend": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz", + "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==", + "dev": true, + "license": "MIT" + }, "node_modules/picocolors": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", @@ -17941,6 +17986,7 @@ "os": [ "darwin" ], + "peer": true, "engines": { "node": "^8.16.0 || ^10.6.0 || >=11.0.0" } @@ -19250,6 +19296,19 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/yauzl": { + "version": "3.4.0", + "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz", + "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==", + "dev": true, + "license": "MIT", + "dependencies": { + "pend": "~1.2.0" + }, + "engines": { + "node": ">=12" + } + }, "node_modules/yocto-queue": { "version": "0.1.0", "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz", diff --git a/package.json b/package.json index b89c014e4b..68661ccfc1 100644 --- a/package.json +++ b/package.json @@ -71,7 +71,7 @@ "node-pty@1.1.0": true, "electron-winstaller@5.4.0": true, "agent-browser@0.26.0": true, - "electron@40.10.6": true, + "electron@40.10.2": true, "fsevents@2.3.2": true, "fsevents@2.3.3": true, "get-windows@9.3.0": true