Electron 32 → 43 - #27
Merged
Merged
Conversation
Electron 32 is out of support (Electron keeps the latest three majors), so the 16 advisories that landed against it in August will never be patched there. 43.3.0 is current. Requires pinning node-abi: 4.26 does not know electron 43, so electron-builder's install-app-deps could not resolve the ABI and refused to rebuild the serialport bindings. That was the only breakage across eleven majors — no source change was needed. The API surface this app uses (app, BrowserWindow, ipcMain/ipcRenderer, contextBridge, shell.openExternal, setWindowOpenHandler) is unchanged, and webPreferences already used the sandbox/contextIsolation defaults Electron has been moving toward. Verified on macOS x64: typecheck, lint, 450 unit tests, all 604 e2e tests (01-main, 02-standalone, 03-presentation, 99-hardware against real devices), electron-builder packaging, and launching the packaged app. The serialport prebuild is a universal binary, so arm64 uses the same binding. Claude-Session: https://claude.ai/code/session_01LJ74fxYgZhmViUJdVxG6mb
This was referenced Aug 27, 2026
Merged
Harted
added a commit
that referenced
this pull request
Aug 27, 2026
Clicking Disconnect raised "Connection closed unexpectedly" next to "Disconnected from server". The close event comes back while close() is still running. The handler read the flag that marks a deliberate close before disconnect() had set it. The flag then stayed set, and suppressed the next close that really was unexpected. Setting it before the close fixes the first. Clearing it in connect() fixes the second. Neither half depends on the transport: a serial port has always lost this race, and a TCP socket loses it on the Electron #27 moves to. That PR cannot land ahead of this one.
Harted
added a commit
that referenced
this pull request
Aug 27, 2026
Clicking Disconnect raised "Connection closed unexpectedly" next to "Disconnected from server". The close event comes back while close() is still running. The handler read the flag that marks a deliberate close before disconnect() had set it. The flag then stayed set, and suppressed the next close that really was unexpected. Setting it before the close fixes the first. Clearing it in connect() fixes the second. Neither half depends on the transport: a serial port has always lost this race, and a TCP socket loses it on the Electron #27 moves to. That PR cannot land ahead of this one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Electron only backports to the last three majors, so what is open on the 32 line will never be patched. Two of those advisories reach a shipped build rather than the build tooling: a use-after-free in offscreen child window paint, and an ASAR integrity bypass through resource modification. Dependabot files them under
developmentbecause electron sits in devDependencies, but electron-builder packs that runtime into the installer, so they arrive on users’ machines all the same.One breakage along the way, visible in
package.json: anode-abipin.What this was waiting on
Not knowing what it would break. That is now measured: lint, typecheck, the unit tests and the full e2e suite are green, in dev and packaged mode, on
ubuntu-22.04,ubuntu-22.04-arm,macos-26,macos-26-intelandwindows-2025.What it drops
LSMinimumSystemVersionmoves 10.15 → 12.0, so Catalina and Big Sur stop getting new versions. Decided: both are years past Apple’s own support window, and v2.2.1 stays downloadable for anyone still there, so nobody loses a working tool.Nothing in the repository states a minimum today — Electron sets it — so nothing breaks by leaving it. But the README's Installation section carries a note per platform, and the manual does the same. That is where a system requirement belongs: release notes are read once, and someone downloading in six months reads neither.
Still worth doing
A look at the app on Windows. The suite passes there; passing and looking right are different questions.
Order
#28 is branched off this one, so it comes after.