Aller au contenu principal

Introduction à l'historique de l'API (GSoC 2024)

· 7 mins de lecture

L'historique des changements des différentes API Electron sera maintenant détaillé dans la documentation.


Bonjour 👋, je suis Peter, le contributeur Electron pour le Google Summer of Code (GSoC).

Over the course of the GSoC program, I implemented an API history feature for the Electron documentation and its functions, classes, etc. in a similar fashion to the Node.js documentation: by allowing the use of a simple but powerful YAML schema in the API documentation Markdown files and displaying it nicely on the Electron documentation website.

Electron 32.0.0

· 4 mins de lecture

Electron 32.0.0 est disponible ! It includes upgrades to Chromium 128.0.6613.36, V8 12.8, and Node 20.16.0.


L’équipe Electron est heureuse d’annoncer la sortie d’Electron 32.0.0 ! Vous pouvez l'installer avec npm via npm install electron@latest ou le télécharger sur notre site web de téléchargement de version. Vous obtiendrez plus de détails sur cette version en lisant ce qui suit.

Si vous avez des commentaires, veuillez les partager avec nous sur [Twitter] (https://twitter.com/electronjs) ou Mastodon, ou joignez-vous à notre communauté [Discord] (https://discord.com/invite/electronjs)! Les bogues et les demandes de fonctionnalités peuvent être signalés dans l'[outil de suivi des problèmes] d’Electron (https://github.com/electron/electron/issues).

Changements notables

Points clés

  • Added new API version history in our documentation, a feature created by @piotrpdev as part of Google Summer of Code. You can learn more about it in this blog post. #42982
  • Removed nonstandard File.path extension from the Web File API. #42053
  • Aligned failure pathway in Web File System API with upstream when attempting to open a file or directory in a blocked path. #42993
  • Added the following existing navigation-related APIs to webcontents.navigationHistory: canGoBack, goBack, canGoForward, goForward, canGoToOffset, goToOffset, clear. The previous navigation APIs are now deprecated. #41752

Changements de la Stack

Electron 32 upgrades Chromium from 126.0.6478.36 to 128.0.6613.36, Node from 20.14.0 to 20.16.0, and V8 from 12.6 to 12.8.

Nouvelles fonctionnalités

  • Added support for responding to auth requests initiated from the utility process via the app module's 'login' event. #43317
  • Added the cumulativeCPUUsage property to the CPUUsage structure, which returns the total seconds of CPU time used since process startup. #41819
  • Added the following existing navigation related APIs to webContents.navigationHistory: canGoBack, goBack, canGoForward, goForward, canGoToOffset, goToOffset, clear. #41752
  • Extended WebContentsView to accept pre-existing webContents objects. #42086
  • Added a new property prefersReducedTransparency to nativeTheme, which indicates whether the user has chosen to reduce OS-level transparency via system accessibility settings. #43137
  • Aligned failure pathway in File System Access API with upstream when attempting to open a file or directory in a blocked path. #42993
  • Enabled the Windows Control Overlay API on Linux. #42681
  • Enabled zstd compression in network requests. #43300

Changements majeurs avec rupture de compatibilité

Removed: File.path

The nonstandard path property of the Web File object was added in an early version of Electron as a convenience method for working with native files when doing everything in the renderer was more common. However, it represents a deviation from the standard and poses a minor security risk as well, so beginning in Electron 32.0 it has been removed in favor of the webUtils.getPathForFile method.

// Before (renderer)
const file = document.querySelector('input[type=file]');
alert(`Uploaded file path was: ${file.path}`);
// After (renderer)
const file = document.querySelector('input[type=file]');
electron.showFilePath(file);

// After (preload)
const { contextBridge, webUtils } = require('electron');

contextBridge.exposeInMainWorld('electron', {
showFilePath(file) {
// It's best not to expose the full file path to the web content if
// possible.
const path = webUtils.getPathForFile(file);
alert(`Uploaded file path was: ${path}`);
},
});

Deprecated: clearHistory, canGoBack, goBack, canGoForward, goForward, goToIndex, canGoToOffset, goToOffset on WebContents

Navigation-related APIs on WebContents instances are now deprecated. These APIs have been moved to the navigationHistory property of WebContents to provide a more structured and intuitive interface for managing navigation history.

// Deprecated
win.webContents.clearHistory();
win.webContents.canGoBack();
win.webContents.goBack();
win.webContents.canGoForward();
win.webContents.goForward();
win.webContents.goToIndex(index);
win.webContents.canGoToOffset();
win.webContents.goToOffset(index);

// Replace with
win.webContents.navigationHistory.clear();
win.webContents.navigationHistory.canGoBack();
win.webContents.navigationHistory.goBack();
win.webContents.navigationHistory.canGoForward();
win.webContents.navigationHistory.goForward();
win.webContents.navigationHistory.canGoToOffset();
win.webContents.navigationHistory.goToOffset(index);

End of Support for 29.x.y

Electron 29.x.y has reached end-of-support as per the project's support policy. Nous encourageons les développeurs à mettre à jour vers une version plus récente d'Electron et de faire de même avec leurs applications.

E32 (Aug'24)E33 (Oct'24)E34 (Jan'25)
32.x.y33.x.y34.x.y
31.x.y32.x.y33.x.y
30.x.y31.x.y32.x.y

Et maintenant ?

À court terme, vous pouvez compter sur l’équipe pour continuer a se concentrer sur le développement des principaux composants qui composent Electron, notamment Chromium, Node et V8.

You can find Electron's public timeline here.

More information about future changes can be found on the Planned Breaking Changes page.

Electron 31.0.0

· 3 mins de lecture

Electron 31.0.0 est disponible ! It includes upgrades to Chromium 126.0.6478.36, V8 12.6, and Node 20.14.0.


L’équipe Electron est heureuse d’annoncer la sortie d’Electron 31.0.0 ! Vous pouvez l'installer avec npm via npm install electron@latest ou le télécharger sur notre site web de téléchargement de version. Vous obtiendrez plus de détails sur cette version en lisant ce qui suit.

Si vous avez des commentaires, veuillez les partager avec nous sur [Twitter] (https://twitter.com/electronjs) ou Mastodon, ou joignez-vous à notre communauté [Discord] (https://discord.com/invite/electronjs)! Les bogues et les demandes de fonctionnalités peuvent être signalés dans l'[outil de suivi des problèmes] d’Electron (https://github.com/electron/electron/issues).

Changements notables

Points clés

  • Extended WebContentsView to accept pre-existing webContents object. #42319
  • Added support for NODE_EXTRA_CA_CERTS. #41689
  • Updated window.flashFrame(bool) to flash continuously on macOS. #41391
  • Removed WebSQL support #41868
  • nativeImage.toDataURL will preserve PNG colorspace #41610
  • Extended webContents.setWindowOpenHandler to support manual creation of BrowserWindow. #41432

Changements de la Stack

Electron 31 upgrades Chromium from 124.0.6367.49 to 126.0.6478.36, Node from 20.11.1 to 20.14.0, and V8 from 12.4 to 12.6.

Nouvelles fonctionnalités

  • Added clearData method to Session. #40983
    • Added options parameter to Session.clearData API. #41355
  • Added support for Bluetooth ports being requested by service class ID in navigator.serial. #41638
  • Added support for Node's NODE_EXTRA_CA_CERTS environment variable. #41689
  • Extended webContents.setWindowOpenHandler to support manual creation of BrowserWindow. #41432
  • Implemented support for the web standard File System API. #41419
  • Extended WebContentsView to accept pre-existing WebContents instances. #42319
  • Added a new instance property navigationHistory on webContents API with navigationHistory.getEntryAtIndex method, enabling applications to retrieve the URL and title of any navigation entry within the browsing history. #41577 (Also in 29, 30)

Changements majeurs avec rupture de compatibilité

Removed: WebSQL support

Chromium has removed support for WebSQL upstream, transitioning it to Android only. See Chromium's intent to remove discussion for more information.

Behavior Changed: nativeImage.toDataURL will preseve PNG colorspace

PNG decoder implementation has been changed to preserve colorspace data. The encoded data returned from this function now matches it.

See crbug.com/332584706 for more information.

Behavior Changed: win.flashFrame(bool) will flash dock icon continuously on macOS

This brings the behavior to parity with Windows and Linux. Prior behavior: The first flashFrame(true) bounces the dock icon only once (using the NSInformationalRequest level) and flashFrame(false) does nothing. New behavior: Flash continuously until flashFrame(false) is called. This uses the NSCriticalRequest level instead. To explicitly use NSInformationalRequest to cause a single dock icon bounce, it is still possible to use dock.bounce('informational').

Fin du support pour 28.x.y

Electron 28.x.y a atteint la limite pour le support conformément à la politique d'assistance du projet. Nous encourageons les développeurs à mettre à jour vers une version plus récente d'Electron et de faire de même avec leurs applications.

E31 (Jun'24)E32 (Aug'24)E33 (Oct'24)
31.x.y32.x.y33.x.y
30.x.y31.x.y32.x.y
28.x.y29.x.y31.x.y

Et maintenant ?

À court terme, vous pouvez compter sur l’équipe pour continuer a se concentrer sur le développement des principaux composants qui composent Electron, notamment Chromium, Node et V8.

You can find Electron's public timeline here.

More information about future changes can be found on the Planned Breaking Changes page.

Electron 30.0.0

· 4 mins de lecture

Electron 30.0.0 est disponible ! It includes upgrades to Chromium 124.0.6367.49, V8 12.4, and Node.js 20.11.1.


L’équipe Electron est heureuse d’annoncer la sortie d’Electron 30.0.0 ! Vous pouvez l'installer avec npm via npm install electron@latest ou le télécharger sur notre site web de téléchargement de version. Vous obtiendrez plus de détails sur cette version en lisant ce qui suit.

Si vous avez des commentaires, veuillez les partager avec nous sur [Twitter] (https://twitter.com/electronjs) ou Mastodon, ou joignez-vous à notre communauté [Discord] (https://discord.com/invite/electronjs)! Les bogues et les demandes de fonctionnalités peuvent être signalés dans l'[outil de suivi des problèmes] d’Electron (https://github.com/electron/electron/issues).

Changements notables

Points clés

  • ASAR Integrity fuse now supported on Windows (#40504)
    • Existing apps with ASAR Integrity enabled may not work on Windows if not configured correctly. Apps using Electron packaging tools should upgrade to @electron/packager@18.3.1 or @electron/forge@7.4.0.
    • Take a look at our ASAR Integrity tutorial for more information.
  • Added WebContentsView and BaseWindow main process modules, deprecating & replacing BrowserView (#35658)
    • BrowserView is now a shim over WebContentsView and the old implementation has been removed.
    • See our Web Embeds documentation for a comparison of the new WebContentsView API to other similar APIs.
  • Implemented support for the File System API (#41827)

Changements de la Stack

Electron 30 upgrades Chromium from 122.0.6261.39 to 124.0.6367.49, Node from 20.9.0 to 20.11.1, and V8 from 12.2 to 12.4.

Nouvelles fonctionnalités

  • Added a transparent webpreference to webviews. (#40301)
  • Added a new instance property navigationHistory on webContents API with navigationHistory.getEntryAtIndex method, enabling applications to retrieve the URL and title of any navigation entry within the browsing history. (#41662)
  • Added new BrowserWindow.isOccluded() method to allow apps to check occlusion status. (#38982)
  • Added proxy configuring support for requests made with the net module from the utility process. (#41417)
  • Added support for Bluetooth ports being requested by service class ID in navigator.serial. (#41734)
  • Added support for the Node.js NODE_EXTRA_CA_CERTS CLI flag. (#41822)

Changements majeurs avec rupture de compatibilité

Behavior Changed: cross-origin iframes now use Permission Policy to access features

Cross-origin iframes must now specify features available to a given iframe via the allow attribute in order to access them.

See documentation for more information.

Removed: The --disable-color-correct-rendering command line switch

This switch was never formally documented but its removal is being noted here regardless. Chromium itself now has better support for color spaces so this flag should not be needed.

Behavior Changed: BrowserView.setAutoResize behavior on macOS

In Electron 30, BrowserView is now a wrapper around the new WebContentsView API.

Previously, the setAutoResize function of the BrowserView API was backed by autoresizing on macOS, and by a custom algorithm on Windows and Linux. For simple use cases such as making a BrowserView fill the entire window, the behavior of these two approaches was identical. However, in more advanced cases, BrowserViews would be autoresized differently on macOS than they would be on other platforms, as the custom resizing algorithm for Windows and Linux did not perfectly match the behavior of macOS's autoresizing API. The autoresizing behavior is now standardized across all platforms.

If your app uses BrowserView.setAutoResize to do anything more complex than making a BrowserView fill the entire window, it's likely you already had custom logic in place to handle this difference in behavior on macOS. If so, that logic will no longer be needed in Electron 30 as autoresizing behavior is consistent.

Removed: params.inputFormType property on context-menu on WebContents

The inputFormType property of the params object in the context-menu event from WebContents has been removed. Use the new formControlType property instead.

Supprimé : process.getIOCounters()

Chromium has removed access to this information.

Fin du support pour 27.x.y

Electron 27.x.y a atteint la limite pour le support conformément à la politique d'assistance du projet. Nous encourageons les développeurs à mettre à jour vers une version plus récente d'Electron et de faire de même avec leurs applications.

E24 (Avr'24)E31 (Jun'24)E32 (Aug'24)
30.x.y31.x.y32.x.y
29.x.y30.x.y31.x.y
28.x.y29.x.y30.x.y

Et maintenant ?

À court terme, vous pouvez compter sur l’équipe pour continuer a se concentrer sur le développement des principaux composants qui composent Electron, notamment Chromium, Node et V8.

You can find Electron's public timeline here.

More information about future changes can be found on the Planned Breaking Changes page.

Le Google Summer of Code 2024

· 4 mins de lecture

We are excited to announce that Electron has been accepted as a mentoring organization for the 20th edition of Google Summer of Code (GSoC) 2024! Google Summer of Code is a global program focused on bringing new contributors into open source software development.

For more program details, check out Google’s Summer of Code homepage.

About us

Electron is a JavaScript framework for building cross-platform desktop applications using web technologies. The core Electron framework is a compiled binary executable built with Chromium and Node.js, and is mostly written in C++.

Outside of Electron core, we also work on a variety of projects to help sustain the Electron organization, such as:

As a Summer of Code contributor, you would be collaborating with some of Electron’s core contributors on one of many projects under the github.com/electron umbrella.

Before applying

If you aren’t very familiar with Electron, we would recommend you start by reading the documentation and trying out examples in Electron Fiddle.

To learn more about Electron app distribution, you can also play around with Electron Forge by creating a sample application:

npm init electron-app@latest my-app

After familiarizing yourself with the code a bit, come join the conversation on the Electron Discord server.

info

If this is your first time participating in Google Summer of Code or if you’re new to open source in general, we recommend reading Google’s Contributor Guide as a first step before engaging with the community.

Drafting your proposal

Interested in collaborating with Electron? First, check out the seven project idea drafts that we have prepared. Toutes les idées listées sont actuellement ouvertes aux propositions.

Have a different idea you’d like us to consider? We’re also open to accepting new ideas that are not on the proposed project list, but make sure your approach is thoroughly outlined and detailed. When in doubt, we recommend sticking with our listed ideas.

Votre candidature devra inclure :

  • Your proposal: a written document that describes in detail what you plan to achieve over the course of the summer.
  • Votre expérience en tant que développeur. If you have a resume, please include a copy. Otherwise, tell us about your past technical experience.
    • Lack of experience in certain areas won’t disqualify you, but it will help our mentors work out a plan to best support you and make sure your summer project is successful.

A detailed guide of what to submit as part of your Electron application is here. Submit proposals directly to the Google Summer of Code portal. Note that proposals emailed to the Electron team rather than submitted through the application portal will not be considered as a final submission.

If you want more guidance on your proposal or are unsure of what to include, we also recommend that you follow the official Google Summer of Code proposal writing advice here.

Applications open on March 18th, 2024 and close on April 2nd, 2024.

info

Our 2022 Google Summer of Code intern, @aryanshridhar, did an amazing job! If you want to see what Aryan worked on during his summer with Electron, you can read his report in the 2022 GSoC program archives.

Questions?

If you have questions we didn’t address in the blog post or inquiries for your proposal draft, please send us an email at summer-of-code@electronjs.org or check GSoC FAQ!

Ressources

Electron 29.0.0

· 4 mins de lecture

Electron 29.0.0 est disponible ! It includes upgrades to Chromium 122.0.6261.39, V8 12.2, and Node.js 20.9.0.


L’équipe Electron est heureuse d’annoncer la sortie d’Electron 29.0.0 ! Vous pouvez l'installer avec npm via npm install electron@latest ou le télécharger sur notre site web de téléchargement de version. Vous obtiendrez plus de détails sur cette version en lisant ce qui suit.

Si vous avez des commentaires, veuillez les partager avec nous sur [Twitter] (https://twitter.com/electronjs) ou Mastodon, ou joignez-vous à notre communauté [Discord] (https://discord.com/invite/electronjs)! Les bogues et les demandes de fonctionnalités peuvent être signalés dans l'[outil de suivi des problèmes] d’Electron (https://github.com/electron/electron/issues).

Changements notables

Points clés

  • Added a new top-level webUtils module, a renderer process module that provides a utility layer to interact with Web API objects. The first available API in the module is webUtils.getPathForFile. Electron's previous File.path augmentation was a deviation from web standards; this new API is more in line with current web standards behavior.

Changements de la Stack

Electron 29 upgrades Chromium from 120.0.6099.56 to 122.0.6261.39, Node from 18.18.2 to 20.9.0, and V8 from 12.0 to 12.2.

Nouvelles fonctionnalités

  • Added new webUtils module, a utility layer to interact with Web API objects, to replace File.path augmentation. #38776
  • Added net module to utility process. #40890
  • Added a new Electron Fuse, grantFileProtocolExtraPrivileges, that opts the file:// protocol into more secure and restrictive behaviour that matches Chromium. #40372
  • Added an option in protocol.registerSchemesAsPrivileged to allow V8 code cache in custom schemes. #40544
  • Migrated app.{set|get}LoginItemSettings(settings) to use Apple's new recommended underlying framework on macOS 13.0+. #37244

Changements majeurs avec rupture de compatibilité

Behavior Changed: ipcRenderer can no longer be sent over the contextBridge

Attempting to send the entire ipcRenderer module as an object over the contextBridge will now result in an empty object on the receiving side of the bridge. This change was made to remove / mitigate a security footgun. You should not directly expose ipcRenderer or its methods over the bridge. Instead, provide a safe wrapper like below:

contextBridge.exposeInMainWorld('app', {
onEvent: (cb) => ipcRenderer.on('foo', (e, ...args) => cb(args)),
});

Removed: renderer-process-crashed event on app

The renderer-process-crashed event on app has been removed. Use the new render-process-gone event instead.

// Removed
app.on('renderer-process-crashed', (event, webContents, killed) => {
/* ... */
});

// Replace with
app.on('render-process-gone', (event, webContents, details) => {
/* ... */
});

Removed: crashed event on WebContents and <webview>

The crashed events on WebContents and <webview> have been removed. Use the new render-process-gone event instead.

// Removed
win.webContents.on('crashed', (event, killed) => {
/* ... */
});
webview.addEventListener('crashed', (event) => {
/* ... */
});

// Replace with
win.webContents.on('render-process-gone', (event, details) => {
/* ... */
});
webview.addEventListener('render-process-gone', (event) => {
/* ... */
});

Removed: gpu-process-crashed event on app

The gpu-process-crashed event on app has been removed. Use the new child-process-gone event instead.

// Removed
app.on('gpu-process-crashed', (event, killed) => {
/* ... */
});

// Replace with
app.on('child-process-gone', (event, details) => {
/* ... */
});

Fin du support pour 26.x.y

Electron 26.x.y a atteint la limite pour le support conformément à la politique d'assistance du projet. Nous encourageons les développeurs à mettre à jour vers une version plus récente d'Electron et de faire de même avec leurs applications.

E29 (Fev'24)E24 (Avr'24)E31 (Jun'24)
29.x.y30.x.y31.x.y
28.x.y29.x.y30.x.y
27.x.y28.x.y29.x.y

Et maintenant ?

Did you know that Electron recently added a community Request for Comments (RFC) process? If you want to add a feature to the framework, RFCs can be a useful tool to start a dialogue with maintainers on its design. You can also see upcoming changes being discussed in the Pull Requests. To learn more, check out our Introducing electron/rfcs blog post, or check out the README of the electron/rfcs repository directly.

À court terme, vous pouvez compter sur l’équipe pour continuer a se concentrer sur le développement des principaux composants qui composent Electron, notamment Chromium, Node et V8.

You can find Electron's public timeline here.

More information about future changes can be found on the Planned Breaking Changes page.

Introducing electron/rfcs

· 3 mins de lecture

Electron’s API Working Group is adopting an open Requests for Comments (RFC) process to help shepherd larger changes to Electron core.

Why RFCs?

In short, we want to smooth out the process of landing significant changes to Electron core.

Currently, new code changes are mostly discussed through issues and pull requests on GitHub. For most changes to Electron, this is a good system. Many bug fixes, documentation changes, and even new features are straightforward enough to review and merge asynchronously through standard GitHub flows.

For changes that are more significant—for instance, large API surfaces or breaking changes that would affect the majority of Electron apps—it makes sense for review to happen at the ideation stage before most of the code is written.

This process is designed to be open to the public, which will also make it easier for the open source community at large to give feedback on potential changes before they land in Electron.

Comment ça marche ?

The entire RFC process lives in the electron/rfcs repository on GitHub. The steps are described in detail in the repository README.

In brief, an RFC is Proposed once a PR is made to the electron/rfcs repository. A Proposed RFC becomes:

  • Active when the PR is merged into the main branch of the repository, which means that Electron maintainers are amenable to an implementation in electron/electron, or
  • Declined if the PR is ultimately rejected.
info

For the RFC to become Active, the PR must be approved by at least 2 API Working Group members. Before merging, the RFC should be presented synchronously and accepted unanimously by a quorum of at least two-thirds of the WG members. If consensus is reached, a one-month final comment period will be triggered, after which the PR will be merged.

An Active RFC is Completed if the implementation has been merged into electron/electron.

Who can participate?

Anyone in the Electron community can submit RFCs or leave feedback on the electron/rfcs repository!

We wanted to make this process a two-way dialogue and encourage community participation to get a diverse set of opinions from Electron apps that might consume these APIs in the future. If you’re interested in leaving feedback on currently proposed RFCs, the Electron maintainers have already created a few:

Credits

Electron's RFC process was modeled on many established open source RFC processes. Inspiration for many ideas and major portions of copywriting go to:

Déclaration concernant les CVEs "runAsNode"

· 4 mins de lecture

Earlier today, the Electron team was alerted to several public CVEs recently filed against several notable Electron apps. The CVEs are related to two of Electron’s fuses - runAsNode and enableNodeCliInspectArguments - and incorrectly claim that a remote attacker is able to execute arbitrary code via these components if they have not been actively disabled.

We do not believe that these CVEs were filed in good faith. First of all, the statement is incorrect - the configuration does not enable remote code execution. Secondly, companies called out in these CVEs have not been notified despite having bug bounty programs. Lastly, while we do believe that disabling the components in question enhances app security, we do not believe that the CVEs have been filed with the correct severity. “Critical” is reserved for issues of the highest danger, which is certainly not the case here.

Anyone is able to request a CVE. While this is good for the overall health of the software industry, “farming CVEs” to bolster the reputation of a single security researcher is not helpful.

That said, we understand that the mere existence of a CVE with the scary critical severity might lead to end user confusion, so as a project, we’d like to offer guidance and assistance in dealing with the issue.

Comment cela pourrait-il avoir un impact pour moi?

After reviewing the CVEs, the Electron team believes that these CVEs are not critical.

An attacker needs to already be able to execute arbitrary commands on the machine, either by having physical access to the hardware or by having achieved full remote code execution. This bears repeating: The vulnerability described requires an attacker to already have access to the attacked system.

Chrome, for example, does not consider physically-local attacks in their threat model:

We consider these attacks outside Chrome's threat model, because there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your device as you, or who can run software with the privileges of your operating system user account. Such an attacker can modify executables and DLLs, change environment variables like PATH, change configuration files, read any data your user account owns, email it to themselves, and so on. Such an attacker has total control over your device, and nothing Chrome can do would provide a serious guarantee of defense. This problem is not special to Chrome ­— all applications must trust the physically-local user.

The exploit described in the CVEs allows an attacker to then use the impacted app as a generic Node.js process with inherited TCC permissions. So if the app, for example, has been granted access to the address book, the attacker can run the app as Node.js and execute arbitrary code which will inherit that address book access. This is commonly known as a “living off the land” attack. Attackers usually use PowerShell, Bash, or similar tools to run arbitrary code.

Suis-je impacté?

Par défaut, toutes les versions publiées d'Electron ont les fonctionnalités runAsNode et enableNodeCliInspectArguments activées. If you have not turned them off as described in the Electron Fuses documentation, your app is equally vulnerable to being used as a “living off the land” attack. Again, we need to stress that an attacker needs to already be able to execute code and programs on the victim’s machine.

Atténuation

La façon la plus simple d'atténuer ce problème est de désactiver le fusible runAsNode dans votre application Electron. Le fuse runAsNode acitve ou désactive le respect de la variable d'environnement ELECTRON_RUN_AS_NODE. Please see the Electron Fuses documentation for information on how to toggle theses fuses.

Please note that if this fuse is disabled, then process.fork in the main process will not function as expected as it depends on this environment variable to function. Instead, we recommend that you use Utility Processes, which work for many use cases where you need a standalone Node.js process (like a Sqlite server process or similar scenarios).

Vous pouvez trouver plus d'informations sur les meilleures pratiques de sécurité que nous recommandons pour les applications Electron dans notre Liste de contrôle de sécurité.

Electron 28.0.0

· 4 mins de lecture

Electron 28.0.0 est disponible ! Il inclut des mises à jour vers Chromium 120.0.6099.56, V8 12.0, et Node.js 18.18.2.


L’équipe Electron est heureuse d’annoncer la sortie d’Electron 28.0.0 ! Vous pouvez l'installer avec npm via npm install electron@latest ou le télécharger sur notre site web de téléchargement de version. Vous obtiendrez plus de détails sur cette version en lisant ce qui suit.

Si vous avez des commentaires, veuillez les partager avec nous sur [Twitter] (https://twitter.com/electronjs) ou Mastodon, ou joignez-vous à notre communauté [Discord] (https://discord.com/invite/electronjs)! Les bogues et les demandes de fonctionnalités peuvent être signalés dans l'[outil de suivi des problèmes] d’Electron (https://github.com/electron/electron/issues).

Changements notables

Points clés

  • Support implémenté pour les modules ECMAScript ou ESM (Que sont les modules ECMAScript ? en apprendre plus ici. Cela inclut la prise en charge de ESM dans Electron proprement dit, ainsi que certains domaines tels que les points d'entrée de l'API UtilityProcess. Voir notre documentation sur le MES pour plus de détails.
  • En plus de l'activation du support ESM dans Electron, Electron Forge supportera désormais également l'utilisation d'ESM pour empaqueter, compiler et développer des applications Electron. Vous pouvez profiter de ce support dans Forge v7.0.0 et au delà.

Changements de la Stack

Nouvelles fonctionnalités

  • Prise en charge ESM activée. #37535
  • Ajout de points d'entrée ESM à l'API UtilityProcess. #40047
  • Ajout de plusieurs propriétés à l'objet display y compris detected, maximumCursorSize, et nativeOrigin. #40554
  • Ajout du support de la variable d'environnement ELECTRON_OZONE_PLATFORM_HINT sous Linux. #39792

Changements majeurs avec rupture de compatibilité

Comportement modifié : L'affectation à false de WebContents.backgroundThrottling affecte tous les WebContents de la BrowserWindow hote

WebContents.backgroundThrottling défini à false désactivera la limitation des images dans l' BrowserWindow pour tous les WebContents qu'elle affichera.

Supprimé : BrowserWindow.setTrafficLightPosition(position)

BrowserWindow.setTrafficLightPosition(position) a été supprimé, l'API BrowserWindow.setWindowButtonPosition(position) doit être utilisé à loa place qui pprend null à la place de { x: 0, y: 0 } pour réinitialiser la position à celle par défaut du système.

// Supprimé dans Electron 28
win.setTrafficLightPosition({ x: 10, y: 10 })
win.setTrafficLightPosition({ x: 0, y: 0 })

// A remplacer par
win.setWindowButtonPosition({ x: 10, y: 10 })
win.setWindowButtonPosition(null);

Supprimé : BrowserWindow.setTrafficLightPosition(position)

BrowserWindow.getTrafficLightPosition() a été déprécié, l’API BrowserWindow.getWindowButtonPosition() doit être utilisée à la place, celle-ci retourne null au lieu de { x: 0, y: 0 } en absence de position personnalisée.

// Supprimé dans Electron 28
const pos = win.getTrafficLightPosition();
if (pos. === 0 && pos.y === 0) {
// Aucune position personnalisée.
}

// Remplacer par
const ret = win. etWindowButtonPosition();
if (ret === null) {
// Pas de position personnalisée.
}

Supprimé: ipcRenderer.sendTo()

La méthode ipcRenderer.sendTo() a été supprimée. It should be replaced by setting up a MessageChannel between the renderers.

The senderId and senderIsMainFrame properties of IpcRendererEvent have been removed as well.

Supprimé : app.runningUnderRosettaTranslation

The app.runningUnderRosettaTranslation property has been removed. Use app.runningUnderARM64Translation instead.

// Supprimé
console.log(app.runningUnderRosettaTranslation)
// A remplacer par
console.log(app.runningUnderARM64Translation);

Fin du support pour 25.x.y

Electron 25.x.y a atteint la limite pour le support conformément à la politique d'assistance du projet. Nous encourageons les développeurs à mettre à jour vers une version plus récente d'Electron et de faire de même avec leurs applications.

E28 (Dec'23)E29 (Fev'24)E24 (Avr'24)
28.x.y29.x.y30.x.y
27.x.y28.x.y29.x.y
26.x.y27.x.y28.x.y

Et maintenant ?

À court terme, vous pouvez compter sur l’équipe pour continuer a se concentrer sur le développement des principaux composants qui composent Electron, notamment Chromium, Node et V8.

You can find Electron's public timeline here.

More information about future changes can be found on the Planned Breaking Changes page.

Récapitulation de l’écosystème 2023

· 6 mins de lecture

Réflexion à propos des améliorations et changements intervenu dans l’écosystème des développeurs d’Electron en 2023.


Au cours des derniers mois, nous avons concocté plusieurs changements dans l’écosystème Electron pour booster l’expérience des développeurs pour les applications Electron ! Voici un rapide aperçu des derniers ajouts en direct du siège d’Electron.

Forge Electron 7 et au-delà

Electron Forge 7— nouvelle version majeure de notre outil tout-en-un pour l’empaquetage et la distribution des applications Electron, est maintenant disponible.

Alors que Forge 6 était une réécriture complète de la v5, la v7 a une portée plus réduite, mais contient toujours quelques modifications de rupture. À l’avenir, nous continuerons à publier des versions majeures de Forge car des modifications de rupture doivent être apportées.

Pour plus de détails, consultez la version 7.0.0 de Forge sur GitHub.

Dernières modifications

  • Switched to notarytool for macOS notarization: As of 2023-11-01, Apple sunset the legacy altool for macOS notarization, and this release removes it from Electron Forge entirely.
  • Minimum Node.js increased to v16.4.0: With this release, we’ve set the minimum required Node.js version to 16.4.0.
  • Dropped support for electron-prebuilt and electron-prebuilt-compile: electron-prebuilt was the original name for Electron’s npm module, but was replaced by electron in v1.3.1. electron-prebuilt-compile was an alternative to that binary that came with enhanced DX features, but was eventually abandoned as a project.

Points clés

  • Google Cloud Storage publisher : Dans le cadre de nos efforts pour mieux soutenir la mise à jour automatique statique, Electron Forge prend maintenant en charge la publication directement dans Google Cloud Storage!
  • ESM forge.config.js support: Electron Forge prend désormais en charge les fichiers ESM `forge.config.js. (P.S. Nous attendons avec impatience le support des points d'entrée ESM dans Electron 28. )
  • Les fabricants fonctionnent maintenant en parallèle: Dans Electron Forge 6, les makers s'exécutaient séquentiellement pour ✨ raisons historiques héritées ✨ . Since then, we’ve tested out parallelization for the Make step with no adverse side effects, so you should see a speed-up when building multiple targets for the same platform!
Merci !

🙇 Un grand merci à mahnunchik pour ses contributions au support de GCS Publisher et de l'ESM dans les configurations Forge!

Amélioration des mises à jour automatiques pour stockage statique

Squirrel.Windows and Squirrel.Mac are platform-specific updater technologies that back Electron’s built-in autoUpdater module. Both projects support auto updates via two methods:

  • A Squirrel-compatible update server
  • A manifest URL hosted on a static storage provider (e.g. AWS, Google Cloud Platform, Microsoft Azure, etc.)

The update server method has traditionally been the recommended approach for Electron apps (and provides additional customization of update logic), but it has a major downside—it requires apps to maintain their own server instance if they are closed-source.

On the other hand, the static storage method has always been possible, but was undocumented within Electron and poorly supported across Electron tooling packages.

With some great work from @MarshallOfSound, the update story for serverless automatic app updates has been drastically streamlined:

  • Electron Forge’s Zip and Squirrel.Windows makers can now be configured to output autoUpdater-compatible update manifests.
  • A new major version of update-electron-app (v2.0.0) can now read these generated manifests as an alternative to the update.electronjs.org server.

Once your Makers and Publishers are configured to upload update manifests to cloud file storage, you can enable auto updates with only a few lines of configuration:

const { updateElectronApp, UpdateSourceType } = require('update-electron-app');

updateElectronApp({
updateSource: {
type: UpdateSourceType.StaticStorage,
baseUrl: `https://my-manifest.url/${process.platform}/${process.arch}`,
},
});
Further reading

📦 Want to learn more? For a detailed guide, see Forge’s auto update documentation.

L’univers étendu « @electron/

Au débuts d'Electron, la communauté a publié de nombreux packages pour améliorer l’expérience de développement, d’empaquetage et de distribution d’applications Electron. Au fil du temps, bon nombre de ces paquets ont été incorporés dans l'organisation GitHub d'Electron, l'équipe principale assumant le fardeau de la maintenance.

En 2022, nous avons commencé à unifier tous ces outils sous l’espace de noms « @electron/» sur npm. Ce changement signifie que les paquets qui étaient dans « electron-foo » sont maintenantsur npm dans « @electron/foo » et les dépôts qui étaient nommés « electron/electron-foo » sont maintenant « electron/foo » sur GitHub. Ces changements aident à délimiter clairement les projets initiaux des projets du userland. Cela inclut de nombreux paquets couramment utilisés, tels que:

  • @electron/asar
  • @electron/fuses
  • @electron/get
  • @electron/notarize
  • @electron/osx-sign
  • @electron/packager
  • @electron/rebuild
  • @electron/remote
  • @electron/symbolicate-mac
  • @electron/universal

Going forward, all first-party packages we release will also be in the @electron/ namespace. There are two exceptions to this rule:

  • Electron core will continue to be published under the electron package.
  • Electron Forge will continue to publish all of its monorepo packages under the @electron-forge/ namespace.
Star seeking

⭐ During this process, we also accidentally took the electron/packager repository private, which has the unfortunate side effect of erasing our GitHub star count (over 9000 before the erasure). If you are an active user of Packager, we’d appreciate a ⭐ Star ⭐!

Introduction à @electron/windows-sign

À partir du 2023-06-01, les normes de l’industrie ont commencé à exiger que les clés des certificats de signature de code Windows soient stockées sur du matériel conforme à la FIPS.

En pratique, cela signifie que la signature de code est devenue beaucoup plus compliquée pour les applications qui compilent et signet des environnements d'intégration continue, car de nombreux outils Electron prennent un fichier de certificat et un mot de passe comme paramètres de configuration et tentent de signer à partir de là en utilisant une logique codée en dur.

This situation has been a common pain point for Electron developers, which is why we have been working on a better solution that isolates Windows code signing into its own standalone step, similar to what @electron/osx-sign does on macOS.

In the future, we plan on fully integrating this package into the Electron Forge toolchain, but it currently lives on its own. The package is currently available for installation at npm install --save-dev @electron/windows-sign and can used programmatically or via CLI.

Veuillez si vous le pouvez l’essayer et nous faire part de vos commentaires dans l’outil de suivi des problèmes de repo!

Et ensuite ?

We'll be entering our annual December quiet period next month. While we do, we'll be thinking about how we can make the Electron development experience even better in 2024.

Is there anything you'd like to see us work on next? Signalez-le nous!