Update dependency electron-packager to v7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
electron-packager	^5.0.2 → ^7.0.0

---

SSL Validation Defaults to False in electron-packager

CVE-2016-10534 / GHSA-q43m-ffwr-rpcc

More information

Details

Affected versions of electron-packager configure the generated application to disable SSL certificate verification by default.

This could allow an attacker with a privileged network position to launch a Man In The Middle (MITM) attack on the install process, intercepting the step where electron-packager downloads Electron for supported target platforms and architectures, and replacing the valid download with a tampered malicious one.

This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.

Recommendation

1. Update to version 7.0.0 or later.
2. Delete the electron-download cache folder, which is by default located at ~/.electron.

Severity

Low

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-10534
• https://github.com/electron-userland/electron-packager/issues/333
• https://github.com/advisories/GHSA-q43m-ffwr-rpcc
• https://www.npmjs.com/advisories/104

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

electron/electron-packager (electron-packager)

v7.0.0: 7.0.0

Compare Source

Added

• Add download parameter (#​320)

Changed

• Dropped support for running on Node < 4.0. (#​319)

Fixed

• strict-ssl (and by extension, download.strictSSL) defaults to true, as documented (#​320)

Deprecated

• cache is deprecated in favor of download.cache (#​320)
• strict-ssl is deprecated in favor of download.strictSSL (#​320)

Removed

• [win32] version-string.FileVersion and version-string.ProductVersion are replaced by
  favor of app-version and build-version, respectively (#​327)
• [win32] version-string.LegalCopyright is replaced by app-copyright (#​327)

v6.0.2: 6.0.2

Compare Source

Changed

• [win32] rcedit dependency updated to 0.5.x. The DLL mentioned in the 6.0.1 release notes
  is no longer required.

v6.0.1: 6.0.1

Compare Source

Changed

• [win32] rcedit dependency updated to 0.4.x
• API documentation moved from readme.md to docs/api.md (#​296)

Fixed

• [darwin/mas] The OSX icon is properly replaced when Electron ≥ 0.37.4 is used (#​301)
• default_app.asar is deleted during packaging (necessary when Electron ≥ 0.37.4 is used).
  The default_app folder is still deleted for older Electron versions (#​298, #​311)

v6.0.0: 6.0.0

Compare Source

Added

• Add support for a new target platform, Mac App Store (mas), including signing OS X apps
  (#​223, #​278)
• Add app-copyright parameter (#​223)
• Add tmpdir parameter to specify a custom temp directory (#​230); set to false to disable
  using a temporary directory at all (#​251, #​276)
• Add NEWS.md, a human-readable list of changes in each version (since 5.2.0) (#​263)

Changed

• The GitHub repository has been moved into an organization,
  electron-userland
• Allow the ignore parameter to take a function (#​247)
• [contributors] Update Standard (JavaScript coding standard) package to 5.4.x
• [contributors] Add code coverage support via Coveralls (#​257)
• Better docs around contributing to the project (#​258)
• Ignore the directory specified by the out parameter by default (#​255)
• [darwin/mas] Add support for merging arbitrary plist files and adding arbitrary resource
  files (#​253)
• Split out the code to sign OS X apps into a separate Node module,
  electron-osx-sign (#​223)
• [darwin/mas] BREAKING: The sign parameter is now osx-sign (for better cross-platform
  compatibility) and optionally takes several of the same sub-parameters as
  electron-osx-sign (#​286)

Deprecated

• [win32] version-string.LegalCopyright is deprecated in favor of app-copyright (#​268)

Fixed

• [darwin/mas] Ensure CFBundleVersion and CFBundleShortVersionString are strings (#​250)

• [darwin/mas] Correctly set the helper bundle ID in all relevant plist files (#​223)

• [darwin/mas] OSX-specific binaries are correctly renamed to the application name (#​244, #​293)

  If you are upgrading from ≤ 5.2.1 and building for a darwin target, you may experience problems. See #​323 for details.

v5.2.1

Compare Source

v5.2.0

Compare Source

v5.1.1

Compare Source

v5.1.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.