Skip to content

chore(deps): bump electron from 41.5.0 to 41.10.3 in /apps/desktop #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
radroid merged 3 commits into from
Aug 8, 2026
Merged

chore(deps): bump electron from 41.5.0 to 41.10.3 in /apps/desktop #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
864c62b
chore(deps): bump electron from 41.5.0 to 41.10.3 in /apps/desktop
dependabot[bot] Aug 7, 2026
19fe26a
chore(deps): regenerate the lockfile for electron 41.10.3
radroid Aug 8, 2026
9e10a55
chore(t3x): stop Dependabot on the vendored subtrees, ledger the elec…
radroid Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# t3x fork Dependabot config. Upstream has no `.github/dependabot.yml`, so this file is
# fork-owned and costs no seam-ledger row.
#
# It configures NO version updates. Its only job is to stop Dependabot opening *security*
# update PRs against the vendored reference subtrees under `.repos/`.
#
# `.repos/effect-smol` and `.repos/alchemy-effect` are `git subtree`s of other projects,
# maintained by `scripts/sync-reference-repos.ts` (added upstream in #2902 / #2918). They are
# reference source for agents to read, not code this fork runs:
#
# - no glob in `pnpm-workspace.yaml` matches them, so nothing there is ever installed,
# bundled or shipped — an advisory inside them is not reachable from any artifact we build;
# - `ci.yml` sparse-checks-out `!/.repos/`, so the code is not even present when CI runs;
# - a fork-local edit inside a subtree diverges it from its source, so the next
# `subtree pull` conflicts — in a ~30k-line lockfile — and the same hunk is re-conflicted
# on every daily rebase onto upstream.
#
# They were nonetheless 41 of the fork's 107 open Dependabot alerts, and each alert can spawn a
# PR: #48 (undici) and #50 (hono) were both closed unmerged for the reasons above.
#
# Two details that make this work, both easy to get wrong:
#
# - Per GitHub's docs, a config entry applies to security updates only when `directory` /
# `directories` matches the *manifest* locations and no `target-branch` is set. The
# manifests here are nested deep (`.repos/effect-smol/packages/platform-node/package.json`,
# `.repos/alchemy-effect/packages/alchemy/test/.../react-router-rsc-fixture/package.json`),
# hence the `**` globs rather than the two subtree roots.
# - `open-pull-requests-limit: 0` alone would NOT do this. It is documented as
# version-updates-only, and security PRs are explicitly exempt from that limit. The
# wildcard `ignore` is the lever that reaches security updates; the limit is belt-and-braces
# against the `schedule` key below (required by the schema) enabling version updates.
version: 2
updates:
- package-ecosystem: npm
directories:
- "/.repos/*"
- "/.repos/**"
schedule:
interval: monthly
open-pull-requests-limit: 0
ignore:
- dependency-name: "*"
2 changes: 1 addition & 1 deletion apps/desktop/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
"@t3tools/ssh": "workspace:*",
"@t3tools/tailscale": "workspace:*",
"effect": "catalog:",
"electron": "41.5.0",
"electron": "41.10.3",
"electron-store": "^8.2.0",
"electron-updater": "^6.6.2",
"playwright-core": "1.60.0",
Expand Down
11 changes: 9 additions & 2 deletions docs/t3x/SEAMS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

**The authoritative list of every upstream-owned file this fork edits.**

Measured, not asserted: **35 upstream-owned files, +1700 / -187 lines**, against merge-base
Measured, not asserted: **36 upstream-owned files, +1733 / -257 lines**, against merge-base
`64bf01619` (the 2026-08-02 upstream sync). Everything else the fork adds lives in new files upstream
has never seen and cannot conflict.

Expand Down Expand Up @@ -54,6 +54,12 @@ recurring rebase conflict in a file this doc said the fork did not touch) went u
> **Tripwire:** the surface is already far past "a handful of rows". Before adding row 36, re-isolate
> something instead. Prefer fork-owned files even when an in-place edit is smaller.
>
> Row 36 (`apps/desktop/package.json`) was added on 2026-08-08 for an electron security pin. It is
> the one shape the tripwire cannot redirect: a dependency version has no fork-owned home, and the
> only alternative — a pnpm `overrides` entry — sits in `pnpm-workspace.yaml`, an upstream file, for
> the same cost and worse legibility. It is a single version string and it retires itself as soon as
> upstream passes `41.10.3`.
>
> Row 35 (`AGENTS.md`) was added knowingly on 2026-08-05, against this tripwire. The alternatives —
> a tracked `.claude/settings.json` SessionStart hook, or an untracked `CLAUDE.local.md` — were
> rejected for being Claude-Code-only and worktree-local respectively. It is six lines of prose in a
Expand All @@ -77,8 +83,8 @@ Sorted by risk, worst first.

| Upstream file | fork Δ | churn | risk | Why the fork touches it |
| ----------------------------------------------------------------------- | -------- | ----- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `pnpm-lock.yaml` | +125/-69 | 64 | **12416** | Web Push adds `web-push` + `@types/web-push`; update delivery adds the `t3x-update-relay` workspace entry (+6, `effect` + `@cloudflare/workers-types` only — `wrangler` is run via `pnpm dlx` precisely to keep it out of here, it would have cost ~500); the electron 41.10.3 security bump re-resolves the electron tree (+32/-69, a net **shrink** — `@electron/get` 2.0.3 + 3.1.0 collapse into 5.1.0). Unavoidable and always conflicts; regenerate rather than merge |
| `apps/web/src/components/ChatView.tsx` | +181/-1 | 63 | **11466** | Thread outbox: `handleQueueComposerSubmission`, queue-mode state, `onSend` early-return, `<ThreadOutboxQueueList>`, `sendLabel`, steer-vs-queue predicate, dispatch breadcrumb |
| `pnpm-lock.yaml` | +93 | 64 | **5952** | Web Push adds `web-push` + `@types/web-push`; update delivery adds the `t3x-update-relay` workspace entry (+6, `effect` + `@cloudflare/workers-types` only — `wrangler` is run via `pnpm dlx` precisely to keep it out of here, it would have cost ~500). Unavoidable and always conflicts; regenerate rather than merge |
| `packages/client-runtime/src/connection/supervisor.test.ts` | +363 | 5 | **1815** | Issue #21: 356-line appended `describe` + harness plumbing |
| `packages/client-runtime/src/connection/supervisor.ts` | +186/-63 | 5 | **1245** | Issue #21: in-place rewrite of the reconnect/backoff state machine; now also owns the shared `runLivenessProbe` helper upstream's probe path uses |
| `apps/web/src/components/settings/SettingsPanels.tsx` | +58 | 18 | **1044** | Needs-input notifications: import, 3 restore-reducer entries, permission state, a 45-line `<SettingsRow>`. **Not registered in upstream's new settings-search catalog** — see the note below the table |
Expand All @@ -105,6 +111,7 @@ Sorted by risk, worst first.
| `AGENTS.md` | +6 | 10 | **60** | `## Agent skills` pointer block for the mattpocock engineering skills. Three one-line links into `docs/t3x/agents/`; no config lives here. Placed between `## How it works` and `## Where code lives` — stable anchors, deliberately not appended at EOF where upstream adds tips (the issue #29 add/add pattern) |
| `apps/web/src/connection/platform.ts` | +7/-1 | 7 | **56** | Lazy `import()` of outbox cleanup to dodge a module-init cycle |
| `apps/mobile/…/T3ComposerEditorView.kt` | +51 | 1 | **51** | Android bare-Enter intercept |
| `apps/desktop/package.json` | +1/-1 | 15 | **30** | **Row 36, added 2026-08-08 against the tripwire below.** `electron` pinned to `41.10.3`, not upstream's `41.5.0`, for GHSA advisories #94 (high: sandboxed iframe bypasses `allow-popups` via OpenURL) and #92 (medium: `ProtocolResponse.url` reuses the default session cache). Upstream is still on `41.5.0`, so the sync does **not** carry this fix and the fork ships its own desktop builds. There is no fork-owned way to pin a dependency — an `overrides` entry would land in `pnpm-workspace.yaml`, another upstream file, for the same cost. Retire this row the moment upstream passes `41.10.3`: take upstream's side of the conflict |
| `apps/server/package.json` | +2 | 15 | **30** | `web-push` dependency |
| `apps/mobile/src/native/T3ComposerEditor.types.ts` | +5/-1 | 3 | **18** | Reworded `onSubmit` doc comment |
| `apps/desktop/src/settings/DesktopClientSettings.test.ts` | +1 | 7 | **7** | `notifyOnNeedsInput` in a fixture |
Expand Down
Loading
Loading