search

electron-userland / electron-builder

A complete solution to package and build a ready for distribution Electron app with “auto update” support out of the box
https://www.electron.build
MIT License
13.58k stars 1.73k forks source link

Upgrading or specify verison of fpm or ruby depended on by fpm #8307

Open Jamtastic808 opened 2 months ago

Jamtastic808 commented 2 months ago

Is there a way to update the fpm version (specifically ruby > activesupport in fpm) version being used? Npm buildler downloads fpm and in this version there are critical vulnerabilities. Trying to update fpm in the hope that activesupport 3.2.13 is upgraded to 6.0.3.1.

Thank you

mmaietta commented 2 months ago

The fpm binary comes from here: https://github.com/electron-userland/electron-builder-binaries/releases?q=fpm&expanded=true

I don't have a manner (or access) with which to upload a new binary release though. Note: electron-builder uses the electron-builder-binaries repo with sha hash verification of the release to prevent any potential man-in-the-middle style injection of dependencies, so any official upgrades to fpm would need to be a PR opened in that repo, then @develar would need to perform a release for it.