2.7 KiB
JavaScript lint and dependency audit
Audit date: 2026-10-13. npm run lint uses pinned ESLint 10.12.0, @eslint/js 10.0.1 and globals 17.13.0. Flat configuration enables recommended correctness rules, including undefined identifiers, unsafe control flow, duplicate keys and unreachable code. Node and renderer environments are separate. Serialized isolated-world DOM helpers and classic admin scripts have explicit global contracts. Narrow annotated exceptions preserve intentional control-character rejection, fixed sanitized errors, cleanup failure propagation and sensitive transient text clearing. Unused-variable warnings remain enabled, and the lint command fails on any warning. Existing unused imports and pure dead locals were removed; intentional field-stripping destructures have narrow documented annotations.
Configuration follows the official flat-config documentation and language-options documentation.
npm audit --omit=dev --json reports zero npm advisories in production dependencies. Full npm audit --json reports eight moderate affected packages and zero high/critical. These eight entries form one development-tool dependency chain, rather than eight independent vulnerabilities:
electron-builder → app-builder-lib → @electron/get → global-agent → roarr → [email protected].
The underlying GHSA-hp3w-g68c-fv3c / CVE-2026-97058 concerns denial of service when attackers control numeric precision in sprintf format strings. The advisory lists versions through 1.1.3 as affected and no patched release. The registry's latest sprintf-js is also 1.1.3. Consequently there is currently no verified patched leaf version to pin. Npm proposes electron-builder 26.5.0 despite the current pinned 26.15.3; no blind downgrade or audit fix --force was performed.
This is a remaining build-toolchain risk. Keep package generation limited to reviewed local source/configuration, avoid attacker-supplied format templates, and recheck the advisory before release. A production npm dependency result does not audit bundled Chromium/Electron, Python/OCR/model runtimes or prove absence of vulnerabilities. Exact Electron remains pinned at 44.7.0. Package fuse tooling is pinned separately as @electron/[email protected]; its package fuse enforcement requires a successful package verification result.
Raw reports remain in ignored local artifacts: artifacts/npm-audit-production.json, artifacts/npm-audit-full.json, artifacts/eslint-final.json. Repeat both audit commands when dependencies change; do not treat this dated snapshot as permanent evidence.