ci: add Dependabot to patch the bundled Electron/Chromium runtime - #79
Closed
BernardJen wants to merge 1 commit into
Closed
ci: add Dependabot to patch the bundled Electron/Chromium runtime#79BernardJen wants to merge 1 commit into
BernardJen wants to merge 1 commit into
Conversation
Input Viewer is an Electron app: input_viewer_electron pins electron 42.3.3, i.e. a full Chromium runtime shipped inside the app on the videowall PC. That host is patched by win_updates + `winget upgrade` (labs-windows-mgmt), neither of which can see a runtime bundled inside this app — so Chromium security fixes only reach the videowall when Input Viewer is rebuilt with a newer Electron, and nothing currently prompts that rebuild. Add .github/dependabot.yml so the electron pin (and the rest of the toolchain) moves with upstream releases, plus github-actions hygiene. The electron packages are grouped so runtime bumps land as coherent PRs. Ref: LABS-832 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Superseded: Not carried over: the LABS-832 rationale comment and the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add
.github/dependabot.ymlwith two update ecosystems:/input_viewer_electron— weekly, so theelectronpin (currently42.3.3) and the rest of the toolchain move with upstream releases. Electron packages are grouped so a runtime bump lands as one coherent PR./— keeps the CI/release workflow actions current.Why — LABS-832
Input Viewer is an Electron app, so
input_viewer_electronships a full Chromium runtime inside the app on the videowall PC. That host is patched bywin_updates+winget upgrade --all(labs-windows-mgmt), but neither can see a runtime bundled inside an app — so Chromium security fixes reach the videowall only when Input Viewer is rebuilt with a newer Electron, and nothing currently prompts that rebuild.This closes that blind spot: Dependabot is now what raises the Electron bump that triggers a rebuild/redeploy.
Not tied to a specific CVE — this is about the missing patch route, found during the LABS-660 Chromium exposure review. Practical risk is lower than a kiosk browser (the app renders local content, not arbitrary web pages), so this is hygiene, not an urgent exposure.
Ref: LABS-832
🤖 Generated with Claude Code