mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 09:35:39 +00:00
UNITRONIX
100f697260
Pin production console images and new bare-metal installs to the latest Node 22 LTS patch while the Node 24 cleanup-hook backport is released and validated. Keep better-sqlite3 13.x and avoid a risky statement-lifecycle refactor. Refs #377 Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
2.1 KiB
2.1 KiB
Dependency upgrade backlog (non-agent)
Tracked after the July 2026 dependency audit. Do not land these majors in the same PR as runtime EOL or patch bumps — one major (or closely related stack) per PR, with full panel/server tests.
Agents (betterdesk-agent*) are out of scope until support resumes.
Deferred majors — web-nodejs
| Package | Current | Target | Notes |
|---|---|---|---|
| express | 4.x | 5.x | Breaking routing / res.send signatures; migrate with Express 5 guide. Likely pulls path-to-regexp override rewrite. |
| helmet | 7.x | 8.x | Prefer with Express 5 |
| express-rate-limit | 7.x | 8.x | Prefer with Express 5 |
| csrf-csrf | 3.x | 4.x | Auth/CSRF regression suite |
| bcrypt | 5.x | 6.x | Native rebuild; sheds deprecated node-gyp transitive tree |
| better-sqlite3 | 13.x | — | Done (#353): shared SQLite handles + Node 24 Alpine musl |
| ejs | 3.x | 6.x | Template audit |
| otplib | 12.x | 13.x | npm-deprecated at 12; 2FA/TOTP tests required |
| protobufjs | 7.x | 8.x | RdClient / proto paths |
| jest | 29.x | 30.x | Dev/CI only |
Deferred / blocked — rdclient-desktop
| Item | Notes |
|---|---|
| RUSTSEC-2024-0429 (glib) | Ignored in CI/Dependabot until Tauri/GTK stack can move to glib 0.20+. Do not force-upgrade transitive GTK3 crates. |
Vendored wry + git brotli patches |
Leave until WebView regression testing is scheduled. |
Done in audit follow-up (2026-07)
- Node 24 (CI/client tooling); production console images temporarily pin Node 22.23.2 because of the Node.js 24 cleanup-hook crash tracked in #377;
engines>=22 - Alpine server runtime 3.22; Go build image 1.26
- Patch bumps: axios, nodemailer, ws, pg; Go direct deps including
modernc.org/sqlite - SNMP bridge:
pysnmplib→pysnmp>=7.1 - Removed orphan
betterdesk-mgmt/package-lock.json
Related deferred security (not package majors)
See docs/security/LOGIN_API_SECURITY_AUDIT_2026-04-26.md: RustDesk access-token hashing migration; CSP hardening (unsafe-inline / unsafe-eval).