mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 09:35:39 +00:00
UNITRONIX
100f697260
Pin production console images and new bare-metal installs to the latest Node 22 LTS patch while the Node 24 cleanup-hook backport is released and validated. Keep better-sqlite3 13.x and avoid a risky statement-lifecycle refactor. Refs #377 Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
40 lines
2.1 KiB
Markdown
40 lines
2.1 KiB
Markdown
# Dependency upgrade backlog (non-agent)
|
|
|
|
Tracked after the July 2026 dependency audit. **Do not** land these majors in the same PR as runtime EOL or patch bumps — one major (or closely related stack) per PR, with full panel/server tests.
|
|
|
|
Agents (`betterdesk-agent*`) are out of scope until support resumes.
|
|
|
|
## Deferred majors — `web-nodejs`
|
|
|
|
| Package | Current | Target | Notes |
|
|
|---------|---------|--------|-------|
|
|
| express | 4.x | 5.x | Breaking routing / `res.send` signatures; migrate with [Express 5 guide](https://expressjs.com/en/guide/migrating-5/). Likely pulls `path-to-regexp` override rewrite. |
|
|
| helmet | 7.x | 8.x | Prefer with Express 5 |
|
|
| express-rate-limit | 7.x | 8.x | Prefer with Express 5 |
|
|
| csrf-csrf | 3.x | 4.x | Auth/CSRF regression suite |
|
|
| bcrypt | 5.x | 6.x | Native rebuild; sheds deprecated `node-gyp` transitive tree |
|
|
| better-sqlite3 | **13.x** | — | Done (#353): shared SQLite handles + Node 24 Alpine musl |
|
|
| ejs | 3.x | 6.x | Template audit |
|
|
| otplib | 12.x | 13.x | **npm-deprecated** at 12; 2FA/TOTP tests required |
|
|
| protobufjs | 7.x | 8.x | RdClient / proto paths |
|
|
| jest | 29.x | 30.x | Dev/CI only |
|
|
|
|
## Deferred / blocked — `rdclient-desktop`
|
|
|
|
| Item | Notes |
|
|
|------|-------|
|
|
| **RUSTSEC-2024-0429 (glib)** | Ignored in CI/Dependabot until Tauri/GTK stack can move to glib 0.20+. Do not force-upgrade transitive GTK3 crates. |
|
|
| Vendored `wry` + git `brotli` patches | Leave until WebView regression testing is scheduled. |
|
|
|
|
## Done in audit follow-up (2026-07)
|
|
|
|
- Node **24** (CI/client tooling); production console images temporarily pin Node **22.23.2** because of the Node.js 24 cleanup-hook crash tracked in #377; `engines` **>=22**
|
|
- Alpine server runtime **3.22**; Go build image **1.26**
|
|
- Patch bumps: axios, nodemailer, ws, pg; Go direct deps including `modernc.org/sqlite`
|
|
- SNMP bridge: `pysnmplib` → **`pysnmp` >=7.1**
|
|
- Removed orphan `betterdesk-mgmt/package-lock.json`
|
|
|
|
## Related deferred security (not package majors)
|
|
|
|
See `docs/security/LOGIN_API_SECURITY_AUDIT_2026-04-26.md`: RustDesk access-token hashing migration; CSP hardening (`unsafe-inline` / `unsafe-eval`).
|