Understand heads-down on db features, but security/maintenance-releases for deps? (or turn on bot for version bump-PRs to review?)

Ramses · March 10, 2025, 5:53pm

Thanks for raising this issue @jakotay (and sorry for taking so long to reply).

All work is currently focused on the “DB branch”, which will be merged back into main soon. There, electron has been been updated to v31.7.5:

Edit: I see there’s an issue with this version as well, so I’ve flagged the issue with @tienson based on the comment below. He told me that the electron version will be updated again.

github.com/logseq/logseq

Electron version in use is outdated and marked insecure

opened 04:08PM - 13 Dec 24 UTC

XenGi

### Search first - [X] I searched and no similar issues were found ### Wha…t Happened? The current release 0.10.9 uses electron version 27 which reached EOL 2024-Apr-16. In the master branch electron version 31 is used which will reach EOL 2025-Jan-14, which is at the time of writing in 1 month. That means that the current version of logseq already is insecure and the master branch will become insecure very shortly. Therefore I recommend upgrading electron to at least version 33 which will reach EOL 2025-Apr-29 and creating a new release. See https://www.electronjs.org/docs/latest/tutorial/electron-timelines ### Reproduce the Bug 1. Download current version 2. investigate dependencies 3. Download master 4. investigate dependencies ### Expected Behavior Release version should have an electron version which still receives security updates. ### Screenshots _No response_ ### Desktop or Mobile Platform Information _No response_ ### Additional Context _No response_ ### Are you willing to submit a PR? If you know how to fix the bug. - [ ] I'm willing to submit a PR (Thank you!)

Edit 2: Electron will be updated soon, in time for the new local builds: