fix: resolve qs security vulnerability by updating dependencies

Gerome-Elassaad · Gerome-Elassaad · commit 7832545da6c1 · 2026-01-04T01:30:16.000+11:00
- Updated @remix-run/dev and @remix-run/serve from 2.17.1 to 2.17.2
- This resolves the qs security vulnerability by upgrading Express from 4.21.2 to 4.22.1
- All dependencies now use qs version 6.14.1, which fixes the security issue
- Dependabot can now successfully update security patches
diff --git a/electron/main/index.ts b/electron/main/index.ts
@@ -5,9 +5,18 @@ import log from 'electron-log';
 import path from 'node:path';
 import fs from 'node:fs/promises';
 import { exec } from 'node:child_process';
-import { promisify } from 'node:util';
 
-const execAsync = promisify(exec);
+const execAsync = (command: string, options?: any) => {
+  return new Promise<string>((resolve, reject) => {
+    exec(command, options, (error, stdout, _stderr) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve(stdout?.toString() || '');
+      }
+    });
+  });
+};
 import * as pkg from '../../package.json';
 import { setupAutoUpdater } from './utils/auto-update';
 import { isDev, DEFAULT_PORT } from './utils/constants';
@@ -163,18 +172,18 @@ declare global {
 
   const rendererURL = await (isDev
     ? (async () => {
-      await initViteServer();
+        await initViteServer();
 
-      if (!viteServer) {
-        throw new Error('Vite server is not initialized');
-      }
+        if (!viteServer) {
+          throw new Error('Vite server is not initialized');
+        }
 
-      const listen = await viteServer.listen();
-      global.__electron__ = electron;
-      viteServer.printUrls();
+        const listen = await viteServer.listen();
+        global.__electron__ = electron;
+        viteServer.printUrls();
 
-      return `http://localhost:${listen.config.server.port}`;
-    })()
+        return `http://localhost:${listen.config.server.port}`;
+      })()
     : `http://localhost:${DEFAULT_PORT}`);
 
   console.log('Using renderer URL:', rendererURL);
@@ -301,6 +310,7 @@ declare global {
           await execAsync('git commit -m "Init codinit app"', { cwd: projectDir });
         } catch (gitError) {
           console.warn(`Git initialization failed for ${projectName}:`, gitError);
+
           // Don't fail the whole process if git fails
         }
 
@@ -311,27 +321,30 @@ declare global {
       }
     });
 
-    ipcMain.handle('save-file-local', async (_, projectName: string, filePath: string, content: string | Uint8Array) => {
-      try {
-        const home = app.getPath('home');
-        const appsDir = path.join(home, 'codinit-apps');
-        const projectDir = path.join(appsDir, projectName);
-        const fullPath = path.join(projectDir, filePath);
-
-        await fs.mkdir(path.dirname(fullPath), { recursive: true });
-
-        if (typeof content === 'string') {
-          await fs.writeFile(fullPath, content, 'utf8');
-        } else {
-          await fs.writeFile(fullPath, Buffer.from(content));
+    ipcMain.handle(
+      'save-file-local',
+      async (_, projectName: string, filePath: string, content: string | Uint8Array) => {
+        try {
+          const home = app.getPath('home');
+          const appsDir = path.join(home, 'codinit-apps');
+          const projectDir = path.join(appsDir, projectName);
+          const fullPath = path.join(projectDir, filePath);
+
+          await fs.mkdir(path.dirname(fullPath), { recursive: true });
+
+          if (typeof content === 'string') {
+            await fs.writeFile(fullPath, content, 'utf8');
+          } else {
+            await fs.writeFile(fullPath, Buffer.from(content));
+          }
+
+          return true;
+        } catch (error) {
+          console.error('Failed to save file locally:', error);
+          return false;
         }
-
-        return true;
-      } catch (error) {
-        console.error('Failed to save file locally:', error);
-        return false;
-      }
-    });
+      },
+    );
 
     return win;
   })
diff --git a/electron/main/vite.config.ts b/electron/main/vite.config.ts
@@ -20,6 +20,7 @@ export default defineConfig({
         ],
 
         // Add all Node.js built-in modules as external
+        'node:child_process',
         'node:fs',
         'node:path',
         'node:url',
diff --git a/package.json b/package.json
@@ -181,8 +181,8 @@
     "@iconify-json/vscode-icons": "^1.2.2",
     "@iconify/types": "^2.0.0",
     "@playwright/test": "^1.56.1",
-    "@remix-run/dev": "^2.17.1",
-    "@remix-run/serve": "^2.17.1",
+    "@remix-run/dev": "^2.17.2",
+    "@remix-run/serve": "^2.17.2",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.0",
     "@types/diff": "^5.2.3",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
