Bump Node.js (v22) and Electron (v35), remove manual install of corepack from build scripts (#53610)

* Bump the electron group with 3 updates Bumps the electron group with 3 updates: [electron](https://github.com/electron/electron), [electron-builder](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-builder) and [electron-vite](https://github.com/alex8088/electron-vite). Updates `electron` from 34.3.0 to 35.1.2 - [Release notes](https://github.com/electron/electron/releases) - [Changelog](https://github.com/electron/electron/blob/main/docs/breaking-changes.md) - [Commits](https://github.com/electron/electron/compare/v34.3.0...v35.1.2) Updates `electron-builder` from 25.1.8 to 26.0.12 - [Release notes](https://github.com/electron-userland/electron-builder/releases) - [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/electron-builder/CHANGELOG.md) - [Commits](https://github.com/electron-userland/electron-builder/commits/v26.0.12/packages/electron-builder) Updates `electron-vite` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/alex8088/electron-vite/releases) - [Changelog](https://github.com/alex8088/electron-vite/blob/master/CHANGELOG.md) - [Commits](https://github.com/alex8088/electron-vite/compare/v3.0.0...v3.1.0) --- updated-dependencies: - dependency-name: electron dependency-version: 35.1.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: electron - dependency-name: electron-builder dependency-version: 26.0.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: electron - dependency-name: electron-vite dependency-version: 3.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: electron ... Signed-off-by: dependabot[bot] <support@github.com> * Bump @electron/notarize from 2.5.0 to 3.0.1 Bumps [@electron/notarize](https://github.com/electron/notarize) from 2.5.0 to 3.0.1. - [Release notes](https://github.com/electron/notarize/releases) - [Changelog](https://github.com/electron/notarize/blob/main/.releaserc.json) - [Commits](https://github.com/electron/notarize/compare/v2.5.0...v3.0.1) --- updated-dependencies: - dependency-name: "@electron/notarize" dependency-version: 3.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Bump node-pty from 1.1.0-beta14 to 1.1.0-beta33 Bumps [node-pty](https://github.com/microsoft/node-pty) from 1.1.0-beta14 to 1.1.0-beta33. - [Release notes](https://github.com/microsoft/node-pty/releases) - [Commits](https://github.com/microsoft/node-pty/commits/v1.1.0-beta33) --- updated-dependencies: - dependency-name: node-pty dependency-version: 1.1.0-beta33 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Bump electron to 35.1.4 * Remove override for electron-vite * Remove unnecessary node_gyp config option from .npmrc It's enough to have a specific version of node-gyp in package.json and that will cause node-pty to use that over the version shipped with pnpm. * Bump Node.js version to 22.14.0 * Remove manual installation of corepack@0.31.0 and new integrity keys * Fix electron-builder deps This is done by removing electron-builder from package.json, running pnpm install and then adding it back again and running pnpm install. * Do not install missing peers to solve problem with electron-builder-squirrel-windows * Move Windows signing configuration to `signtoolOptions` * Update @types/node to v22 * Bring back node_gyp config option in .npmrc This reverts commit b565095500. Turns out it's actually needed, as on Windows pnpm uses 11.1.0 without this. * Update node-gyp to 11.2.0 * Update linux templates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
2026-09-21 05:55:42 +08:00 · 2025-04-14 14:24:22 +00:00
parent 6190627ef7
commit aa3b6430d3
16 changed files with 457 additions and 739 deletions
@@ -56,7 +56,6 @@ jobs:

      - name: Setup pnpm
        run: |
-          npm install -g corepack@0.31.0
          corepack enable pnpm

      - name: Install Go Toolchain
@@ -41,7 +41,6 @@ jobs:

      - name: Install JS dependencies
        run: |
-          npm install -g corepack@0.31.0
          pnpm install --frozen-lockfile

      - name: Build WASM
@@ -48,7 +48,6 @@ jobs:

      - name: Install JS dependencies
        run: |
-          npm install -g corepack@0.31.0
          pnpm install --frozen-lockfile

      - name: Build WASM
@@ -245,7 +245,7 @@ RUN export NODE_ARCH=$(if [ "$BUILDARCH" = "amd64" ]; then echo "x64"; else echo
    mkdir -p ${NODE_PATH} && \
    curl -o /tmp/nodejs.tar.xz -fsSL ${NODE_URL} && \
    tar -xJf /tmp/nodejs.tar.xz -C /usr/local/lib/nodejs-linux --strip-components=1
-RUN npm install -g corepack@0.31.0 && corepack enable yarn pnpm
+RUN corepack enable yarn pnpm

 # Install Go.
 ARG GOLANG_VERSION
@@ -57,7 +57,7 @@ RUN NODE_ARCH="$(if [ "$BUILDARCH" = 'amd64' ]; then echo 'x64'; else echo 'arm6
    curl -o "$NODE_FILE" -fsSL "$NODE_URL" && \
    tar -xJf "$NODE_FILE" -C /usr/local/lib/nodejs-linux --strip-components=1 && \
    rm -f "$NODE_FILE"
-RUN npm install -g corepack@0.31.0 && corepack enable yarn pnpm
+RUN corepack enable yarn pnpm

 # Install Go.
 ARG GOLANG_VERSION
@@ -21,7 +21,7 @@ FROM node:${NODE_VERSION}-bullseye AS buildbox
 # https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
 ARG BUILDARCH

-RUN npm install -g corepack@0.31.0 && corepack enable pnpm
+RUN corepack enable pnpm

 COPY locale.gen /etc/locale.gen
 COPY profile /etc/profile
@@ -7,10 +7,7 @@ GOLANG_VERSION ?= go1.24.2
 GOLANGCI_LINT_VERSION ?= v1.64.7

 # NOTE: Remember to update engines.node in package.json to match the major version.
-# TODO(ravicious): When updating Node.js, see if corepack distributed with the new Node.JS version
-# is >= 0.31.0. If so, remove manual calls to install corepack@0.31.0 from CI scripts and
-# COREPACK_INTEGRITY_KEYS env var from windows/build.ps1.
-NODE_VERSION ?= 20.18.0
+NODE_VERSION ?= 22.14.0

 # Run lint-rust check locally before merging code after you bump this.
 RUST_VERSION ?= 1.81.0
@@ -144,7 +144,6 @@ function Install-Node {
        Expand-Archive -Path $NodeZipfile -DestinationPath $ToolchainDir
        Rename-Item -Path "$ToolchainDir/node-v$NodeVersion-win-x64" -NewName "$ToolchainDir/node"
        Enable-Node -ToolchainDir $ToolchainDir
-        $Env:COREPACK_INTEGRITY_KEYS = '{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}'
        corepack enable pnpm
        Write-Host "::endgroup::"
    }
@@ -30,8 +30,7 @@
  "private": true,
  "pnpm": {
    "overrides": {
-      "jsdom@^20.0.3>nwsapi@^2": "2.2.9",
-      "electron-vite@^3.0.0>esbuild@0.24.2": "^0.25.0"
+      "jsdom@^20.0.3>nwsapi@^2": "2.2.9"
    }
  },
  "devDependencies": {
@@ -50,7 +49,7 @@
    "@testing-library/user-event": "^14.6.1",
    "@types/history": "^4.7.11",
    "@types/jest": "^29.5.14",
-    "@types/node": "^20.17.29",
+    "@types/node": "^22.14.0",
    "@types/react": "^18.3.12",
    "@types/react-dom": "^18.3.1",
    "@types/react-highlight": "^0.12.8",
@@ -63,7 +62,7 @@
    "jsdom-testing-mocks": "^1.13.1",
    "msw": "^2.7.3",
    "msw-storybook-addon": "^2.0.4",
-    "node-gyp": "11.0.0",
+    "node-gyp": "^11.2.0",
    "playwright": "^1.51.1",
    "prettier": "^3.5.3",
    "react-select-event": "^5.5.1",
@@ -111,6 +110,6 @@
  },
  "packageManager": "pnpm@10.7.0+sha512.6b865ad4b62a1d9842b61d674a393903b871d9244954f652b8842c2b553c72176b278f64c463e52d40fff8aba385c235c8c9ecf5cc7de4fd78b8bb6d49633ab6",
  "engines": {
-    "node": "^20"
+    "node": "^22"
  }
 }
@@ -8,3 +8,18 @@ onlyBuiltDependencies:
  - msw
  - node-pty
  - protobufjs
+# Without this, electron-builder will pull in electron-builder-squirrel-windows (which we don't need)
+# and that dep will in turn pull electron-winstaller (which we also don't need). pnpm will then
+# start complaining that electron-winstaller is not in onlyBuiltDependencies.
+#
+# We could instead solve this by adding electron-winstaller to ignoredBuiltDependencies, but why
+# pull in deps that we don't use? Ultimately, the problem is that electron-builder-squirrel-windows
+# is defined as a peer dep of one of electron-builder deps, while in reality it's more like an
+# optional dep.
+autoInstallPeers: false
+strictPeerDependencies: true
+peerDependencyRules:
+  ignoreMissing:
+    # This dep is needed only when using Squirrel.Windows as an installer in electron-build which we
+    # don't use. https://www.electron.build/squirrel-windows.html
+    - electron-builder-squirrel-windows
@@ -24,6 +24,36 @@ if hash update-desktop-database 2>/dev/null; then
  update-desktop-database /usr/share/applications || true
 fi

+# Install apparmor profile. (Ubuntu 24+)
+# First check if the version of AppArmor running on the device supports our profile.
+# This is in order to keep backwards compatibility with Ubuntu 22.04 which does not support abi/4.0.
+# In that case, we just skip installing the profile since the app runs fine without it on 22.04.
+#
+# Those apparmor_parser flags are akin to performing a dry run of loading a profile.
+# https://wiki.debian.org/AppArmor/HowToUse#Dumping_profiles
+#
+# Unfortunately, at the moment AppArmor doesn't have a good story for backwards compatibility.
+# https://askubuntu.com/questions/1517272/writing-a-backwards-compatible-apparmor-profile
+if apparmor_status --enabled > /dev/null 2>&1; then
+  APPARMOR_PROFILE_SOURCE='/opt/${sanitizedProductName}/resources/apparmor-profile'
+  APPARMOR_PROFILE_TARGET='/etc/apparmor.d/${executable}'
+  if apparmor_parser --skip-kernel-load --debug "$APPARMOR_PROFILE_SOURCE" > /dev/null 2>&1; then
+    cp -f "$APPARMOR_PROFILE_SOURCE" "$APPARMOR_PROFILE_TARGET"
+
+    # Updating the current AppArmor profile is not possible and probably not meaningful in a chroot'ed environment.
+    # Use cases are for example environments where images for clients are maintained.
+    # There, AppArmor might correctly be installed, but live updating makes no sense.
+    if ! { [ -x '/usr/bin/ischroot' ] && /usr/bin/ischroot; } && hash apparmor_parser 2>/dev/null; then
+      # Extra flags taken from dh_apparmor:
+      # > By using '-W -T' we ensure that any abstraction updates are also pulled in.
+      # https://wiki.debian.org/AppArmor/Contribute/FirstTimeProfileImport
+      apparmor_parser --replace --write-cache --skip-read-cache "$APPARMOR_PROFILE_TARGET"
+    fi
+  else
+    echo "Skipping the installation of the AppArmor profile as this version of AppArmor does not seem to support the bundled profile"
+  fi
+fi
+
 ###
 # Custom after-install.tpl script.
 ###
@@ -69,32 +99,4 @@ else
  fi
 fi

-APPARMOR_PROFILE_SOURCE="$APP/resources/apparmor-profile"
-APPARMOR_PROFILE_TARGET="/etc/apparmor.d/teleport-connect"
-
-# Install apparmor profile.
-# First check if the version of AppArmor running on the device supports our profile.
-# This is in order to keep backwards compatibility with Ubuntu 22.04 which does not support abi/4.0.
-# In that case, we just skip installing the profile since the app runs fine without it on 22.04.
-#
-# Those apparmor_parser flags are akin to performing a dry run of loading a profile.
-# https://wiki.debian.org/AppArmor/HowToUse#Dumping_profiles
-#
-# Unfortunately, at the moment AppArmor doesn't have a good story for backwards compatibility.
-# https://askubuntu.com/questions/1517272/writing-a-backwards-compatible-apparmor-profile
-if test -d "/etc/apparmor.d"; then
-  if apparmor_parser --skip-kernel-load --debug "$APPARMOR_PROFILE_SOURCE" > /dev/null 2>&1; then
-    cp -f "$APPARMOR_PROFILE_SOURCE" "$APPARMOR_PROFILE_TARGET"
-
-    if hash apparmor_parser 2>/dev/null; then
-      # Extra flags taken from dh_apparmor:
-      # > By using '-W -T' we ensure that any abstraction updates are also pulled in.
-      # https://wiki.debian.org/AppArmor/Contribute/FirstTimeProfileImport
-      apparmor_parser --replace --write-cache --skip-read-cache "$APPARMOR_PROFILE_TARGET"
-    fi
-  else
-    echo "Skipping the installation of the AppArmor profile as this version of AppArmor does not seem to support the profile bundled with Teleport Connect."
-  fi
-fi
-
 # vim: syntax=sh
@@ -46,7 +46,7 @@ if [ -L "$TSH_SYMLINK_TARGET" ] && [ ! -e "$TSH_SYMLINK_TARGET" ]; then
  rm -f "$TSH_SYMLINK_TARGET"
 fi

-APPARMOR_PROFILE_DEST="/etc/apparmor.d/teleport-connect"
+APPARMOR_PROFILE_DEST='/etc/apparmor.d/${executable}'

 # Remove apparmor profile.
 if [ -f "$APPARMOR_PROFILE_DEST" ]; then
@@ -1,9 +0,0 @@
-abi <abi/4.0>,
-include <tunables/global>
-
-profile teleport-connect /opt/Teleport\ Connect/teleport-connect flags=(unconfined) {
-  userns,
-
-  # Site-specific additions and overrides. See local/README for details.
-  include if exists <local/teleport-connect>
-}
@@ -152,30 +152,32 @@ module.exports = {
  },
  win: {
    target: ['nsis'],
-    // The algorithm passed here is not used, it only prevents the signing function from being called twice for each file.
-    // https://github.com/electron-userland/electron-builder/issues/3995#issuecomment-505725704
-    signingHashAlgorithms: ['sha256'],
-    sign: customSign => {
-      if (process.env.CI !== 'true') {
-        console.warn('Not running in CI pipeline: signing will be skipped');
-        return;
-      }
+    signtoolOptions: {
+      // The algorithm passed here is not used, it only prevents the signing function from being called twice for each file.
+      // https://github.com/electron-userland/electron-builder/issues/3995#issuecomment-505725704
+      signingHashAlgorithms: ['sha256'],
+      sign: customSign => {
+        if (process.env.CI !== 'true') {
+          console.warn('Not running in CI pipeline: signing will be skipped');
+          return;
+        }

-      spawnSync(
-        'powershell',
-        [
-          '-noprofile',
-          '-executionpolicy',
-          'bypass',
-          '-c',
-          "$ProgressPreference = 'SilentlyContinue'; " +
-            "$ErrorActionPreference = 'Stop'; " +
-            '$PSNativeCommandUseErrorActionPreference = $true; ' +
-            '. ../../../build.assets/windows/build.ps1; ' +
-            `Invoke-SignBinary -UnsignedBinaryPath "${customSign.path}"`,
-        ],
-        { stdio: 'inherit' }
-      );
+        spawnSync(
+          'powershell',
+          [
+            '-noprofile',
+            '-executionpolicy',
+            'bypass',
+            '-c',
+            "$ProgressPreference = 'SilentlyContinue'; " +
+              "$ErrorActionPreference = 'Stop'; " +
+              '$PSNativeCommandUseErrorActionPreference = $true; ' +
+              '. ../../../build.assets/windows/build.ps1; ' +
+              `Invoke-SignBinary -UnsignedBinaryPath "${customSign.path}"`,
+          ],
+          { stdio: 'inherit' }
+        );
+      },
    },
    artifactName: '${productName} Setup-${version}.${ext}',
    icon: 'build_resources/icon-win.ico',
@@ -26,7 +26,7 @@
    "@grpc/grpc-js": "1.13.2",
    "@types/which": "^3.0.4",
    "node-forge": "^1.3.1",
-    "node-pty": "1.1.0-beta14",
+    "node-pty": "1.1.0-beta33",
    "ring-buffer-ts": "^1.2.0",
    "split2": "4.2.0",
    "strip-ansi": "^7.1.0",
@@ -35,7 +35,7 @@
    "winston": "^3.17.0"
  },
  "devDependencies": {
-    "@electron/notarize": "^2.5.0",
+    "@electron/notarize": "^3.0.1",
    "@gravitational/build": "workspace:*",
    "@gravitational/design": "workspace:*",
    "@gravitational/shared": "workspace:*",
@@ -45,9 +45,9 @@
    "@types/whatwg-url": "^13.0.0",
    "@xterm/addon-fit": "^0.10.0",
    "@xterm/xterm": "^5.5.0",
-    "electron": "34.3.0",
-    "electron-builder": "^25.1.8",
-    "electron-vite": "^3.0.0",
+    "electron": "35.1.4",
+    "electron-builder": "^26.0.12",
+    "electron-vite": "^3.1.0",
    "events": "3.3.0",
    "jest-canvas-mock": "^2.5.2",
    "react-dnd": "^14.0.4",