Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[HOLD for payment for #23298] [$1000] Upgrade Electron to latest #21345

Closed
roryabraham opened this issue Jun 22, 2023 · 76 comments
Closed

[HOLD for payment for #23298] [$1000] Upgrade Electron to latest #21345

roryabraham opened this issue Jun 22, 2023 · 76 comments
Assignees
@Skalakid @roryabraham @joekaufmanexpensify @Santhosh-Sellavel
Labels
Awaiting Payment Auto-added when associated PR is deployed to production Bug Something is broken. Auto assigns a BugZero manager. External Added to denote the issue can be worked on by a contributor Task Weekly KSv2

Comments

@roryabraham
Copy link
Contributor

roryabraham commented Jun 22, 2023 •
edited by conorpendergrast
Loading

HOLD for payment for #23298

Problem

There is a known vulnerability in our current version of Electron. Furthermore, we are currently several major versions behind.

Solution

Upgrade Electron to the latest stable version.

Upwork Automation - Do Not Edit
  • Upwork Job URL: https://www.upwork.com/jobs/~017a4d213a61b1d4d6
  • Upwork Job ID: 1671967517911908352
  • Last Price Increase: 2023-06-29
@roryabraham roryabraham added External Added to denote the issue can be worked on by a contributor Daily KSv2 Task labels Jun 22, 2023
@roryabraham roryabraham self-assigned this Jun 22, 2023
@melvin-bot melvin-bot bot changed the title Upgrade Electron to latest [$1000] Upgrade Electron to latest Jun 22, 2023
@melvin-bot
Copy link

melvin-bot bot commented Jun 22, 2023

Job added to Upwork: https://www.upwork.com/jobs/~017a4d213a61b1d4d6

@melvin-bot melvin-bot bot added the Help Wanted Apply this label when an issue is open to proposals by contributors label Jun 22, 2023
@melvin-bot
Copy link

melvin-bot bot commented Jun 22, 2023

Triggered auto assignment to @conorpendergrast (External), see https://stackoverflow.com/c/expensify/questions/8582 for more details.

@melvin-bot
Copy link

melvin-bot bot commented Jun 22, 2023

Triggered auto assignment to Contributor-plus team member for initial proposal review - @Santhosh-Sellavel (External)

@situchan
Copy link
Contributor

Is this volunteer based or proposal needed following template?

@roryabraham
Copy link
Contributor Author

Proposal needed following template please

@situchan

This comment was marked as outdated.

Sign in to view
@prodev0223

This comment was marked as resolved.

Sign in to view
@melvin-bot

This comment was marked as resolved.

Sign in to view
@prodev0223

This comment was marked as spam.

Sign in to view
@melvin-bot

This comment was marked as spam.

Sign in to view
@Santhosh-Sellavel
Copy link
Collaborator

@situchan Proposal could have additional details like an Overview of changes we should make, and anything we should be aware of in the process. Were there any deprecations in API we use, are there any known issues, etc?

@prodev0223

This comment was marked as spam.

Sign in to view
@melvin-bot

This comment was marked as resolved.

Sign in to view
@prodev0223

This comment was marked as resolved.

Sign in to view
@melvin-bot

This comment was marked as resolved.

Sign in to view
@prodev0223

This comment was marked as resolved.

Sign in to view
@melvin-bot

This comment was marked as resolved.

Sign in to view
@prodev0223

This comment was marked as resolved.

Sign in to view
@melvin-bot

This comment was marked as resolved.

Sign in to view
@prodev0223

This comment was marked as resolved.

Sign in to view
@melvin-bot

This comment was marked as resolved.

Sign in to view
@AbeerAhmad
Copy link

AbeerAhmad commented Jun 22, 2023 •
edited
Loading

Please re-state the problem that we are trying to solve in this issue.

Upgrade Electron to latest

What is the root cause of that problem?

as defined in the description, There is a known vulnerability in our current version of Electron. Furthermore, we are currently several major versions behind.

What changes do you think we should make in order to solve the problem?

first updating two libraries using
Step1.
npm install electron@latest
it installed electron version "electron": "^25.2.0",
npm install update-electron-app
this one is optional to let the users know about the new app version availability
Step2. Remove expired or libraries that are no longer supported and install compatible versions
icons became unclickable which got fixed apart from that app is working fine and not dependency update needed
Step3.Need to test the app's whole functionality to check if it's working fine and with no Crashes, will submit the PR.
Zero App crash

@roryabraham
Copy link
Contributor Author

Just requested some changes in the PR to close https://expensify.slack.com/archives/C07J32337/p1691436719756409, but we should be close

@conorpendergrast
Copy link
Contributor

Still held!

@melvin-bot melvin-bot bot added the Overdue label Aug 25, 2023
@conorpendergrast
Copy link
Contributor

The PR for #23298 has been merged! Still waiting for that to be on production for 7 days to pay this one.

@melvin-bot melvin-bot bot removed the Overdue label Aug 29, 2023
@melvin-bot melvin-bot bot added the Overdue label Sep 11, 2023
@conorpendergrast conorpendergrast removed their assignment Sep 11, 2023
@melvin-bot melvin-bot bot removed the Overdue label Sep 11, 2023
@conorpendergrast conorpendergrast added Overdue Bug Something is broken. Auto assigns a BugZero manager. labels Sep 11, 2023
@melvin-bot
Copy link

melvin-bot bot commented Sep 11, 2023

Triggered auto assignment to @joekaufmanexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

@melvin-bot melvin-bot bot added Daily KSv2 and removed Weekly KSv2 labels Sep 11, 2023
@melvin-bot

This comment was marked as duplicate.

Sign in to view
@melvin-bot melvin-bot bot removed the Overdue label Sep 11, 2023
@conorpendergrast
Copy link
Contributor

@joekaufmanexpensify I'm on parental leave; re-assigning! I missed that this should be paid, with regression penalties

@joekaufmanexpensify
Copy link
Contributor

All set to issue payment here. Because of the regression, default price here drops by 50%. This means we need to pay:

  • @Santhosh-Sellavel - $500 for C+ review (reduced by 50% from $1,000).
  • @Skalakid's payment is handled separately because they're with an agency.

@joekaufmanexpensify
Copy link
Contributor

@Santhosh-Sellavel could you please request $500 via NewDot and confirm here once complete?

@roryabraham
Copy link
Contributor Author

@conorpendergrast this is ready to pay out and close

@joekaufmanexpensify
Copy link
Contributor

@Santhosh-Sellavel is OOO until next week. Bumping to weekly until they're back and can request money via NewDot.

@joekaufmanexpensify joekaufmanexpensify added Weekly KSv2 and removed Daily KSv2 labels Sep 12, 2023
@joekaufmanexpensify
Copy link
Contributor

Bumped issue in Slack

@Santhosh-Sellavel
Copy link
Collaborator

Will request this week!

@joekaufmanexpensify
Copy link
Contributor

@Santhosh-Sellavel could you please provide an update on this? Would love to close this one out.

@Santhosh-Sellavel
Copy link
Collaborator

Requested on ND

@JmillsExpensify
Copy link

$500 payment approved for @Santhosh-Sellavel based on BZ summary.

@joekaufmanexpensify
Copy link
Contributor

Closing as this is all set!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Skalakid Skalakid

@roryabraham roryabraham

@joekaufmanexpensify joekaufmanexpensify

@Santhosh-Sellavel Santhosh-Sellavel

Labels
Awaiting Payment Auto-added when associated PR is deployed to production Bug Something is broken. Auto assigns a BugZero manager. External Added to denote the issue can be worked on by a contributor Task Weekly KSv2
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests