Skip to main content

Electron 27.0.0

· 7 min read

Electron 27.0.0 已发布!它包括对 Chromium 118.0.5993.32、V8 11.8 和 Node.js 18.17.1 的升级。

🌐 Electron 27.0.0 has been released! It includes upgrades to Chromium 118.0.5993.32, V8 11.8, and Node.js 18.17.1.


Electron 团队很高兴地宣布发布 Electron 27.0.0!你可以通过 npm 使用 npm install electron@latest 安装,或从我们的发布网站下载。请继续阅读以了解此次发布的详细信息。

🌐 The Electron team is excited to announce the release of Electron 27.0.0! You can install it with npm via npm install electron@latest or download it from our releases website. Continue reading for details about this release.

如果你有任何反馈,请通过 TwitterMastodon 与我们分享,或者加入我们的社区 Discord!错误和功能请求可以在 Electron 的 问题追踪器 中报告。

🌐 If you have any feedback, please share it with us on Twitter or Mastodon, or join our community Discord! Bugs and feature requests can be reported in Electron's issue tracker.

打破障碍:通过沙箱强化应用

· 8 min read

自从CVE-2023-4863:WebP中的堆缓冲区溢出被公开以来,已经过去一周多,这导致了一系列新的软件发布,用于渲染 webp 图片:macOS、iOS、Chrome、Firefox 以及各种 Linux 发行版都收到了更新。这是在公民实验室的调查之后发现的,他们发现一个由“位于华盛顿特区的民间社会组织”使用的 iPhone 正在通过 iMessage 中的零点击漏洞遭受攻击。

🌐 It’s been more than a week since CVE-2023-4863: Heap buffer overflow in WebP was made public, leading to a flurry of new releases of software rendering webp images: macOS, iOS, Chrome, Firefox, and various Linux distributions all received updates. This followed investigations by Citizen Lab, discovering that an iPhone used by a “Washington DC-based civil society organization” was under attack using a zero-click exploit within iMessage.

Electron 也迅速行动起来,并在同一天发布了新版本:如果你的应用渲染任何用户提供的内容,你应该更新你的 Electron 版本——v27.0.0-beta.2、v26.2.1、v25.8.1、v24.8.3 和 v22.3.24 都包含修复后的 libwebp,该库负责渲染 webp 图片。

🌐 Electron, too, spun into action and released new versions the same day: If your app renders any user-provided content, you should update your version of Electron - v27.0.0-beta.2, v26.2.1, v25.8.1, v24.8.3, and v22.3.24 all contain a fixed version of libwebp, the library responsible for rendering webp images.

现在我们都清楚地意识到,像“渲染图片”这样简单的交互也可能存在危险,我们想借此机会提醒大家,Electron 内置了一个进程沙盒,它可以限制下一次大规模攻击的波及范围 - 无论它是什么。

🌐 Now that we are all freshly aware that an interaction as innocent as “rendering an image” is a potentially dangerous activity, we want to use this opportunity to remind everyone that Electron comes with a process sandbox that will limit the blast radius of the next big attack — whatever it may be.

自从 Electron v1 开始,沙箱功能就已经可用,并且在 v20 中默认启用,但我们知道许多应用(尤其是那些存在已久的应用)可能在它们的代码中某处有一个 sandbox: false —— 或者一个 nodeIntegration: true,当没有明确的 sandbox 设置时,也会同样禁用沙箱。这是可以理解的:如果你和我们一起走过了很长时间,你可能享受过将 require("child_process")require("fs") 扔进运行 HTML/CSS 的同一代码中的强大功能。

🌐 The sandbox was available ever since Electron v1 and enabled by default in v20, but we know that many apps (especially those that have been around for a while) may have a sandbox: false somewhere in their code – or a nodeIntegration: true, which equally disables the sandbox when there is no explicit sandbox setting. That’s understandable: If you’ve been with us for a long time, you probably enjoyed the power of throwing a require("child_process") or require("fs") into the same code that runs your HTML/CSS.

在我们讨论你如何迁移到沙盒之前,先让我们讨论一下你为什么想要这样做。

🌐 Before we talk about how you migrate to the sandbox, let’s first discuss why you want it.

沙箱在所有渲染进程周围设置了一个严格的隔离环境,确保无论内部发生什么,代码都在受限的环境中执行。作为一个概念,它比 Chromium 要早得多,并且作为功能由所有主要操作系统提供。Electron 和 Chromium 的沙箱构建在这些系统功能之上。即使你从未显示用户生成的内容,也应考虑渲染器可能被攻破的可能性:从复杂的供应链攻击到简单的小漏洞,都可能导致渲染器执行你未完全预期的操作。

🌐 The sandbox puts a hard cage around all renderer processes, ensuring that no matter what happens inside, code is executed inside a restricted environment. As a concept, it's a lot older than Chromium, and provided as a feature by all major operating systems. Electron's and Chromium's sandbox build on top of these system features. Even if you never display user-generated content, you should consider the possibility that your renderer might get compromised: Scenarios as sophisticated as supply chain attacks and as simple as little bugs can lead to your renderer doing things you didn't fully intend for it to do.

沙盒使这种情况的威胁大大降低:内部的进程可以自由使用 CPU 周期和内存——仅此而已。进程不能写入磁盘或显示自己的窗口。在我们提到的 libwep 漏洞案例中,沙盒确保攻击者无法安装或运行恶意软件。实际上,在最初针对员工 iPhone 的 Pegasus 攻击中,攻击者专门针对一个非沙盒化的图片处理进程,以获取手机访问权限,首先突破了通常沙盒化的 iMessage 的边界。当像本例中的 CVE 漏洞被公布时,你仍然需要将 Electron 应用升级到安全版本——但与此同时,攻击者能造成的损害量会大幅度受限。

🌐 The sandbox makes that scenario a lot less scary: A process inside gets to freely use CPU cycles and memory — that’s it. Processes cannot write to disk or display their own windows. In the case of our libwep bug, the sandbox makes sure that an attacker cannot install or run malware. In fact, in the case of the original Pegasus attack on the employee’s iPhone, the attack specifically targeted a non-sandboxed image process to gain access to the phone, first breaking out of the boundaries of the normally sandboxed iMessage. When a CVE like the one in this example is announced, you still have to upgrade your Electron apps to a secure version — but in the meantime, the amount of damage an attacker can do is limited dramatically.

将一个原生 Electron 应用从 sandbox: false 迁移到 sandbox: true 是一项大工程。我知道,因为即使我个人撰写了 Electron 安全指南 的初稿,我也未能将自己的应用迁移到使用它。这个周末情况有所改变,我也建议你进行相应的更改。

🌐 Migrating a vanilla Electron application from sandbox: false to sandbox: true is an undertaking. I know, because even though I have personally written the first draft of the Electron Security Guidelines, I have not managed to migrate one of my own apps to use it. That changed this weekend, and I recommend that you change it, too.

Don’t be scared by the number of line changes, most of it is in package-lock.json

你需要解决两件事:

🌐 There are two things you need to tackle:

  1. 如果你在 preload 脚本或实际的 WebContents 中使用 Node.js 代码,你需要将所有 Node.js 的交互移到主进程(或者,如果你比较高级的话,可以移到一个辅助进程)。考虑到渲染器已经非常强大,很有可能你大部分代码实际上并不需要重构。

    请查阅我们关于进程间通信的文档。在我的案例中,我移动了大量代码并将其封装在 ipcRenderer.invoke()ipcMain.handle() 中,但整个进程很简单,也很快完成。在这里要稍微注意一下你的 API ——如果你创建一个名为 executeCodeAsRoot(code) 的 API,沙箱并不能为你的用户提供太多保护。

  2. 由于启用沙箱会在预加载脚本中禁用 Node.js 集成,因此你无法再使用 require("../my-script")。换句话说,你的预加载脚本需要是一个单独的文件。

    有多种方法可以实现这一点:Webpack、esbuild、parcel 和 rollup 都能完成任务。我使用了 Electron Forge 出色的 Webpack 插件,同样受欢迎的 electron-builder 用户可以使用 electron-webpack

总而言之,整个进程花了我大约四天时间 - 这期间我花了很多时间思考如何驾驭 Webpack 的强大功能,因为我决定利用这个机会以许多其他方式重构我的代码。

🌐 All in all, the entire process took me around four days — and that includes a lot of scratching my head at how to wrangle Webpack’s massive power, since I decided to use the opportunity to refactor my code in plenty of other ways, too.

Electron 26.0.0

· 4 min read

Electron 26.0.0 已经发布!它包括对 Chromium 116.0.5845.62、V8 11.2 和 Node.js 18.16.1 的升级。请往下阅读了解更多详情!

🌐 Electron 26.0.0 has been released! It includes upgrades to Chromium 116.0.5845.62, V8 11.2, and Node.js 18.16.1. Read below for more details!


Electron 团队很高兴地宣布发布 Electron 26.0.0!你可以通过 npm 使用 npm install electron@latest 安装,或从我们的发布网站下载。请继续阅读以了解此次发布的详细信息。

🌐 The Electron team is excited to announce the release of Electron 26.0.0! You can install it with npm via npm install electron@latest or download it from our releases website. Continue reading for details about this release.

如果你有任何反馈,请通过 Twitter 与我们分享,或加入我们的社区 Discord!你可以在 Electron 的 问题追踪器 中报告错误和功能请求。

🌐 If you have any feedback, please share it with us on Twitter, or join our community Discord! Bugs and feature requests can be reported in Electron's issue tracker.

Electron 25.0.0

· 7 min read

Electron 25.0.0 已经发布!它包括对 Chromium 114、V8 11.4 和 Node.js 18.15.0 的升级。请往下阅读了解更多详情!

🌐 Electron 25.0.0 has been released! It includes upgrades to Chromium 114, V8 11.4, and Node.js 18.15.0. Read below for more details!


Electron 团队很高兴地宣布发布 Electron 25.0.0!你可以通过 npm 使用 npm install electron@latest 安装,或从我们的发布网站下载。请继续阅读以了解此次发布的详细信息。

🌐 The Electron team is excited to announce the release of Electron 25.0.0! You can install it with npm via npm install electron@latest or download it from our releases website. Continue reading for details about this release.

如果你有任何反馈,请通过 Twitter 与我们分享,或加入我们的社区 Discord!你可以在 Electron 的 问题追踪器 中报告错误和功能请求。

🌐 If you have any feedback, please share it with us on Twitter, or join our community Discord! Bugs and feature requests can be reported in Electron's issue tracker.

22.x.y 持续支持

🌐 22.x.y Continued Support

如在《告别 Windows 7/8/8.1》(https://www.electronjs.org/blog/windows-7-to-8-1-deprecation-notice) 中所述,Electron 22(Chromium 108)的计划终止支持日期将从 2023 年 5 月 30 日延长至 2023 年 10 月 10 日。Electron 团队将继续为该版本提供安全修复的回溯更新,直至 2023 年 10 月 10 日。10 月的支持日期是根据 Chromium 和 Microsoft 的延长支持日期确定的。自 10 月 11 日起,Electron 团队将仅支持最新的三个稳定主版本,这些版本将不再支持 Windows 7/8/8.1。

🌐 As noted in Farewell, Windows 7/8/8.1, Electron 22's (Chromium 108) planned end of life date will be extended from May 30, 2023 to October 10, 2023. The Electron team will continue to backport any security fixes that are part of this program to Electron 22 until October 10, 2023. The October support date follows the extended support dates from both Chromium and Microsoft. On October 11, the Electron team will drop support back to the latest three stable major versions, which will no longer support Windows 7/8/8.1.

E25(2023年5月)E26(2023年8月)E27(2023年10月)
25.x.y26.x.y27.x.y
24.x.y25.x.y26.x.y
23.x.y24.x.y25.x.y
22.x.y22.x.y--

显著变化

🌐 Notable Changes

  • 在 Electron 的 net 模块中实现了 net.fetch,使用了 Chromium 的网络栈。这与 Node 的 fetch() 不同,后者使用 Node.js 的 HTTP 栈。参见 #36733#36606
  • 添加了 protocol.handle,它取代并弃用 protocol.{register,intercept}{String,Buffer,Stream,Http,File}Protocol#36674
  • 为了与 Chromium 以及微软的 Windows 7/8/8.1 弃用计划保持一致,扩展对 Electron 22 的支持。更多详细信息请参见本文博客文章末尾。

Electron 24.0.0

· 6 min read

Electron 24.0.0 已经发布!它包括对 Chromium 112.0.5615.49、V8 11.2 和 Node.js 18.14.0 的升级。请往下阅读了解更多详情!

🌐 Electron 24.0.0 has been released! It includes upgrades to Chromium 112.0.5615.49, V8 11.2, and Node.js 18.14.0. Read below for more details!


Electron 团队很高兴地宣布发布 Electron 24.0.0!你可以通过 npm 使用 npm install electron@latest 安装,或从我们的发布网站下载。请继续阅读以了解此次发布的详细信息。

🌐 The Electron team is excited to announce the release of Electron 24.0.0! You can install it with npm via npm install electron@latest or download it from our releases website. Continue reading for details about this release.

如果你有任何反馈,请通过 Twitter 与我们分享,或加入我们的社区 Discord!你可以在 Electron 的 问题追踪器 中报告错误和功能请求。

🌐 If you have any feedback, please share it with us on Twitter, or join our community Discord! Bugs and feature requests can be reported in Electron's issue tracker.

Electron 10周年 🎉

· 18 min read

🌐 10 Years of Electron 🎉

electron/electron 仓库的第一次提交是在 2013 年 3 月 13 日[^1]。

🌐 The first commit to the electron/electron repository was on March 13, 2013[^1].

Initial commit on electron/electron by @aroben

经过10年和1192名独立贡献者的27,147次提交后,Electron 已成为当今构建桌面应用最受欢迎的框架之一。这个里程碑是一个完美的机会,让我们庆祝并回顾迄今为止的旅程,同时分享我们在此进程中所学到的经验。

如果没有每一位为项目付出时间和努力的人,我们今天不会站在这里。虽然源代码提交总是最显眼的贡献,但我们同样需要感谢那些报告错误、维护用户模块、提供文档和翻译,以及在网络空间参与 Electron 社区的人。每一份贡献对我们这些维护者来说都是无价的。

🌐 We would not be here today without everyone who has dedicated their time and effort to contribute to the project. Although source code commits are always the most visible contributions, we also have to acknowledge the effort of folks who report bugs, maintain userland modules, provide documentation and translations, and participate in the Electron community across cyberspace. Every contribution is invaluable to us as maintainers.

在我们继续阅读博客文章剩下部分之前:谢谢你。❤️

我们是怎么走到这一步的?

🌐 How did we get here?

Atom Shell 是作为 GitHub Atom 编辑器 的基础而构建的,该编辑器于 2014 年 4 月推出了公开测试版。它从零开始开发,作为当时可用的基于网络的桌面框架(node-webkit 和 Chromium 嵌入式框架)的替代方案。它有一个杀手级功能:嵌入 Node.js 和 Chromium,为 web 技术提供强大的桌面运行环境。

在一年内,Atom Shell 在功能和受欢迎程度上都开始迅速增长。大公司、初创企业以及个人开发者都开始用它来构建应用(一些早期采用者包括 SlackGitKrakenWebTorrent),项目也因此被恰当地重命名为 Electron

🌐 Within a year, Atom Shell began seeing immense growth in capabilities and popularity. Large companies, startups, and individual developers alike had started building apps with it (some early adopters include Slack, GitKraken, and WebTorrent), and the project was aptly renamed to Electron.

从那时起,Electron 就一发不可收拾,持续发展。以下是我们每周下载量的变化情况,由 npmtrends.com 提供:

🌐 From then on, Electron hit the ground running and never stopped. Here’s a look at our weekly download count over time, courtesy of npmtrends.com:

Electron weekly downloads graph over time

Electron v1 于 2016 年发布,承诺提供更稳定的 API 以及更好的文档和工具。Electron v2 于 2018 年发布,推出了语义化版本控制,使 Electron 开发者更容易跟踪发布周期。

🌐 Electron v1 was released in 2016, promising increased API stability and better docs and tooling. Electron v2 was released in 2018 and introduced semantic versioning, making it easier for Electron developers to keep track of the release cycle.

到了 Electron v6,我们改为每 12 周发布一次重大版本,以与 Chromium 的发布节奏保持一致。这一决策意味着项目思维方式的转变,将“拥有最新的 Chromium 版本”从可有可无变为了优先事项。这减少了升级之间的技术债务,使我们更容易保持 Electron 的更新和安全。

🌐 By Electron v6, we shifted to a regular 12-week major release cadence to match Chromium’s. This decision was a change in mentality for the project, bringing “having the most up-to-date Chromium version” from a nice-to-have to a priority. This has reduced the amount of tech debt between upgrades, making it easier for us to keep Electron updated and secure.

从那以后,我们就像一台运转良好的机器,每当 Chromium 发布稳定版时,我们也会在同一天发布新的 Electron 版本。到了 2021 年 Chromium 将发布周期加快到 4 周时,我们能够轻轻一耸肩,并相应地将我们的发布频率提高到 8 周。

🌐 Since then, we’ve been a well-oiled machine, releasing a new Electron version on the same day as every Chromium stable. By the time Chromium sped up their release schedule to 4 weeks in 2021, we were able to shrug our shoulders and increase our release cadence to 8 weeks accordingly.

我们现在已经在使用 Electron v23(且仍在更新中),并且仍然致力于打造最好的跨平台桌面应用运行时。即便近年来 JavaScript 开发工具蓬勃发展,Electron 仍然是桌面应用框架字段中稳定、经过实战考验的中坚力量。如今,Electron 应用随处可见:你可以用它编程(如 Visual Studio Code)、设计(如 Figma)、沟通(如 Slack)、做注意(如 Notion)——以及许多其他应用场景。我们为这一成就感到非常自豪,也感谢每一位让这一切成为可能的人。

🌐 We’re now on Electron v23 (and counting), and are still dedicated to building the best runtime for building cross-platform desktop applications. Even with the boom in JavaScript developer tools in recent years, Electron has remained a stable, battle-tested stalwart of the desktop app framework landscape. Electron apps are ubiquitous nowadays: you can program with Visual Studio Code, design with Figma, communicate with Slack, and take notes with Notion (amongst many other use cases). We’re incredibly proud of this achievement and grateful to everyone who has made it possible.

我们在此进程中学到了什么?

🌐 What did we learn along the way?

走向十周年的道路漫长而曲折。以下是一些帮助我们运营可持续大型开源项目的关键因素。

🌐 The road to the decade mark has been long and winding. Here are some key things that have helped us run a sustainable large open source project.

使用治理模型扩展分布式决策

🌐 Scaling distributed decision-making with a governance model

我们必须克服的一个挑战是,在 Electron 首次爆红之后,如何处理项目的长期方向。我们如何应对作为一个由几十名工程师组成、分布在不同公司、国家和时区的团队的情况?

🌐 One challenge we had to overcome was handling the long-term direction of the project once Electron first exploded in popularity. How do we handle being a team of a couple dozen engineers distributed across companies, countries, and time zones?

在早期,Electron 的维护者团队依赖非正式的协调方式,这对于较小的项目来说快速且轻量,但无法扩展到更广泛的协作中。2019 年,我们转向了一种治理模式,不同的工作组拥有正式的职责范围。这对于简化进程和将项目部分所有权分配给特定维护者起到了重要作用。如今,每个工作组(WG)负责的具体内容是什么?

🌐 In the early days, Electron’s maintainer group relied on informal coordination, which is fast and lightweight for smaller projects, but doesn’t scale to wider collaboration. In 2019, we shifted to a governance model where different working groups have formal areas of responsibility. This has been instrumental in streamlining processes and assigning portions of project ownership to specific maintainers. What is each Working Group (WG) responsible for nowadays?

  • 发布 Electron 版本(发布工作组)
  • 升级 Chromium 和 Node.js(升级工作组)
  • 监督公共 API 设计 (API WG)
  • 保障 Electron 安全(安全工作组)
  • 运行网站、文档和工具(生态系统工作组)
  • 社区和企业拓展(拓展工作组)
  • 社区审核(社区与安全工作组)
  • 维护我们的构建基础设施、维护工具和云服务(基础设施工作组)

差不多在我们转向治理模式的同时,我们也将 Electron 的所有权从 GitHub 转移到了 OpenJS 基金会。虽然最初的核心团队今天仍在微软工作,但他们只是构成 Electron 治理的更大协作团队的一部分。[2]

🌐 Around the same time we shifted to the governance model, we also moved Electron's ownership from GitHub to the OpenJS Foundation. Although the original core team still works at Microsoft today, they are only a part of a larger group of collaborators that form Electron governance.[^2]

虽然这个模式并不完美,但它在全球大流行和持续的宏观经济逆风中一直很适合我们。展望未来,我们计划改进治理章程,以引导我们度过 Electron 的第二个十年。

🌐 While this model isn’t perfect, it has suited us well through a global pandemic and ongoing macroeconomic headwinds. Going forward, we plan on revamping the governance charter to guide us through the second decade of Electron.

info

如果你想了解更多,可以查看 electron/governance 仓库!

🌐 If you want to learn more, check out the electron/governance repository!

社区

🌐 Community

开源项目的社区部分很难,尤其是当你的宣传团队只有十几个工程师,却穿着一件写着“社区经理”的风衣时。不过,作为一个大型开源项目,我们拥有大量用户,利用他们的力量为 Electron 构建用户生态系统是维持项目健康的一个关键部分。

🌐 The community part of open source is hard, especially when your Outreach team is a dozen engineers in a trench coat that says “community manager”. That said, being a large open source project means that we have a lot of users, and harnessing their energy for Electron to build a userland ecosystem is a crucial part of sustaining project health.

我们做了哪些工作来提升社区影响力?

🌐 What have we been doing to develop our community presence?

构建虚拟社区

🌐 Building virtual communities

参与高知名度开源项目

🌐 Participating in high-visibility open source programs

让一切自动化!

🌐 Automate all the things!

截至今天,Electron 的治理团队大约有 30 名活跃维护者。不到一半是全职贡献者,这意味着有很多工作需要分担。我们保持一切顺利运转的秘诀是什么?我们的座右铭是计算机便宜,而人类的时间宝贵。以典型工程师的方式,我们开发了一套自动化支持工具来让我们的工作更轻松。

🌐 Today, Electron governance has about 30 active maintainers. Less than half of us are full-time contributors, which means that there’s a lot of work to go around. What’s our trick to keeping everything running smoothly? Our motto is that computers are cheap, and human time is expensive. In typical engineer fashion, we’ve developed a suite of automated support tooling to make our lives easier.

非 Goma

🌐 Not Goma

Electron 核心代码库是一个庞大的 C++ 代码集合,构建时间一直是限制我们快速发布 bug 修复和新功能的因素。2020 年,我们部署了 Not Goma,这是一个为 Electron 定制的 Google Goma 分布式编译服务的后端。Not Goma 会处理授权用户机器的编译请求,并将编译进程分发到后端的数百个核心上。它还会缓存编译结果,因此其他人编译相同的文件时,只需下载预编译结果。

🌐 The core Electron codebase is a behemoth of C++ code, and build times have always been a limiting factor in how fast we can ship bug fixes and new features. In 2020, we deployed Not Goma, a custom Electron-specific backend for Google’s Goma distributed compiler service. Not Goma processes compilation requests from authorized user’s machines and distributes the process across hundreds of cores in the backend. It also caches the compilation result so that someone else compiling the same files will only need to download the pre-compiled result.

自从推出 Not Goma 以来,维护者的编译时间已经从几小时缩短到几分钟。稳定的互联网连接成为贡献者编译 Electron 的最低要求!

🌐 Since launching Not Goma, compilation times for maintainers have decreased from the scale of hours to minutes. A stable internet connection became the minimum requirement for contributors to compile Electron!

info

如果你是开源贡献者,你也可以尝试使用 Not Goma 的只读缓存,它在默认情况下随 Electron Build Tools 提供。

🌐 If you’re an open source contributor, you can also try Not Goma’s read-only cache, which is available by default with Electron Build Tools.

持续因素身份验证

🌐 Continuous Factor Authentication

持续因子认证(CFA) 是围绕 npm 的双因素认证(2FA)系统的一层自动化,我们将其与 semantic-release 结合,以管理我们各个 @electron/ npm 包的安全和自动化发布。

虽然 semantic-release 已经自动化了 npm 包的发布进程,但它需要关闭双因素认证或传入一个绕过此限制的秘密令牌。

🌐 While semantic-release already automates the npm package publishing process, it requires turning off two-factor authentication or passing in a secret token that bypasses this restriction.

我们构建了 CFA,用于为 npm 双因素认证 (2FA) 提供基于时间的一次性密码 (TOTP) 到任意 CI 作业,从而让我们能够利用 semantic-release 的自动化,同时保持双因素认证的额外安全性。

🌐 We built CFA to deliver a time-based one-time password (TOTP) for npm 2FA to arbitrary CI jobs, allowing us to harness the automation of semantic-release while keeping the additional security of two-factor authentication.

我们使用带有 Slack 集成前端的 CFA,使维护者可以从任何安装了 Slack 的设备上验证软件包发布,只要他们手边有 TOTP 生成器。

🌐 We use CFA with a Slack integration front-end, allowing maintainers to validate package publishing from any device they have Slack on, as long as they have their TOTP generator handy.

info

如果你想在自己的项目中尝试 CFA,可以查看 GitHub 仓库文档! 如果你使用 CircleCI 作为 CI 提供商,我们还有 一个方便的 orb 可以快速使用 CFA 搭建项目。

🌐 If you want to try CFA out in your own projects, check out the GitHub repository or the docs! If you use CircleCI as your CI provider, we also have a handy orb to quickly scaffold a project with CFA.

Sheriff

Sheriff 是我们编写的一个开源工具,用于自动管理 GitHub、Slack 和 Google Workspace 的权限。

Sheriff 的核心价值主张是权限管理应该是一个透明的进程。它使用一个单一的 YAML 配置文件来指定上述所有服务的权限。使用 Sheriff,获得仓库的协作者身份或创建一个新的邮件列表就像批准并合并一个 PR 一样简单。

🌐 Sheriff’s key value proposition is that permission management should be a transparent process. It uses a single YAML config file that designates permissions across all the above listed services. With Sheriff, getting collaborator status on a repo or creating a new mailing list is as easy as getting a PR approved and merged.

Sheriff 还有一个审计日志,会发布到 Slack,当 Electron 组织中的任何地方发生可疑活动时,会警告管理员。

🌐 Sheriff also has an audit log that posts to Slack, warning admins when suspicious activity occurs anywhere in the Electron organization.

……以及我们所有的 GitHub 机器人

🌐 …and all our GitHub bots

GitHub 是一个具有丰富 API 可扩展性的平台,并且拥有一个名为 Probot 的第一方机器人应用框架。为了帮助我们专注于工作中更具创造性的部分,我们开发了一系列小型机器人,帮助我们处理繁琐的工作。以下是几个示例:

🌐 GitHub is a platform with rich API extensibility and a first-party bot application framework called Probot. To help us focus on the more creative parts of our job, we built out a suite of smaller bots that help do the dirty work for us. Here are a few examples:

  • Sudowoodo 自动化了 Electron 的整个发布进程,从启动构建到将发布资源上传到 GitHub 和 npm,一应俱全。
  • Trop 通过尝试根据 GitHub PR 标签将补丁挑选到以前的发布分支,自动化 Electron 的回移植进程。
  • Roller 自动化 Electron 的 Chromium 和 Node.js 依赖的滚动升级。
  • Cation 是我们用于 electron/electron PR 的状态检查机器人。

总而言之,我们的机器人小家族极大地提高了开发者的生产力!

🌐 Altogether, our little family of bots has given us a huge boost in developer productivity!

下一步是什么?

🌐 What’s next?

随着我们作为一个项目进入第二个十年,你可能会问:Electron 的下一步是什么?

🌐 As we enter our second decade as a project, you might be asking: what’s next for Electron?

我们将与 Chromium 的发布节奏保持同步,每 8 周发布一次 Electron 的新主版本,使框架保持最新的 Web 平台和 Node.js 特性,同时确保企业级应用的稳定性和安全性。

🌐 We’re going to stay in sync with Chromium's release cadence, releasing new major versions of Electron every 8 weeks, keeping the framework updated with the latest and greatest from the web platform and Node.js while maintaining stability and security for enterprise-grade applications.

我们通常会在即将开展的计划变得具体时发布相关新闻。如果你想了解未来的版本、功能和一般项目更新,可以阅读我们的博客并关注我们的社交媒体账户(TwitterMastodon)!

🌐 We generally announce news on upcoming initiatives when they become concrete. If you want to keep up with future releases, features, and general project updates, you can read our blog and follow our social media profiles (Twitter and Mastodon)!

[^1]: 这实际上是来自 electron-archive/brightray 项目 的第一个提交,该项目在 2017 年被并入 Electron 并合并了其 git 历史记录。但谁在乎呢? 今天是我们的生日,所以我们可以自己定规则!

[^2]:与大众认知相反,Electron 目前不再由 GitHub 或微软拥有,而是如今属于 OpenJS 基金会 的一部分。

Electron 23.0.0

· 6 min read

Electron 23.0.0 已发布!它包括对 Chromium 110、V8 11.0 和 Node.js 18.12.1 的升级。此外,不再支持 Windows 7/8/8.1。请阅读以下内容了解更多详情!

🌐 Electron 23.0.0 has been released! It includes upgrades to Chromium 110, V8 11.0, and Node.js 18.12.1. Additionally, support for Windows 7/8/8.1 has been dropped. Read below for more details!


Electron 团队很高兴地宣布发布 Electron 23.0.0!你可以通过 npm 使用 npm install electron@latest 安装,或从我们的发布网站下载。请继续阅读以了解此次发布的详细信息。

🌐 The Electron team is excited to announce the release of Electron 23.0.0! You can install it with npm via npm install electron@latest or download it from our releases website. Continue reading for details about this release.

如果你有任何反馈,请通过 Twitter 与我们分享,或加入我们的社区 Discord!你可以在 Electron 的 问题追踪器 中报告错误和功能请求。

🌐 If you have any feedback, please share it with us on Twitter, or join our community Discord! Bugs and feature requests can be reported in Electron's issue tracker.

放弃对 Windows 7/8/8.1 的支持

🌐 Dropping Windows 7/8/8.1 Support

Electron 23 不再支持 Windows 7/8/8.1。Electron 遵循 Chromium 的计划弃用政策,该政策将在 Chromium 109 中弃用对 Windows 7/8/8.1 以及 Windows Server 2012 和 2012 R2 的支持(点击此处了解更多信息)(https://support.google.com/chrome/thread/185534985/sunsetting-support-for-windows-7-8-8-1-in-early-2023?hl=en)。

🌐 Electron 23 no longer supports Windows 7/8/8.1. Electron follows the planned Chromium deprecation policy, which will deprecate Windows 7/8/8.1 , as well as Windows Server 2012 and 2012 R2 support in Chromium 109 (read more here).

Electron 22.0.0

· 9 min read

Electron 22.0.0 已发布!它包含一个新的实用程序进程 API,对 Windows 7/8/8.1 的支持进行了更新,并升级了 Chromium 108、V8 10.8 和 Node.js 16.17.1。详见以下内容!

🌐 Electron 22.0.0 has been released! It includes a new utility process API, updates for Windows 7/8/8.1 support, and upgrades to Chromium 108, V8 10.8, and Node.js 16.17.1. Read below for more details!


Electron 团队很高兴地宣布发布 Electron 22.0.0!你可以通过 npm 使用 npm install electron@latest 安装,或从我们的发布网站下载。请继续阅读以了解此次发布的详细信息。

🌐 The Electron team is excited to announce the release of Electron 22.0.0! You can install it with npm via npm install electron@latest or download it from our releases website. Continue reading for details about this release.

如果你有任何反馈,请通过 Twitter 与我们分享,或加入我们的社区 Discord!你可以在 Electron 的 问题追踪器 中报告错误和功能请求。

🌐 If you have any feedback, please share it with us on Twitter, or join our community Discord! Bugs and feature requests can be reported in Electron's issue tracker.

Windows 7/8/8.1 支持更新

🌐 Windows 7/8/8.1 Support Update

info

2023/02/16:关于 Windows Server 2012 支持的更新

上个月,谷歌宣布Chrome 109将继续为Windows Server 2012和Windows Server 2012 R2提供关键安全修复,直到2023年10月10日。根据这一安排,Electron 22(Chromium 108)的计划终止支持日期将从2023年5月30日延长至2023年10月10日。Electron 团队将继续将该计划中的任何安全修复回移到 Electron 22,直至2023年10月10日。

🌐 Last month, Google announced that Chrome 109 would continue to receive critical security fixes for Windows Server 2012 and Windows Server 2012 R2 until October 10, 2023. In accordance, Electron 22's (Chromium 108) planned end of life date will be extended from May 30, 2023 to October 10, 2023. The Electron team will continue to backport any security fixes that are part of this program to Electron 22 until October 10, 2023.

请注意,我们将不会对 Windows 7/8/8.1 提供额外的安全修复。此外,正如之前所宣布的,Electron 23(Chromium 110)仅在 Windows 10 及以上版本上运行。

🌐 Note that we will not make additional security fixes for Windows 7/8/8.1. Also, Electron 23 (Chromium 110) will only function on Windows 10 and above as previously announced.

Electron 22 将是最后一个支持 Windows 7/8/8.1 的 Electron 主要版本。Electron 遵循 Chromium 的计划弃用政策,该政策将在 Chromium 109 中弃用对 Windows 7/8/8.1 的支持(在这里了解更多信息](https://support.google.com/chrome/thread/185534985/sunsetting-support-for-windows-7-8-8-1-in-early-2023?hl=en))。

🌐 Electron 22 will be the last Electron major version to support Windows 7/8/8.1. Electron follows the planned Chromium deprecation policy, which will deprecate Windows 7/8/8.1 support in Chromium 109 (read more here).

Electron 23 及更高主要版本将不支持 Windows 7/8/8.1。

🌐 Windows 7/8/8.1 will not be supported in Electron 23 and later major releases.

显著变化

🌐 Notable Changes

UtilityProcess API #36089

新的 UtilityProcess 主进程模块允许创建一个轻量级的 Chromium 子进程,该子进程仅集成了 Node.js,同时也允许使用 MessageChannel 与沙盒渲染器进行通信。该 API 基于 Node.js child_process.fork 设计,以便于更轻松的过渡,主要区别在于入口点 modulePath 必须来自打包后的应用内部,以确保只加载受信任的脚本。此外,该模块默认阻止与渲染器建立通信通道,从而维持主进程是应用中唯一受信任进程的约定。

🌐 The new UtilityProcess main process module allows the creation of a lightweight Chromium child process with only Node.js integration while also allowing communication with a sandboxed renderer using MessageChannel. The API was designed based on Node.js child_process.fork to allow for easier transition, with one primary difference being that the entry point modulePath must be from within the packaged application to allow only for trusted scripts to be loaded. Additionally the module prevents establishing communication channels with renderers by default, upholding the contract in which the main process is the only trusted process in the application.

你可以在我们的文档中阅读有关 新 UtilityProcess API 的更多信息

🌐 You can read more about the new UtilityProcess API in our docs here.

其他高亮的变更

🌐 Additional Highlighted Changes

  • 在 Linux 和 Windows 上新增了对 Web 蓝牙 PIN 配对的支持。 #35416
  • 添加了 LoadBrowserProcessSpecificV8Snapshot 作为一个新的开关,它将允许主进程/浏览器进程从 browser_v8_context_snapshot.bin 的文件加载其 v8 快照。其他进程将使用与当前相同的路径。 #35266
  • 添加了 WebContents.opener 用于访问窗口打开者,以及 webContents.fromFrame(frame) 用于获取与 WebFrameMain 实例对应的 WebContents。#35140
  • 通过新的会话处理器 ses.setDisplayMediaRequestHandler 添加了对 navigator.mediaDevices.getDisplayMedia 的支持。 #30702

再见,Windows 7/8/8.1

· 5 min read

Electron 将从 Electron 23 开始停止对 Windows 7、Windows 8 和 Windows 8.1 的支持。

🌐 Electron will end support of Windows 7, Windows 8 and Windows 8.1 beginning in Electron 23.


根据 Chromium 的废弃政策,Electron 将从 Electron 23 开始停止对 Windows 7、Windows 8 和 Windows 8.1 的支持。这与微软在 2023 年 1 月 10 日对 Windows 7 ESUWindows 8.1 扩展支持 结束支持的时间一致。

Electron 22 将是最后一个支持 Windows 10 之前版本的主要 Electron 版本。Windows 7/8/8.1 将不再在 Electron 23 及以后的主要版本中得到支持。旧版本的 Electron 将继续在 Windows 7 上运行,我们将继续为 Electron 22.x 系列发布修补程序,直到 2023 年 5 月 30 日,届时 Electron 将结束对 22.x 的支持(根据我们的支持时间表)。

🌐 Electron 22 will be the last Electron major version to support Windows versions older than 10. Windows 7/8/8.1 will not be supported in Electron 23 and later major releases. Older versions of Electron will continue to function on Windows 7, and we will continue to release patches for Electron the 22.x series until May 30 2023, when Electron will end support for 22.x (according to our support timeline).

为什么要弃用?

🌐 Why deprecate?

Electron 遵循计划中的 Chromium 弃用政策,该政策将在 Chromium 109 中弃用支持(在此阅读有关 Chromium 时间表的更多信息)。Electron 23 将包含 Chromium 110,它将不再支持较旧版本的 Windows。

🌐 Electron follows the planned Chromium deprecation policy, which will deprecate support in Chromium 109 (read more about Chromium's timeline here). Electron 23 will contain Chromium 110, which won’t support older versions of Windows.

因此,包含 Chromium 108 的 Electron 22 将成为最后一个受支持的版本。

🌐 Electron 22, which contains Chromium 108, will thus be the last supported version.

弃用时间表

🌐 Deprecation timeline

以下是我们计划的弃用时间表:

🌐 The following is our planned deprecation timeline:

  • 2022年12月:Electron 团队正在进入假期的平静期
  • 2023年1月:所有支持的发布分支均接受与 Windows 7 和 8 相关的问题。
  • 2023年2月7日:Electron 23 发布。
  • 2023年2月8日 - 2023年5月29日:Electron将继续接受对早于Electron 23的支持版本的修复。
  • 2023年5月30日:Electron 22 达到其支持周期的终点。

这对开发者意味着什么:

🌐 What this means for developers:

  • Electron 团队将接受与 Windows 7/8/8.1 相关的问题和修复,以支持稳定的产品线,直到每个产品线达到其支持周期的结束。
    • 这特别适用于 Electron 22、Electron 21 和 Electron 20。
  • 对于 Electron 23 之前的 Electron 版本,将接受与 Windows 7/8/8.1 相关的新问题。
    • 任何较新的发行版将不再接受新问题。
  • 一旦 Electron 22 达到其支持周期的结束,所有与 Windows 7/8/8.1 相关的现有问题都将被关闭。
info

2023/02/16:关于 Windows Server 2012 支持的更新

上个月,谷歌宣布Chrome 109将继续为Windows Server 2012和Windows Server 2012 R2提供关键安全修复,直到2023年10月10日。根据这一安排,Electron 22(Chromium 108)的计划终止支持日期将从2023年5月30日延长至2023年10月10日。Electron 团队将继续将该计划中的任何安全修复回移到 Electron 22,直至2023年10月10日。

🌐 Last month, Google announced that Chrome 109 would continue to receive critical security fixes for Windows Server 2012 and Windows Server 2012 R2 until October 10, 2023. In accordance, Electron 22's (Chromium 108) planned end of life date will be extended from May 30, 2023 to October 10, 2023. The Electron team will continue to backport any security fixes that are part of this program to Electron 22 until October 10, 2023.

请注意,我们将不会对 Windows 7/8/8.1 提供额外的安全修复。此外,正如之前所宣布的,Electron 23(Chromium 110)仅在 Windows 10 及以上版本上运行。

🌐 Note that we will not make additional security fixes for Windows 7/8/8.1. Also, Electron 23 (Chromium 110) will only function on Windows 10 and above as previously announced.

下一步是什么

🌐 What's next

如果你有任何问题或疑虑,请随时写信至 info@electronjs.org 联系我们。你也可以在我们的官方 Electron Discord 社区寻求支持。

🌐 Please feel free to write to us at info@electronjs.org if you have any questions or concerns. You can also find community support in our official Electron Discord.

寂静之地2(22年12月)

· 2 min read

Electron 项目将在 2022 年 12 月暂停,然后在 2023 年 1 月恢复全速运行。

🌐 The Electron project will pause for the month of December 2022, then return to full speed in January 2023.

via GIPHY


12 月会有什么相同之处?

🌐 What will be the same in December

  1. 零日漏洞及其他主要的安全相关版本将在必要时发布。安全事件应通过 SECURITY.md 报告。
  2. 行为准则 的举报和管理将继续进行。

12 月会有什么不同?

🌐 What will be different in December

  1. 十二月没有新的稳定版本。十二月的最后两周没有夜间版和测试版发布。
  2. 除了少数例外,无需进行拉取请求审核或合并。
  3. 任何代码库均未更新问题跟踪器。
  4. 维护人员未提供 Discord 调试帮助。
  5. 无需更新社交媒体内容。

为什么会发生这种情况?

🌐 Why is this happening?

继2021年12月的安静月份活动成功之后,我们希望在2022年再次推出。对于大多数公司来说,12月仍然是一个比较安静的月份,所以我们希望给维护者们一个充电的机会。大家都在期待2023年,我们也期待美好的事情到来!我们鼓励其他项目考虑采取类似的措施。

🌐 With the success of December Quiet Month 2021, we wanted to bring it back for 2022. December continues to be a quiet month for most companies, so we want to give our maintainers a chance to recharge. Everyone is looking forward to 2023, and we expect good things to come! We encourage other projects to consider similar measures.