[Snyk] Security upgrade electron-updater from 6.1.7 to 6.3.0

[idanbe4]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• desktop/package.json
• desktop/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Improper Verification of Cryptographic Signature SNYK-JS-ELECTRONUPDATER-7431097	589

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[dryrunsecurity]

DryRun Security Summary

The pull request updates the electron-updater dependency from version 6.1.7 to 6.3.0 in the desktop/package.json and desktop/package-lock.json files, which is generally a positive change from an application security perspective, but it's important to review the changes and thoroughly test the application to ensure there are no regressions or unintended behavior.

Expand for full summary

Summary:

The code changes in this pull request involve updating the electron-updater dependency from version 6.1.7 to 6.3.0 in the desktop/package.json and desktop/package-lock.json files. This is generally a positive change from an application security perspective, as dependency updates often include security fixes, bug fixes, and feature improvements.

It's important to review the changelog or release notes for the electron-updater dependency to understand what changes are included in the new version. This can help determine if there are any potential security implications or breaking changes that need to be considered before merging the pull request. Additionally, it's a good practice to thoroughly test the application after updating dependencies to ensure that the changes do not introduce any regressions or unintended behavior.

Overall, this code change appears to be a routine dependency update, which is generally a positive step from an application security perspective. However, it's important to review the details of the changes to fully understand the potential impact.

Files Changed:

1. desktop/package.json: This file has been updated to use the electron-updater dependency version 6.3.0 instead of the previous version 6.1.7.
2. desktop/package-lock.json: This file has also been updated to reflect the change in the electron-updater dependency version.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.