Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
hazel-server
Advanced tools
This project lets you deploy an update server for Electron apps with ease: You only need to click a button.
The result will be faster and more lightweight than any other solution out there! :rocket:
Open this link in a new tab to deploy Hazel on Vercel:
Once it's deployed, paste the deployment address into your code (please keep in mind that updates should only occur in the production version of the app, not while developing):
const { app, autoUpdater } = require('electron')
const server = <your-deployment-url>
const url = `${server}/update/${process.platform}/${app.getVersion()}`
autoUpdater.setFeedURL({ url })
That's it! :white_check_mark:
From now on, the auto updater will ask your Hazel deployment for updates!
The following environment variables can be used optionally:
INTERVAL
: Refreshes the cache every x minutes (restrictions)PRE
: When defined with a value of 1
, only pre-releases will be cachedTOKEN
: Your GitHub token (for private repos)URL
: The server's URL (for private repos - when running on Vercel, this field is filled with the URL of the deployment automatically)Since Hazel routes all the traffic for downloading the actual application files to GitHub Releases, you can use their API to determine the download count for a certain release.
As an example, check out the latest Hyper release and search for mac.zip
. You'll find a release containing a sub property named download_count
with the amount of downloads as its value.
Displays an overview page showing the cached repository with the different available platforms and file sizes. Links to the repo, releases, specific cached version and direct downloads for each platform are present.
Automatically detects the platform/OS of the visitor by parsing the user agent and then downloads the appropriate copy of your application.
If the latest version of the application wasn't yet pulled from GitHub Releases, it will return a message and the status code 404
. The same happens if the latest release doesn't contain a file for the detected platform.
Accepts a platform (like "darwin" or "win32") to download the appropriate copy your app for. I generally suggest using either process.platform
(more) or os.platform()
(more) to retrieve this string.
If the cache isn't filled yet or doesn't contain a download link for the specified platform, it will respond like /
.
Checks if there is an update available by reading from the cache.
If the latest version of the application wasn't yet pulled from GitHub Releases, it will return the 204
status code. The same happens if the latest release doesn't contain a file for the specified platform.
This endpoint was specifically crafted for the Windows platform (called "win32" in Node.js).
Since the Windows version of Squirrel (the software that powers auto updates inside Electron) requires access to a file named "RELEASES" when checking for updates, this endpoint will respond with a cached version of the file that contains a download link to a .nupkg
file (the application update).
You can add Hazel to an existing HTTP server, if you want. For example, this will allow you to implement custom analytics on certain paths.
const hazel = require('hazel-server')
http.createServer((req, res) => {
hazel(req, res)
})
cd hazel
vercel dev
Huge thanks to my (@leo's) friend Andy, who suggested the name "Hazel" (since the auto updater software inside Electron is called "Squirrel") and Matheus for collecting ideas with me.
Leo Lamprecht (@notquiteleo) - Vercel
FAQs
Lightweight update server for Electron apps
The npm package hazel-server receives a total of 321 weekly downloads. As such, hazel-server popularity was classified as not popular.
We found that hazel-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 80 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.