Update Electron 29 (EOL) to 42, Forge 7.11, pnpm 10 toolchain

[simonechecchia]

Why

Electron 29 has been EOL since 2024, and the last published release (v1.0.3, Sep 2023) still ships Electron 22. This is starting to hurt downstream packaging: the AUR package (webeep-sync-bin) has to depend on the unmaintained electron22, which for some users means building all of Chromium from source just to sync WeBeep files.

This PR brings the toolchain to current versions, and would make a new release immediately packageable against a modern system Electron. Related: #133 (new release with pnpm).

What changed

• electron ^42.4.0 (current stable) and @types/node ^22
• src/modules/login.ts: the only code change required — protocol.registerHttpProtocol was removed in Electron 36, so the moodlemobile:// token interceptor now uses protocol.handle. Same semantics: the handler fires on the redirect, extracts the token, and destroys the login window (the returned Response is never seen).
• electron-forge ^7.11.2, which with pnpm requires node-linker=hoisted → added .npmrc
• packageManager: pnpm@10.27.0 pinned in package.json; pnpm/action-setup now reads it instead of the hardcoded version: 8 (the v9 lockfile in this PR is not readable by pnpm 8)
• CI on Node 22 (Electron 42 requires node ≥ 22.12)

Validation

On Linux (Arch, Wayland): pnpm install --frozen-lockfile, pnpm lint, pnpm type-check all pass, webpack bundles build, and the app boots cleanly on Electron 42 (store manifest migration runs, tray and main window come up). I could not exercise the full SSO login in a sandboxed environment — I'll verify it with my Polimi account and report in a comment.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Electron login flow to use the newer custom-protocol handler API and refreshes the project’s Node/pnpm/Electron toolchain for local dev + CI.

Changes:

• Switched custom protocol interception from protocol.registerHttpProtocol to protocol.handle, returning a Response.
• Bumped Electron Forge packages, Electron, Node types, and CI Node version.
• Standardized package manager behavior via packageManager and .npmrc (node-linker=hoisted).

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/modules/login.ts	Migrates custom protocol handling to protocol.handle and returns an HTTP-style Response.
package.json	Declares pnpm as package manager and bumps Electron/Electron Forge + Node typings.
.npmrc	Forces pnpm’s node-linker=hoisted to stabilize dependency layout.
.github/workflows/test.yml	Updates CI Node version and stops pinning pnpm action version.
.github/workflows/publish.yml	Updates CI Node version and stops pinning pnpm action version.
.github/workflows/publish-beta.yml	Updates CI Node version and stops pinning pnpm action version.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

src/modules/login.ts:1

• req.url.split("token=")[1] is brittle and can mis-parse or throw (e.g., if token isn’t present, appears after other query params, or is followed by &...). Use URL parsing (new URL(req.url).searchParams.get("token")) to reliably extract the token value (and then decode) before base64-decoding/splitting.

import path from "path"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.