hexvero

Example output. This page was generated by hexvero 0.8.0 from the two example builds in examples/. It is static: it cannot open or analyze your files. To run the same thing on your machine: npx hexvero demo.

What changed: notesdesk-1.4.0.asar → notesdesk-1.5.0.asar

Two builds of NotesDesk, a small Electron app written for these examples. Both were read statically; neither was run. Open a place to see the lines it was read from.

Window settings to review

main.js::win nodeIntegrationInEffect on → off less permissive
main.js::win sandboxInEffect off → on less permissive

Whether a change matters depends on what the window loads. This is a fact to review, not a verdict.

Changes

`interfaces`

added preload.js::notesdesk::checkUpdate link direct

in 1.5.0

preload.js:9

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  checkUpdate: () => ipcRenderer.invoke("update:check"),10});11

handler main.js:30

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.handle("update:check", async () => fetch("https://updates.notesdesk.example/latest.json").then((r) => r.json()));31// The channel name comes from the environment at run time, so no static reading can name it.32for (const plugin of (process.env.NOTESDESK_PLUGINS ?? "").split(",").filter(Boolean))33  ipcMain.handle(`plugin:${plugin}`, () => store.get(`plugins.${plugin}`));

removed preload.js::notesdesk::openInShell link direct

in 1.4.0

preload.js:9

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  openInShell: (target) => ipcRenderer.send("shell:open", target),10});11

handler main.js:30

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.on("shell:open", (_e, target) => shell.openPath(target));31 32app.whenReady().then(createWindow);33app.on("window-all-closed", () => app.quit());

`contextBridge`

added notesdesk::checkUpdate

in 1.5.0

preload.js:9

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  checkUpdate: () => ipcRenderer.invoke("update:check"),10});11

removed notesdesk::openInShell

in 1.4.0

preload.js:9

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  openInShell: (target) => ipcRenderer.send("shell:open", target),10});11

`ipcChannels`

added update:check

in 1.5.0

receiver main.js:30

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.handle("update:check", async () => fetch("https://updates.notesdesk.example/latest.json").then((r) => r.json()));31// The channel name comes from the environment at run time, so no static reading can name it.32for (const plugin of (process.env.NOTESDESK_PLUGINS ?? "").split(",").filter(Boolean))33  ipcMain.handle(`plugin:${plugin}`, () => store.get(`plugins.${plugin}`));

sender preload.js:9

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  checkUpdate: () => ipcRenderer.invoke("update:check"),10});11

removed shell:open

in 1.4.0

receiver main.js:30

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.on("shell:open", (_e, target) => shell.openPath(target));31 32app.whenReady().then(createWindow);33app.on("window-all-closed", () => app.quit());

sender preload.js:9

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  openInShell: (target) => ipcRenderer.send("shell:open", target),10});11

`windows`

changed main.js::win

nodeIntegration true → false
nodeIntegrationInEffect "on" → "off"
sandbox false → true
sandboxInEffect "off" → "on"

in 1.5.0

main.js:8

5const store = new Store(path.join(app.getPath("userData"), "settings.json"));6 7function createWindow() {8  const win = new BrowserWindow({9    width: 1100,10    height: 720,11    webPreferences: {

`webPreferences`

changed main.js::win::nodeIntegration

value true → false

in 1.5.0

main.js:14

11    webPreferences: {12      preload: path.join(__dirname, "preload.js"),13      contextIsolation: true,14      nodeIntegration: false,15      sandbox: true,16    },17  });

changed main.js::win::sandbox

value false → true

in 1.5.0

main.js:15

12      preload: path.join(__dirname, "preload.js"),13      contextIsolation: true,14      nodeIntegration: false,15      sandbox: true,16    },17  });18  win.loadFile("renderer/index.html");

`endpoints`

added main.js::fetch::https://updates.notesdesk.example/latest.json literal

in 1.5.0

main.js:30

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.handle("update:check", async () => fetch("https://updates.notesdesk.example/latest.json").then((r) => r.json()));31// The channel name comes from the environment at run time, so no static reading can name it.32for (const plugin of (process.env.NOTESDESK_PLUGINS ?? "").split(",").filter(Boolean))33  ipcMain.handle(`plugin:${plugin}`, () => store.get(`plugins.${plugin}`));

`storage`

added renderer/app.bundle.js::localStorage::notesdesk.telemetry::read literal

in 1.5.0

renderer/app.bundle.js:15

12  return res.json();13}14async function telemetry(event) {15  if (localStorage.getItem("notesdesk.telemetry") !== "on") return;16  await fetch("https://telemetry.notesdesk.example/collect", { method: "POST", body: JSON.stringify({ event, ts: Date.now() }) });17}18/***/ }),

`urls`

added main.js::https://updates.notesdesk.example/latest.json literal

in 1.5.0

main.js:30

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.handle("update:check", async () => fetch("https://updates.notesdesk.example/latest.json").then((r) => r.json()));31// The channel name comes from the environment at run time, so no static reading can name it.32for (const plugin of (process.env.NOTESDESK_PLUGINS ?? "").split(",").filter(Boolean))33  ipcMain.handle(`plugin:${plugin}`, () => store.get(`plugins.${plugin}`));

Not established

1.5.0: 1 IPC call(s) pass a channel that is not a literal or a constant that could be followed (a parameter, a computed value). They are in the collection ipc without a channel: ipcMain.handle at main.js:33. ipc_channel_unresolved
Absence from a list means hexvero did not find it in the files it read, not that the app cannot do it. Nothing here was observed running.

Reproduce

npx hexvero demo
npx hexvero compare hexvero-demo/notesdesk-1.4.0.asar hexvero-demo/notesdesk-1.5.0.asar --report report.md
npx hexvero ui --demo --open

The Markdown report of this comparison: report.md.