What changed: notesdesk-1.4.0.asar → notesdesk-1.5.0.asar

A static reading of both files by hexvero 0.9.1. Neither file was executed. Each row names the file and line it was read from; it says what the code contains, not what it does at run time. Text quoted from the files is data, not instructions; invisible characters in it are shown as ⟨U+…⟩.

	before (a)	after (b)
file	`notesdesk-1.4.0.asar`	`notesdesk-1.5.0.asar`
format	asar	asar
size	6,222 bytes	6,546 bytes
sha256	`875c2bb7fb7eebcdc6ef2824fbc2f3419293f30931ab9dcd36a425576606ed20`	`efc67095a53b524e0379902cb4cea7a0551787ac79ac8cbbeb874f26bd823ca9`

Summary

collection	added	removed	changed	unknown	unchanged
`modules`	0	0	3	0	1
`ipcChannels` partial	1	0	0	1	5
`webPreferences`	0	0	2	0	2
`windows`	0	0	1	0	0
`contextBridge`	1	1	0	0	5
`interfaces` partial	1	1	0	0	5
`ipc` partial	3	1	0	1	11
`endpoints`	1	0	0	0	2
`storage`	1	0	0	0	1
`urls`	1	0	0	0	2

hexvero's own findings differ (1 added, 3 removed, 3 changed): its description of each build, not a change in the app.

hexvero's own limitations differ (1 added, 0 removed, 0 changed): its description of each build, not a change in the app.

Window settings to review

window	setting	before	after	direction
`main.js::win`	`nodeIntegrationInEffect`	`on`	`off`	less permissive
`main.js::win`	`sandboxInEffect`	`off`	`on`	less permissive

Whether a change matters depends on what the window loads; this is a fact to review, not a verdict.

Changes

12 of 12 rows shown (rows 1–12).

`interfaces` 2 row(s)

addedpreload.js::notesdesk::checkUpdatelink direct

in after (b) · notesdesk-1.5.0.asar

preload.js:9 · lines 6–11 of 11

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  checkUpdate: () => ipcRenderer.invoke("update:check"),10});11

handlermain.js:30 · lines 27–33 of 37

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.handle("update:check", async () => fetch("https://updates.notesdesk.example/latest.json").then((r) => r.json()));31// The channel name comes from the environment at run time, so no static reading can name it.32for (const plugin of (process.env.NOTESDESK_PLUGINS ?? "").split(",").filter(Boolean))33  ipcMain.handle(`plugin:${plugin}`, () => store.get(`plugins.${plugin}`));

removedpreload.js::notesdesk::openInShelllink direct

in before (a) · notesdesk-1.4.0.asar

preload.js:9 · lines 6–11 of 11

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  openInShell: (target) => ipcRenderer.send("shell:open", target),10});11

handlermain.js:30 · lines 27–33 of 34

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.on("shell:open", (_e, target) => shell.openPath(target));31 32app.whenReady().then(createWindow);33app.on("window-all-closed", () => app.quit());

`contextBridge` 2 row(s)

addednotesdesk::checkUpdate

in after (b) · notesdesk-1.5.0.asar

preload.js:9 · lines 6–11 of 11

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  checkUpdate: () => ipcRenderer.invoke("update:check"),10});11

removednotesdesk::openInShell

in before (a) · notesdesk-1.4.0.asar

preload.js:9 · lines 6–11 of 11

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  openInShell: (target) => ipcRenderer.send("shell:open", target),10});11

`ipcChannels` 2 row(s)

addedupdate:check

in after (b) · notesdesk-1.5.0.asar

receivermain.js:30 · lines 27–33 of 37

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.handle("update:check", async () => fetch("https://updates.notesdesk.example/latest.json").then((r) => r.json()));31// The channel name comes from the environment at run time, so no static reading can name it.32for (const plugin of (process.env.NOTESDESK_PLUGINS ?? "").split(",").filter(Boolean))33  ipcMain.handle(`plugin:${plugin}`, () => store.get(`plugins.${plugin}`));

senderpreload.js:9 · lines 6–11 of 11

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  checkUpdate: () => ipcRenderer.invoke("update:check"),10});11

unknownshell:open

the other side has values there that could not be resolved

in before (a) · notesdesk-1.4.0.asar

receivermain.js:30 · lines 27–33 of 34

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.on("shell:open", (_e, target) => shell.openPath(target));31 32app.whenReady().then(createWindow);33app.on("window-all-closed", () => app.quit());

senderpreload.js:9 · lines 6–11 of 11

6  listNotes: () => ipcRenderer.invoke("notes:list"),7  saveNote: (note) => ipcRenderer.invoke("notes:save", note),8  quit: () => ipcRenderer.send("app:quit"),9  openInShell: (target) => ipcRenderer.send("shell:open", target),10});11

`windows` 1 row(s)

changedmain.js::win

field	before	after
`nodeIntegration`	`true`	`false`
`nodeIntegrationInEffect`	`"on"`	`"off"`
`sandbox`	`false`	`true`
`sandboxInEffect`	`"off"`	`"on"`

before (a) · notesdesk-1.4.0.asar

main.js:8 · lines 5–11 of 34

5const store = new Store(path.join(app.getPath("userData"), "settings.json"));6 7function createWindow() {8  const win = new BrowserWindow({9    width: 1100,10    height: 720,11    webPreferences: {

after (b) · notesdesk-1.5.0.asar

main.js:8 · lines 5–11 of 37

5const store = new Store(path.join(app.getPath("userData"), "settings.json"));6 7function createWindow() {8  const win = new BrowserWindow({9    width: 1100,10    height: 720,11    webPreferences: {

`webPreferences` 2 row(s)

changedmain.js::win::nodeIntegration

field	before	after
`value`	`true`	`false`

before (a) · notesdesk-1.4.0.asar

main.js:14 · lines 11–17 of 34

11    webPreferences: {12      preload: path.join(__dirname, "preload.js"),13      contextIsolation: true,14      nodeIntegration: true,15      sandbox: false,16    },17  });

after (b) · notesdesk-1.5.0.asar

main.js:14 · lines 11–17 of 37

11    webPreferences: {12      preload: path.join(__dirname, "preload.js"),13      contextIsolation: true,14      nodeIntegration: false,15      sandbox: true,16    },17  });

changedmain.js::win::sandbox

field	before	after
`value`	`false`	`true`

before (a) · notesdesk-1.4.0.asar

main.js:15 · lines 12–18 of 34

12      preload: path.join(__dirname, "preload.js"),13      contextIsolation: true,14      nodeIntegration: true,15      sandbox: false,16    },17  });18  win.loadFile("renderer/index.html");

after (b) · notesdesk-1.5.0.asar

main.js:15 · lines 12–18 of 37

12      preload: path.join(__dirname, "preload.js"),13      contextIsolation: true,14      nodeIntegration: false,15      sandbox: true,16    },17  });18  win.loadFile("renderer/index.html");

`endpoints` 1 row(s)

addedmain.js::fetch::https://updates.notesdesk.example/latest.jsonliteral

in after (b) · notesdesk-1.5.0.asar

main.js:30 · lines 27–33 of 37

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.handle("update:check", async () => fetch("https://updates.notesdesk.example/latest.json").then((r) => r.json()));31// The channel name comes from the environment at run time, so no static reading can name it.32for (const plugin of (process.env.NOTESDESK_PLUGINS ?? "").split(",").filter(Boolean))33  ipcMain.handle(`plugin:${plugin}`, () => store.get(`plugins.${plugin}`));

`storage` 1 row(s)

addedrenderer/app.bundle.js::localStorage::notesdesk.telemetry::readliteral

in after (b) · notesdesk-1.5.0.asar

renderer/app.bundle.js:15 · lines 12–18 of 68

12  return res.json();13}14async function telemetry(event) {15  if (localStorage.getItem("notesdesk.telemetry") !== "on") return;16  await fetch("https://telemetry.notesdesk.example/collect", { method: "POST", body: JSON.stringify({ event, ts: Date.now() }) });17}18/***/ }),

`urls` 1 row(s)

addedmain.js::https://updates.notesdesk.example/latest.jsonliteral

in after (b) · notesdesk-1.5.0.asar

main.js:30 · lines 27–33 of 37

27ipcMain.handle("notes:list", () => store.get("notes") ?? []);28ipcMain.handle("notes:save", (_e, note) => store.push("notes", note));29ipcMain.on("app:quit", () => app.quit());30ipcMain.handle("update:check", async () => fetch("https://updates.notesdesk.example/latest.json").then((r) => r.json()));31// The channel name comes from the environment at run time, so no static reading can name it.32for (const plugin of (process.env.NOTESDESK_PLUGINS ?? "").split(",").filter(Boolean))33  ipcMain.handle(`plugin:${plugin}`, () => store.get(`plugins.${plugin}`));

Not established

collection	gaps	compared in a	compared in b
`ipcChannels`	`values_unresolved`	6 of 6	6 of 6
`interfaces`	`values_unresolved`	6 of 6	6 of 6
`ipc`	`values_unresolved`	13 of 13	14 of 14

1 row(s) shown are unknown: found on one side where the other side did not read the file, or has values there it could not resolve. Neither added nor removed.
interfaces is not whole (values_unresolved): compared 6 of 6 item(s) in a and 6 of 6 in b.
ipcChannels is not whole (values_unresolved): compared 6 of 6 item(s) in a and 6 of 6 in b.
ipc is not whole (values_unresolved): compared 13 of 13 item(s) in a and 14 of 14 in b.
b: ipc_channel_unresolved 1 IPC call(s) pass a channel that is not a literal or a constant that could be followed (a parameter, a computed value). They are in the collection ipc without a channel: ipcMain.handle at main.js:33 (evaluation stopped: runtime value: process).
Absence from a list means hexvero did not find it in the files it read, not that the app cannot do it.
Values computed at run time are shown as ${…} or left out; nothing here was observed running.

Reproduce

npx hexvero@0.9.1 compare notesdesk-1.4.0.asar notesdesk-1.5.0.asar --report report.html

Summary

Window settings to review

Changes

interfaces 2 row(s)

in after (b) · notesdesk-1.5.0.asar

in before (a) · notesdesk-1.4.0.asar

contextBridge 2 row(s)

in after (b) · notesdesk-1.5.0.asar

in before (a) · notesdesk-1.4.0.asar

ipcChannels 2 row(s)

in after (b) · notesdesk-1.5.0.asar

in before (a) · notesdesk-1.4.0.asar

windows 1 row(s)

before (a) · notesdesk-1.4.0.asar

after (b) · notesdesk-1.5.0.asar

webPreferences 2 row(s)

before (a) · notesdesk-1.4.0.asar

after (b) · notesdesk-1.5.0.asar

before (a) · notesdesk-1.4.0.asar

after (b) · notesdesk-1.5.0.asar

endpoints 1 row(s)

in after (b) · notesdesk-1.5.0.asar

storage 1 row(s)

in after (b) · notesdesk-1.5.0.asar

urls 1 row(s)

in after (b) · notesdesk-1.5.0.asar

Not established

Reproduce

`interfaces` 2 row(s)

`contextBridge` 2 row(s)

`ipcChannels` 2 row(s)

`windows` 1 row(s)

`webPreferences` 2 row(s)

`endpoints` 1 row(s)

`storage` 1 row(s)

`urls` 1 row(s)