Agent WranglersDSK-9Recommended
Keep the bundled browser engine current
When the app ships its own browser engine, as Electron does, move to each new major version within 8 weeks of its release. Never ship on a version its makers no longer patch.
How to do it
Electron bundles Chromium and Node.js, so every browser hole is a hole in your app until you update. Electron patches only its newest three major versions. Tauri and native web views use the engine the operating system updates, which moves this work to the user's system updates. Let a dependency bot open the upgrade, as update dependencies in small automatic steps says. Test the upgrade on every platform you ship.
How to check
A CI step compares the app's Electron major version with the newest three on the Electron release list. It fails when the app's version is older than all three.
Sources
Related rules
- ENG-18 Update dependencies in small automatic steps in Engineering
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/update-integrity/current-app-runtime">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.