chore: secure dependencies and bump version to 2.1.13

.gitea/workflows/build.yml

@@ -79,7 +79,7 @@ jobs:
         uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
-          name: gSheets-Rate-Assistant ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
           body_path: release-notes.md
           files: dist/*.exe
 
@@ -104,7 +104,7 @@ jobs:
             raise SystemExit(0)
 
           tag = os.environ["BUILD_VERSION"]
-          release_name = f"gSheets-Rate-Assistant {tag}"
+          release_name = tag
           asset_path = next((os.path.join("dist", name) for name in os.listdir("dist") if name.endswith(".exe")), None)
           with open("release-notes.md", "r", encoding="utf-8") as notes_file:
             release_notes = notes_file.read()

.gitea/workflows/security.yml

@@ -0,0 +1,26 @@
+name: dependency-security
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 9 * * 1'
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '26'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit dependencies
+        run: npm audit

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "google-sheets-rate-assistant",
-  "version": "2.1.11",
+  "version": "2.1.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "google-sheets-rate-assistant",
-      "version": "2.1.11",
+      "version": "2.1.13",
       "dependencies": {
         "csv-stringify": "^6.0.0",
         "googleapis": "^173.0.0",
@@ -557,9 +557,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -1273,9 +1273,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
+      "version": "6.16.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "google-sheets-rate-assistant",
-  "version": "2.1.11",
+  "version": "2.1.13",
   "description": "Pull Google Sheets data and export to CSV with configurable schedules and rate limiting.",
   "main": "index.js",
   "bin": "index.js",

scripts/build-win.js

@@ -1,3 +1,4 @@
+const crypto = require('crypto');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
@@ -10,6 +11,39 @@ function normalizeBuildVersion(value) {
   return version.startsWith('v') ? version : `v${version}`;
 }
 
+async function download(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+
+// SEA blobs must be injected into a node binary of the same version, and non-Windows hosts need a Windows base binary.
+async function getWindowsNodeBinary(tempDir) {
+  if (process.platform === 'win32') {
+    return process.execPath;
+  }
+
+  const baseUrl = `https://nodejs.org/dist/${process.version}`;
+  const [binary, shasums] = await Promise.all([
+    download(`${baseUrl}/win-x64/node.exe`),
+    download(`${baseUrl}/SHASUMS256.txt`),
+  ]);
+
+  const expected = shasums.toString('utf8').split('\n')
+    .map(line => line.trim().split(/\s+/))
+    .find(([, file]) => file === 'win-x64/node.exe');
+  const actual = crypto.createHash('sha256').update(binary).digest('hex');
+  if (!expected || expected[0] !== actual) {
+    throw new Error('Checksum verification failed for downloaded win-x64/node.exe');
+  }
+
+  const binaryPath = path.join(tempDir, 'node.exe');
+  fs.writeFileSync(binaryPath, binary);
+  return binaryPath;
+}
+
 async function main() {
   const distDir = path.resolve(__dirname, '..', 'dist');
   if (!fs.existsSync(distDir)) {
@@ -33,8 +67,11 @@ async function main() {
     logLevel: 'info',
   });
 
+  const executable = await getWindowsNodeBinary(tempDir);
+
   fs.writeFileSync(seaConfigPath, JSON.stringify({
     main: bundlePath,
+    executable,
     output: outputFile,
     mainFormat: 'commonjs',
     disableExperimentalSEAWarning: true,
@@ -43,6 +80,14 @@ async function main() {
   }, null, 2));
 
   execFileSync(process.execPath, ['--build-sea', seaConfigPath], {stdio: 'inherit'});
+
+  const header = Buffer.alloc(2);
+  const fd = fs.openSync(outputFile, 'r');
+  fs.readSync(fd, header, 0, 2, 0);
+  fs.closeSync(fd);
+  if (header.toString('latin1') !== 'MZ') {
+    throw new Error(`${outputFile} is not a Windows PE executable`);
+  }
 }
 
 main().catch(error => {