Updated Dependencies of MusicBlockV4 Launcher

[MostlyKIGuess]

Description

This pull request addresses several security vulnerabilities identified during a yarn audit in the MusicBlockV4 launcher project. The following updates and changes have been made:

1. Updated Electron:

   • Upgraded electron to version >=22.3.25 to resolve the libvpx heap buffer overflow issue.

2. Updated Electron Builder Dependencies:

   • Updated electron-builder to ensure patched dependencies (minimatch, app-builder-lib, and others), resolving:
     • Minimatch ReDoS vulnerability.
     • NSIS installer arbitrary code execution vulnerability.

3. General Dependency Updates:

   • Applied updates to other high and moderate severity vulnerabilities where applicable.

---

Key Changes

• Dependencies Updated:
  • electron upgraded to the latest version (>=22.3.25).
  • electron-builder updated to include patched dependencies:
    • Resolved vulnerabilities related to minimatch and app-builder-lib.
  • Added or adjusted resolution overrides in package.json to enforce specific patched versions.

---

Testing

• Verified application functionality after updates:
  • Launcher builds successfully using the updated dependencies.
  • No regression in core features observed.
• Ran yarn audit after updates:
  • Confirmed no remaining critical vulnerabilities.

---

References

• Electron Security Advisory
• Minimatch ReDoS Advisory
• NSIS Arbitrary Code Execution Advisory

---

Checklist

• Updated dependencies to patched versions.
• Verified no regression in functionality.
• Resolved high and critical vulnerabilities as reported by yarn audit.
• Tested the application post-updates.

[MostlyKIGuess]

corrected this to work with depth 1 rather than it being optional?

[MostlyKIGuess]

• Checked by creating and installing a flatpak as well.

[MostlyKIGuess]

@quozl do review, incase missed.
Sorry for the ping

[quozl]

Thanks. Saw it, but don't know this repository very well and hoping the Music Blocks maintainers will look at this for you. If they don't, give them a nudge in the Music Blocks repositories.

[MostlyKIGuess]

@walterbender Do review.