[HOLD for payment 2022-10-26] [$250] Upgrade electron

[flodnv]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Problem

The version of electron in package.json is really outdated, and now has a vulnerability.

Solution

Let's update to the latest if possible, or at least to 18.3.12.

[melvin-bot]

Triggered auto assignment to @NicMendonca (External), see https://stackoverflow.com/c/expensify/questions/8582 for more details.

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @parasharrajat (External)

[melvin-bot]

Triggered auto assignment to @puneetlath (External), see https://stackoverflow.com/c/expensify/questions/7972 for more details.

[NicMendonca]

Job post: https://www.upwork.com/jobs/~01b1a7d6d830a2580c

[smrutiparida]

Proposal:

The Electron is upgraded to 20.2.0 locally without any breaking changes.

There are 3 breaking changes introduced in 20.2.0. They are

Breaking Changes

1. Removed the skip-taskbar feature on Linux. #35156

Not used in the codebase

2. Renderers are now sandboxed by default unless nodeIntegration: true or sandbox: false is specified. #35125

Since we don't initialize nodeIntegration in our main.js, we can continue to use BrowserWindow with new default values. Or else can initialize the default values for nodeIntegration and sandbox

`return app.whenReady()
    .then(() => {
        const browserWindow = new BrowserWindow({
            backgroundColor: '#FAFAFA',
            width: 1200,
            height: 900,
            webPreferences: {
                preload: `${__dirname}/contextBridge.js`,
                contextIsolation: true,
            },
            titleBarStyle: 'hidden',
            nodeIntegration: false,
            sandbox: true,
        });`

3. Added safeguards when building native modules with nan. Use node-gyp >=8.4.0 and electron-rebuild >=3.2.9 for when rebuilding native modules. #35160

We already use the node-gyp 9.0.0 and do not use electron-rebuild

###Test suite result

The change should work. If we do not wish to upgrade to 20.0.0 then we can also do step wise upgrade to 18.3.6 easily.

[melvin-bot]

@puneetlath, @parasharrajat, @NicMendonca Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!