jgraph/drawio-desktop
Official electron build of draw.io
How drawio-desktop is put together
drawio-desktop is an Electron-based desktop diagramming application that wraps the core draw.io editor (included as a git submodule under drawio/src/main/webapp). The main process (src/main/electron.js) manages windows, IPC, file system access, auto-update via electron-updater, and a strict 'blessed paths' authorization model restricting renderer file writes to user-approved locations. A contextBridge preload script exposes a minimal, validated IPC surface to the sandboxed renderer. The app is designed for complete network isolation except for update checks against github.com and downloads from an AWS S3 bucket, with CSP forbidding remotely loaded JavaScript.
Languages
Frameworks
Infrastructure
Major components
Main process / window management
src/main/electron.js bootstraps the Electron app, creates BrowserWindows, handles menus, dialogs, clipboard, spellcheck, hardware acceleration toggles, and multi-window lifecycle.
IPC bridge (preload)
src/main/electron-preload.js exposes a narrow request/response and message-listener API over ipcRenderer via contextBridge, plus seeds localStorage configuration during first-run migration.
CLI argument parsing & export options
src/main/args.js defines all command-line flags (--export, --format, --page-range, HTML/SVG viewer options, etc.) with validation regexes and help text generation.
Auto-update subsystem
Uses electron-updater's autoUpdater with manual download triggering, silent vs. interactive modes controlled by DRAWIO_DISABLE_UPDATE/--disable-update/--no-silent-update env vars/flags, and flatpak detection; failures route to deduplicated error dialogs.
Blessed-paths authorization model
Maintains a persisted Set of user-authorized filesystem paths (via electron-store key 'blessedPaths', capped at 500) resolved through realpath so the renderer cannot write outside trusted locations even via validated IPC handlers.
PDF export engine
Leverages @cantoo/pdf-lib (PDFDocument, PDFHexString, PDFName) to generate PDF exports of diagrams.
Progress bar UI
src/main/progress-bar.js implements a self-contained BrowserWindow-based progress dialog with indeterminate/determinate modes using data: URLs and executeJavaScript updates.
Window bounds persistence
src/main/window-bounds.js provides pure functions to parse and validate saved window geometry against current display work areas, recentering when monitors change.
The Linux AppImage build was switched to a static runtime so it no longer requires libfuse2 to be installed.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
The Linux AppImage build was switched to a static runtime so it no longer requires libfuse2 to be installed.
Week of 2026-08-17
Two point releases (v31.3.1 and v31.3.2) shipped with signed Windows DLLs and improved release automation.
Week of 2026-08-10
Update-related bugs were fixed, including duplicate listeners piling up and the update window staying on top of everything.
Week of 2026-08-03
A fix for extracting XML from PDF attachments landed along with an update to drawio core 31.1.8.
Week of 2026-07-27
Release v31.1.5 shipped with external plugin support removed so only built-in plugins can run.
Over the past five weeks the drawio desktop app shipped a steady stream of releases (v31.1.5 through v31.3.2) alongside fixes to its update process and installer signing. A notable security-minded change removed support for external plugins so only built-in ones run, and the Linux AppImage was rebuilt to work without an extra system library (libfuse2). The team also tightened up release automation, switching to a GitHub app for accessing the core drawio repository.
Week by week
2026-08-24The Linux AppImage build was switched to a static runtime so it no longer requires libfuse2 to be installed.latest1 change
Fix
AppImage no longer needs libfuse2
The Linux AppImage package now uses a static runtime, removing the dependency on the libfuse2 system library that some users had to install separately.
2026-08-17Two point releases (v31.3.1 and v31.3.2) shipped with signed Windows DLLs and improved release automation.4 changes
Chore
Release v31.3.2 prepared
The app was updated to drawio core 31.3.2 and packaged as release v31.3.2.
Chore
Release v31.3.1 prepared
The app was updated to drawio core 31.3.1 and packaged as release v31.3.1.
Fix
Windows DLLs now digitally signed
Bundled DLL files are now signed, fixing a problem where the unfused portable zip contained unsigned components.
Chore
Builds use GitHub app for repo access
The build pipeline was updated to use a GitHub app token instead of previous credentials when accessing the drawio core repository.
2026-08-10Update-related bugs were fixed, including duplicate listeners piling up and the update window staying on top of everything.2 changes
Fix
Duplicate update listeners removed
Fixed an issue where repeated app updates caused multiple event listeners to accumulate instead of being replaced.
Fix
Update window no longer always on top
The update notification window no longer stays pinned above all other windows after an update.
2026-08-03A fix for extracting XML from PDF attachments landed along with an update to drawio core 31.1.8.2 changes
Fix
XML extraction from PDF attachments fixed
Corrected how diagram XML is extracted from PDF files attached to documents.
Chore
Updated to drawio core 31.1.8
The bundled drawio core library was bumped to version 31.1.8, and a dead merge branch was cleaned up.
2026-07-27Release v31.1.5 shipped with external plugin support removed so only built-in plugins can run.3 changes
Feature
External plugins disabled
Support for loading external plugins was removed; only plugins built into the app are allowed to run.
Chore
Release v31.1.5 prepared
The app was updated to drawio core 31.1.5 and packaged as release v31.1.5, with adjustments for missing remove items and a release override added.
Chore
Dependency updates held back where risky
Dependencies were refreshed, but the pdf-lib library was deliberately left on an older version because its newest release was considered too recent to trust.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 338 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required