← All reportsPublic report

jgraph/drawio-desktop

Official electron build of draw.io

63k stars JavaScript View on GitHubprofiled 11d ago
Try GitZoid
25PRs this week
3Contributors
338Deps scanned
0Issues found
01 · Repo overview

How drawio-desktop is put together

drawio-desktop is an Electron-based desktop diagramming application that wraps the core draw.io editor (included as a git submodule under drawio/src/main/webapp). The main process (src/main/electron.js) manages windows, IPC, file system access, auto-update via electron-updater, and a strict 'blessed paths' authorization model restricting renderer file writes to user-approved locations. A contextBridge preload script exposes a minimal, validated IPC surface to the sandboxed renderer. The app is designed for complete network isolation except for update checks against github.com and downloads from an AWS S3 bucket, with CSP forbidding remotely loaded JavaScript.

Languages

JavaScript

Frameworks

Electronelectron-builderelectron-updaterelectron-storeelectron-logelectron-context-menu@cantoo/pdf-lib

Infrastructure

Travis CIAppVeyorGitHub ReleasesAWS S3 (update artifacts)NSIS installerMSI installerSnap packageAPPX/Microsoft Store package

Major components

Main process / window management

src/main/electron.js bootstraps the Electron app, creates BrowserWindows, handles menus, dialogs, clipboard, spellcheck, hardware acceleration toggles, and multi-window lifecycle.

IPC bridge (preload)

src/main/electron-preload.js exposes a narrow request/response and message-listener API over ipcRenderer via contextBridge, plus seeds localStorage configuration during first-run migration.

CLI argument parsing & export options

src/main/args.js defines all command-line flags (--export, --format, --page-range, HTML/SVG viewer options, etc.) with validation regexes and help text generation.

Auto-update subsystem

Uses electron-updater's autoUpdater with manual download triggering, silent vs. interactive modes controlled by DRAWIO_DISABLE_UPDATE/--disable-update/--no-silent-update env vars/flags, and flatpak detection; failures route to deduplicated error dialogs.

Blessed-paths authorization model

Maintains a persisted Set of user-authorized filesystem paths (via electron-store key 'blessedPaths', capped at 500) resolved through realpath so the renderer cannot write outside trusted locations even via validated IPC handlers.

PDF export engine

Leverages @cantoo/pdf-lib (PDFDocument, PDFHexString, PDFName) to generate PDF exports of diagrams.

Progress bar UI

src/main/progress-bar.js implements a self-contained BrowserWindow-based progress dialog with indeterminate/determinate modes using data: URLs and executeJavaScript updates.

Window bounds persistence

src/main/window-bounds.js provides pure functions to parse and validate saved window geometry against current display work areas, recentering when monitors change.

Over the past five weeks the drawio desktop app shipped a steady stream of releases (v31.1.5 through v31.3.2) alongside fixes to its update process and installer signing. A notable security-minded change removed support for external plugins so only built-in ones run, and the Linux AppImage was rebuilt to work without an extra system library (libfuse2). The team also tightened up release automation, switching to a GitHub app for accessing the core drawio repository.

Week by week

2026-08-24The Linux AppImage build was switched to a static runtime so it no longer requires libfuse2 to be installed.latest1 change

Fix

AppImage no longer needs libfuse2

The Linux AppImage package now uses a static runtime, removing the dependency on the libfuse2 system library that some users had to install separately.

2026-08-17Two point releases (v31.3.1 and v31.3.2) shipped with signed Windows DLLs and improved release automation.4 changes

Chore

Release v31.3.2 prepared

The app was updated to drawio core 31.3.2 and packaged as release v31.3.2.

Chore

Release v31.3.1 prepared

The app was updated to drawio core 31.3.1 and packaged as release v31.3.1.

Fix

Windows DLLs now digitally signed

Bundled DLL files are now signed, fixing a problem where the unfused portable zip contained unsigned components.

Chore

Builds use GitHub app for repo access

The build pipeline was updated to use a GitHub app token instead of previous credentials when accessing the drawio core repository.

2026-08-10Update-related bugs were fixed, including duplicate listeners piling up and the update window staying on top of everything.2 changes

Fix

Duplicate update listeners removed

Fixed an issue where repeated app updates caused multiple event listeners to accumulate instead of being replaced.

Fix

Update window no longer always on top

The update notification window no longer stays pinned above all other windows after an update.

2026-08-03A fix for extracting XML from PDF attachments landed along with an update to drawio core 31.1.8.2 changes

Fix

XML extraction from PDF attachments fixed

Corrected how diagram XML is extracted from PDF files attached to documents.

Chore

Updated to drawio core 31.1.8

The bundled drawio core library was bumped to version 31.1.8, and a dead merge branch was cleaned up.

2026-07-27Release v31.1.5 shipped with external plugin support removed so only built-in plugins can run.3 changes

Feature

External plugins disabled

Support for loading external plugins was removed; only plugins built into the app are allowed to run.

Chore

Release v31.1.5 prepared

The app was updated to drawio core 31.1.5 and packaged as release v31.1.5, with adjustments for missing remove items and a release override added.

Chore

Dependency updates held back where risky

Dependencies were refreshed, but the pdf-lib library was deliberately left on an older version because its newest release was considered too recent to trust.

03 · Security check

Dependencies and code review

338 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 338 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required