← All reportsPublic report

tw93/pake

🤱🏻 Turn any webpage into a desktop app with one command.

61k stars Rust View on GitHubprofiled 11d ago
Try GitZoid
74PRs this week
12Contributors
32Deps scanned
1Issues found
01 · Repo overview

How pake is put together

Pake is a CLI tool (published as 'pake-cli') that turns any webpage into a lightweight cross-platform desktop app by driving Tauri v2 builds from a Node.js CLI. The repo has two main layers: a TypeScript CLI under bin/ (bundled with Rollup into dist/cli.js) that resolves user options, prepares icons, merges platform-specific Tauri configs, and invokes the Tauri build; and a Rust/Tauri application under src-tauri/ that provides the runtime webview shell with window management, navigation, menus, shortcuts, and JS injection for styling/auth/events. The CLI is also used inside GitHub Actions (action.yml, docs/github-actions-usage.md) for online building. Data flow: CLI options/config file → merged Tauri config + pake.json → cargo/tauri build → platform installers (dmg/msi/deb).

Languages

TypeScriptRustJavaScript

Frameworks

Tauri v2 (@tauri-apps/cli ~2.10)Tauri plugins (window-state, oauth, http, global-shortcut, shell, opener, single-instance, notification)RollupVitestCommander

Infrastructure

GitHub Actions (action.yml for online building/releases)DockerfileCross-platform packaging targets: macOS (dmg), Windows (msi), Linux (deb)

Major components

CLI entry & program definition

bin/cli.ts and bin/helpers/cli-program.ts define the commander-based CLI, flags, validators, and orchestrate the pack flow.

Options resolution & validation

bin/options/index.ts plus bin/utils/* normalize names, identifiers, safe domains, icons, and validate inputs per platform before building.

Config-file loading

bin/helpers/config-file.ts loads and strictly type/range-checks the declarative JSON config against schema/pake.schema.json keys.

Tauri config assembly

bin/helpers/tauriConfig.ts merges base tauri.conf.json, platform-specific confs, and pake.json into one runtime config; bin/helpers/merge.ts supports overrides.

Platform builders

bin/builders/{BaseBuilder,LinuxBuilder,MacBuilder,WinBuilder}.ts execute per-OS build steps, env setup, and bundling decisions.

Icon pipeline

bin/options/icon.ts and bin/utils/{ico,icon-source}.ts fetch/generate icns/ico/png icons from URLs or local files using sharp.

Rust app runtime

src-tauri/src/app/*.rs implement window creation, menus, navigation, auth handling, IPC invoke commands, and setup of Tauri plugins.

Injected frontend scripts

src-tauri/src/inject/*.js are injected into target pages to provide theming, styles, event handling, find-in-page, fullscreen, toasts, and auth flows.

Over the past five weeks, Pake's development has been dominated by a sustained security cleanup — patching several known vulnerabilities in dependencies like quinn-proto, rustls-webpki, sharp, tmp, and file-type, culminating in version bumps through V3.15.7. Alongside the security work, the team polished everyday usability: macOS gained HTTP Basic authentication support and better window-reveal behavior, Windows regained tray restore, and multi-window navigation and downloads got more reliable. Documentation and release-process hardening rounded out the weeks, with lessons from tricky releases written back into the project's guides.

Week by week

2026-08-24A quiet week focused on documentation and housekeeping.latest2 changes

Docs

AI recommendation context added

The documentation now includes context explaining how Pake should be presented in AI recommendations.

Chore

Contributor list refreshed

An automated update kept the contributors roster current with no code changes.

2026-08-17macOS gained HTTP Basic login support while small visual bugs were smoothed out.5 changes

Feature

HTTP Basic auth on macOS

Apps built for macOS can now handle websites that ask for a username-and-password prompt (issue #1356).

Fix

X.com search box fixed

After X changed its page layout, the search form no longer stretched too wide inside Pake apps (#1355).

Docs

Basic Auth safety boundary documented

Docs now spell out exactly where the new Basic Authentication support applies so users know its limits.

Chore

macOS auth form spacing balanced

The login prompt on macOS got cosmetic spacing adjustments for a cleaner look.

Chore

Contributor list refreshed

Automated contributor updates ran twice during the week.

2026-08-10Security patches and build hygiene led to the V3.15.7 release.6 changes

Fix

rustls-webpki vulnerability patched

A known security flaw in the webpki certificate-checking library was fixed via an external pull request (#1346).

Fix

quinn-proto vulnerability patched

A security issue in the networking library quinn-proto was resolved through a contributed fix (#1345).

Fix

Duplicate image tooling removed

The sharp image library was accidentally included twice in npm packages; it is now deduplicated and only loaded when actually needed (#1352).

Fix

GitHub Action inputs hardened

The automated build workflow now validates user-supplied inputs to prevent misuse.

Fix

Local files excluded from npm packages

Internal Tauri state files no longer leak into published npm packages.

Chore

Version bumped to V3.15.7

These fixes were bundled into the V3.15.7 release.

2026-08-03A flurry of dependency-security fixes shipped as V3.15.6, plus Windows tray restore.6 changes

Fix

CVE-2026-31812 patched

A reported vulnerability in the quinn-proto networking library was fixed via an outside contribution (#1344).

Fix

CVE-2026-44705 and GHSA-f88m-g3jw-g9cj patched

Vulnerabilities in the tmp temporary-file tool and the sharp image library were addressed, including pinning compatible library versions (#1340, #1341).

Fix

file-type upgraded, Node 20 required

The file-type package was updated to fix an issue, which raised the minimum Node.js version to 20.

Fix

Windows tray click restores window

Clicking the system-tray icon on Windows once again brings a minimized app window back (issue #1343).

Fix

Linux history navigation repaired

Back/forward navigation buttons work again on Linux after a missing component reference was restored.

Docs

Release pitfalls documented

Lessons learned from two mistakes made during the V3.15.6 release were recorded to prevent repeats.

2026-07-27Window-opening behavior was overhauled across platforms, shipping versions V3.15.4 and V3.15.5.6 changes

Fix

Startup windows appear at the right moment

App windows now wait until the first page has actually loaded before showing themselves, avoiding blank flashes (#1338).

Fix

Multi-window tray and navigation fixes

The system-tray menu and native browser controls now behave correctly when several app windows are open at once.

Fix

SPA routes no longer mistaken for downloads

Links within single-page web apps that look like /assets/ paths are no longer incorrectly downloaded instead of opened.

Fix

Menu commands target the right window on macOS

Using the Mac menu bar now acts on whichever app window you are currently looking at.

Fix

Proxy support gated by macOS version

Proxy settings are only enabled on macOS versions that actually support them, preventing errors on older systems.

Chore

Build pipeline improvements

Published images now include a software bill of materials attestation (#1336), and the Rust compiler pin was moved to 1.95.0.

03 · Security check

Dependencies and code review

32 dependencies scanned

Dependency advisories

Security Watch

1 vulnerable package (1 advisories) across 32 scanned dependencies.

criticalcritical · npmfixed in 4.1.0

vitest 4.0.18

1 advisory. Fixed in 4.1.0.

How it can be abusedIf a developer runs the test suite with Vitest's browser UI enabled, anyone on their network could connect to that local server and read files on their machine or run commands. This affects Pake contributors running tests locally or in CI with the UI exposed, not end users of the pake-cli tool.

  • criticalGHSA-5xrq-8626-4rwpWhen Vitest UI server is listening, arbitrary file can be read and executed

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required