joplin

LOW

maintainer cuihao 289 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The npx commands execute build and test tasks from the project's own source code, not remote packages, and are part of a standard build process for a legitimate application.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The npx commands execute build and test tasks from the project's own source code, not remote packages, and are part of a standard build process for a legitimate application.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:65 npx yarn install
PKGBUILD:73 npx gulp build
PKGBUILD:79 npx gulp before-dist
PKGBUILD:86 npx electron-builder \
PKGBUILD:99 npx yarn workspaces foreach -Rptiv --from 'joplin' --from '@joplin/app-desktop' run test

PKGBUILD

5 offending line(s) highlighted

      1# Maintainer: CUI Hao <cuihao.leo@gmail.com>
    
      2# Contributor: dosenpils <dosenpils at donotdevelopmyapp dot com>
    
      3# Contributor: Alfredo Palhares <alfredo at palhares dot me>
    
      4# Contributor: Mark Wagie <mark dot wagie at tutanota dot com>
    
      5# Contributor: Matteo Parolari
    
      6# Contributor: gardar <aur@gardar.net>
    
      7
    
      8pkgbase=joplin
    
      9pkgname=('joplin' 'joplin-desktop')
    
      10pkgdesc="A note taking and to-do application with synchronization capabilities"
    
      11pkgver=3.7.21
    
      12groups=('joplin')
    
      13pkgrel=1
    
      14_electronVersion=42
    
      15depends=("electron${_electronVersion}" "nodejs>=22" "libvips")
    
      16optdepends=('libappindicator-gtk3: for tray icon')
    
      17arch=('x86_64' 'aarch64')
    
      18makedepends=('npm' 'git' 'rsync' 'python-setuptools' 'libxcrypt-compat' 'corepack')
    
      19url="https://joplinapp.org/"
    
      20license=("AGPL-3.0-or-later")
    
      21source=(
    
      22    "joplin-desktop.sh"
    
      23    "joplin-desktop.desktop"
    
      24    "joplin-${pkgver}.tar.gz::https://github.com/laurent22/joplin/archive/v${pkgver}.tar.gz"
    
      25)
    
      26sha256sums=('3f87fe0167806c86495fab78483cce83d60262bc2289e5ff24a9a9039e8454b2'
    
      27            'fb9a5185e3b523a5f52b0eeec6def781782ad0e6b64e5db13300396b835a55b4'
    
      28            'd868a2f9a48937c514b6b39486e88f473b4477085035f75d22542800c1fdd083')
    
      29
    
      30_setup_env() {
    
      31    export YARN_CACHE_FOLDER="${srcdir}/yarn-cache"
    
      32    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      33    #export npm_config_build_from_source=true
    
      34    export npm_config_yes=true
    
      35    export SHARP_IGNORE_GLOBAL_LIBVIPS=1
    
      36}
    
      37
    
      38prepare() {
    
      39    _setup_env
    
      40
    
      41    # Create the yarn cache folder
    
      42    mkdir -p "${YARN_CACHE_FOLDER}"
    
      43
    
      44    cd "${srcdir}/joplin-${pkgver}"
    
      45}
    
      46
    
      47build() {
    
      48    _setup_env
    
      49
    
      50    cd "${srcdir}/joplin-${pkgver}"
    
      51
    
      52    # Delete unused components
    
      53    rm -r packages/{app-mobile,app-clipper,server,doc-builder}
    
      54    # Fix: Build error due to removal of app-mobile
    
      55    sed -i '/app-mobile\//d' packages/tools/gulp/tasks/buildScriptIndexes.js
    
      56    # Fix: joplin-plugin-freehand-drawing complains "not in a git directory"
    
      57    git init
    
      58    # Fix: "Open secondary app instance" not working with system electron
    
      59    sed -i "s#bridge().electronApp().electronApp().getPath('exe')#'/usr/bin/joplin-desktop'#" \
    
      60        packages/app-desktop/bridge.ts
    
      61    sed -i '/const nextArg/a if (arg === "/usr/lib/joplin-desktop/app.asar") { argv.splice(0, 2); continue; }' \
    
      62        packages/lib/utils/processStartFlags.ts
    
      63
    
      64    corepack install
    
      65    npx yarn install
    
      66
    
      67    # Replace npm dependencies with local ones
    
      68    cd "packages"
    
      69    sed -i -E 's_"@joplin/([^"]+)": .*_"@joplin/\1": "file://'$PWD'/\1",_g' */package.json
    
      70
    
      71    # Pack the app-cli package
    
      72    cd "${srcdir}/joplin-${pkgver}/packages/app-cli"
    
      73    npx gulp build
    
      74    # Fix: MODULE_NOT_FOUND error in tests after commit 25a93ff
    
      75    ln -s ../build app/build
    
      76
    
      77    # Pack the app-desktop electron package
    
      78    cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
    
      79    npx gulp before-dist
    
      80    electronRoot=/usr/lib/electron${_electronVersion}/
    
      81    electronVersion="$(<${electronRoot}/version)"
    
      82    arch_args="--x64"
    
      83    if [[ $CARCH == "aarch64" ]]; then
    
      84        arch_args="--arm64"
    
      85    fi
    
      86    npx electron-builder \
    
      87      --linux "$arch_args" --dir=dist/ \
    
      88      -c.electronDist="${electronRoot}" \
    
      89      -c.electronVersion="${electronVersion}"
    
      90}
    
      91
    
      92check() {
    
      93    _setup_env
    
      94
    
      95    cd "${srcdir}/joplin-${pkgver}"
    
      96
    
      97    env ELECTRON_OVERRIDE_DIST_PATH=/usr/lib/electron${_electronVersion}/ \
    
      98        TZ=UTC \
    
      99        npx yarn workspaces foreach -Rptiv --from 'joplin' --from '@joplin/app-desktop' run test
    
      100}
    
      101
    
      102package_joplin() {
    
      103    pkgdesc="A note taking and to-do application with synchronization capabilities - CLI App"
    
      104    depends=('nodejs')
    
      105    optdepends=( )
    
      106
    
      107    _setup_env
    
      108
    
      109    # Install the package
    
      110    cd "${srcdir}/joplin-${pkgver}/packages/app-cli/build"
    
      111    npm pack
    
      112    npm install -g --install-links --prefix "${pkgdir}/usr" \
    
      113        --allow-scripts=keytar,sharp,sqlite3 \
    
      114        *.tgz
    
      115
    
      116    # Fix permissions set by npm
    
      117    chown -R root:root "${pkgdir}"
    
      118}
    
      119
    
      120package_joplin-desktop() {
    
      121    pkgdesc="A note taking and to-do application with synchronization capabilities - Desktop"
    
      122    depends=("electron${_electronVersion}" "nodejs" "libvips")
    
      123    optdepends=('libappindicator-gtk3: for tray icon')
    
      124
    
      125    _setup_env
    
      126
    
      127    cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
    
      128    mkdir -p "${pkgdir}/usr/lib"
    
      129    if [[ "$CARCH" == "aarch64" ]]; then
    
      130        cp -vr dist/linux-arm64-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
    
      131    else
    
      132        cp -vr dist/linux-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
    
      133    fi
    
      134
    
      135    # Install icons
    
      136    while read -r size; do
    
      137        mkdir -p "${pkgdir}/usr/share/icons/hicolor/${size}/apps/"
    
      138        cp "${pkgdir}/usr/lib/${pkgname}/build/icons/${size}.png" \
    
      139           "${pkgdir}/usr/share/icons/hicolor/${size}/apps/${pkgname}.png"
    
      140    done < <(ls build/icons | grep -Po '^(\d+)x\1+(?=\.png)')
    
      141
    
      142    install -vDm644 "${srcdir}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      143    install -vDm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      144    sed -i "s|@electronversion@|${_electronVersion}|" "${pkgdir}/usr/bin/${pkgname}"
    
      145}
    
      146

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -8,11 +8,11 @@
 pkgbase=joplin
 pkgname=('joplin' 'joplin-desktop')
 pkgdesc="A note taking and to-do application with synchronization capabilities"
-pkgver=3.6.16
+pkgver=3.7.21
 groups=('joplin')
 pkgrel=1
 _electronVersion=42
-depends=("electron${_electronVersion}" "nodejs>20" "libvips")
+depends=("electron${_electronVersion}" "nodejs>=22" "libvips")
 optdepends=('libappindicator-gtk3: for tray icon')
 arch=('x86_64' 'aarch64')
 makedepends=('npm' 'git' 'rsync' 'python-setuptools' 'libxcrypt-compat' 'corepack')
@@ -23,9 +23,9 @@
     "joplin-desktop.desktop"
     "joplin-${pkgver}.tar.gz::https://github.com/laurent22/joplin/archive/v${pkgver}.tar.gz"
 )
-sha256sums=('9223cc816f8175ddaf8839f9357d2bd1c4831692504927c98d8e1eefa7df796e'
-            'f485c089904d91750d137d4413297676446e0068892cb08e20bee928bcac516c'
-            'f88de7ccc464dcab925966e35ffa4a061551593749589ef74ce4683977df8c35')
+sha256sums=('3f87fe0167806c86495fab78483cce83d60262bc2289e5ff24a9a9039e8454b2'
+            'fb9a5185e3b523a5f52b0eeec6def781782ad0e6b64e5db13300396b835a55b4'
+            'd868a2f9a48937c514b6b39486e88f473b4477085035f75d22542800c1fdd083')
 
 _setup_env() {
     export YARN_CACHE_FOLDER="${srcdir}/yarn-cache"
@@ -53,20 +53,26 @@
     rm -r packages/{app-mobile,app-clipper,server,doc-builder}
     # Fix: Build error due to removal of app-mobile
     sed -i '/app-mobile\//d' packages/tools/gulp/tasks/buildScriptIndexes.js
-
     # Fix: joplin-plugin-freehand-drawing complains "not in a git directory"
     git init
+    # Fix: "Open secondary app instance" not working with system electron
+    sed -i "s#bridge().electronApp().electronApp().getPath('exe')#'/usr/bin/joplin-desktop'#" \
+        packages/app-desktop/bridge.ts
+    sed -i '/const nextArg/a if (arg === "/usr/lib/joplin-desktop/app.asar") { argv.splice(0, 2); continue; }' \
+        packages/lib/utils/processStartFlags.ts
 
     corepack install
     npx yarn install
 
     # Replace npm dependencies with local ones
     cd "packages"
-    sed -i -E 's_"@joplin/(\w+)": .*_"@joplin/\1": "file://'$PWD'/\1",_g' */package.json
+    sed -i -E 's_"@joplin/([^"]+)": .*_"@joplin/\1": "file://'$PWD'/\1",_g' */package.json
 
     # Pack the app-cli package
     cd "${srcdir}/joplin-${pkgver}/packages/app-cli"
     npx gulp build
+    # Fix: MODULE_NOT_FOUND error in tests after commit 25a93ff
+    ln -s ../build app/build
 
     # Pack the app-desktop electron package
     cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
@@ -120,7 +126,11 @@
 
     cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
     mkdir -p "${pkgdir}/usr/lib"
-    cp -vr dist/linux-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
+    if [[ "$CARCH" == "aarch64" ]]; then
+        cp -vr dist/linux-arm64-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
+    else
+        cp -vr dist/linux-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
+    fi
 
     # Install icons
     while read -r size; do

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 07:52:02	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2