steveseguin/electroncapture v2.23.4-beta.3

Electron Capture v2.23.4-beta.3 — Maintenance prerelease (macOS + Windows + Linux)

on GitHub

Maintenance prerelease focused on bug fixes, security hardening, and compatible dependency updates.

Fixes

• Restore macOS capture windows from the Dock without losing their chosen pin state. In particular, --minimized --no-pin --unclickable now remains unpinned after restoration.
• Preserve explicit click-through pinning through the menu and shortcut.
• Include the reviewed startup compatibility, window/capture lifecycle, shortcut ownership, navigation, and dependency security fixes.
• Update the official macOS runtime to Electron 43.8.7.

Downloads

The DMG and ZIP contain the same Developer ID-signed, Apple-notarized universal macOS app for Apple Silicon and Intel. SHA256SUMS provides checksums for both downloads.

The initial publication contained macOS artifacts only. Verified Windows builds have now been added; see the Windows supplement below. This prerelease does not replace the latest stable release.

Validation

• All 21 regression suites and 161 real macOS window checks passed, covering pinning, visibility, click-through, minimized startup/restoration, transparency, fullscreen, resizing, reloads, and multiple windows.
• Packaged Apple Silicon and Intel/Rosetta launch checks, CSS/JavaScript injection, explicit Node mode, renderer isolation, and Node-environment-injection rejection passed.
• A five-minute recording from the signed app decoded without errors; audio/video ended about 10 ms apart.
• A separate recording stress test completed 15 minimize/hide/restore cycles while opening/closing additional windows. Normal-stop, window-close, and app-quit recordings all decoded and passed synchronization checks.
• All 14 available media devices, both window-specific downloads, fullscreen/resize recovery, and native compositor transparency checks passed.
• Local WebRTC audio/video send/receive passed in the signed app's isolated renderer, with decoded video and zero reported packet loss.
• Both architecture security-fuse checks, signing/notarization, DMG/ZIP integrity, and uploaded asset SHA-256 comparisons passed.
• CodeQL passed for the application fix commit.

Known limitations

Three build-tool dependency alerts remain open (extract-zip and minimatch). Production dependencies audit clean, but the strict release-workflow dependency audit remains blocked. These artifacts were built and verified locally; this is not a claim that all CI checks or all security work are complete. The separate Pages/private-submodule and commit-message-service quota failures remain unresolved. Custom Windows runtimes still need upstream security updates; the Windows supplement below records completed validation and remaining hardware checks.

Windows prerelease addition — November 4, 2026

Windows downloads are now included alongside the original Mac assets. The Mac files, their SHA256SUMS, and the existing tag at 01eeaaf are unchanged. Windows binaries were built from d6e8051bc5921c0a29fda0af541ac05b9cbdafe9; subsequent master commits add validation documentation and test isolation only.

• Windows x64: elecap-2.23.4-beta.3.exe installer, elecap.exe portable, or matching ZIPs. Preserves custom Electron 39.8.10-qp20.
• Windows 11 x64: elecap-2.23.4-beta.3-win11.exe installer, elecap-win11.exe portable, or matching win11 ZIPs. Preserves custom 43.3.0-qp20.
• Windows ARM64: the win-arm64 EXEs / arm64 ZIPs use official 43.8.7. ASIO and process-audio capture native binaries are not included on ARM64.
• WINDOWS-SHASUMS256.txt covers these Windows files and the attached full security-audit.json report.

This Windows source update enforces fetch-stream ownership, verifies local runtime archives against trusted checksums, patches Undici in the native audio build lockfile, and consolidates a redundant close listener. The custom Windows transparency/WebRTC runtime patches remain intact; this does not patch Chromium inside those preserved runtimes.

Validation: all 22 regression suites; 156 window checks and five native compositor states on each custom Windows runtime; VP8/VP9/H.264 loopback; process-audio isolation/replacement; available-device workflows; two 15-minute generated recordings plus close/quit recordings; and final 30-second recordings from both signed portable packages. All eight Windows recordings decoded cleanly. Both x64 packages and native ARM64 builds pass architecture/content/fuse/signature checks. Installer replacement v39 → v43 → v39 and uninstall cleanup pass. Downloaded release packages were checked again locally against the reviewed source and pinned timestamped certificate. The certificate is self-signed; this does not promise SmartScreen reputation or public CA trust.

Production dependencies and both native lockfiles audit clean. Four reviewed build-tool advisories in extract-zip, minimatch and glob remain unfixed and visible in the full report. The manual beta.3 exception is exact-version scoped and expires December 4, 2026; ordinary stable/tag audits remain strict. Release-build checkout of the private native repository now uses its own read-only deploy key.

Actual Windows 10, mixed-DPI monitors, OBS alpha capture, mouse-driven resize/click delivery, ASIO hardware, physical device reconnects, hardware codec/QP behavior, custom cursor/scaling/delay guarantees and multi-hour endurance still require dedicated testing. Linux packages remain CI artifacts: the first packaged recording had delayed initial audio, while an unchanged repeat passed. A newly built/notarized Mac CI package was also retained without replacing the existing Mac downloads.

Windows build and package gates · Validation evidence · Follow-up plan

Linux prerelease addition — November 4, 2026

Linux packages now join the existing macOS and Windows downloads. This supersedes the earlier note that Linux files were held as CI artifacts. The existing tag, all Mac/Windows assets, and their checksum files are unchanged. Linux source: 8e0705a4fc1334b15d8b1c6e3666f7cc5bcd413e; official Electron 43.8.7 on every Linux architecture.

All filenames begin with elecap-2.23.4-beta.3-. Choose the architecture of your installed OS. LINUX-SHASUMS256.txt covers the Linux downloads and reports. linux-source.tar.gz contains the exact Linux application/build source; the release tag's automatic source archives retain the earlier Mac source revision.

The update completes the Linux build matrix, adds portable tar archives, aligns installed desktop identities, prevents RPM build-ID file conflicts with other Electron applications, and adds package verification and native installed-app CI tests. No custom Windows runtime patches are included in Linux.

Validation: all 22 regression suites; 156 real X11 window assertions; startup/injection/isolation checks; VP8/VP9/H.264 WebRTC loopback; available-device and per-window download checks; and all architecture/source/security-fuse/package gates passed. Native Ubuntu x64 and ARM64 CI installed the DEB, verified default/custom native window identities and Node-environment-injection rejection, recorded three fresh-profile clips each, and tested uninstall cleanup. Across local and CI testing, 13 recordings decoded without errors and passed the timing gate, including a five-minute run, close/quit recordings, AppImage execution, and native Wayland under Weston. CI initial audio timestamps were 11–33 ms; the largest final CI audio/video offset was 58 ms. See LINUX-VALIDATION.json for measured results and limits.

Limits: ARMv7 is cross-built and statically verified, with no ARMv7 hardware execution claim. Raspberry Pi GPU/camera behavior, Gamescope, full desktop Wayland/OBS alpha capture, device hot-plug, mixed-DPI monitors and multi-hour endurance still need dedicated hardware testing. Headless tests use disposable profiles with basic password storage; desktop keyring UX is not covered. Earlier WSL testing saw an intermittent initial-audio delay; the new runs pass the timing gate, but this is not a universal cold-start or hardware lip-sync guarantee. ASIO and Windows process-audio capture are unavailable on Linux. Electron 43 is the final upstream series with ARMv7 binaries.

Production and native lockfiles audit clean. Four previously documented build-tool advisories remain under the unchanged, expiring beta.3-only exception; LINUX-SECURITY-AUDIT.json preserves the full report. This remains a prerelease and does not replace the latest stable version.

Linux build and native validation · Installation instructions · Detailed Linux evidence and limits