[qawatake]

Release/deploy: Not required (no-release). Built locally, main.js (sha256 a1c0cbd9…) and manifest.json (07a565f7…) are byte-identical to the build of main at cd131c6.

Summary

1. Pin the obsidian devDependency from "latest" to 1.14.4, the version the lockfile already resolves.
2. Remove electron from onlyBuiltDependencies in pnpm-workspace.yaml, and replace the comment saying electron "Downloads the Electron binary in its postinstall" with a description of how the binary is actually fetched now.

Why

1. obsidian: "latest"

It was the only unpinned entry in package.json; every other dependency is exact (save-exact=true in .npmrc). With latest, the declared range says nothing about what is installed, and any re-resolution of the lockfile can move it.

• Lockfile resolution is unchanged. pnpm install on this branch changes pnpm-lock.yaml in exactly one line: the importer specifier: latest → specifier: 1.14.4. version: 1.14.4(@codemirror/state@6.7.6)(@codemirror/view@6.43.13) and every packages: / snapshots: entry stay as they are. The pnpm install --frozen-lockfile step in CI passes on this head.
• Dependabot can still update it. An exact version is the same form as every other devDependency here (e.g. electron, @playwright/test), and Dependabot bumps those (e.g. build(deps-dev): bump the npm-minor-patch group across 1 directory with 4 updates #53 bumped electron, @playwright/test and @types/node). obsidian is a development dependency, so it stays in the npm-minor-patch / npm-major groups. No ignore rule in .github/dependabot.yml names it.

2. electron and onlyBuiltDependencies

Since Electron 42, the electron npm package no longer has a postinstall script. (breaking changes: "electron no longer downloads itself via postinstall script".) npm view electron@<v> scripts returns postinstall: node install.js for 37–41 and nothing for 42.0.0, 43.0.0, 43.7.7 or 43.7.9, which is what this repo uses. Allow-listing it was therefore a no-op, and the comment was wrong.

How the binary is actually obtained in e2e:

• pnpm install does not download it. After a clean pnpm install --frozen-lockfile, node_modules/electron/dist does not exist, with or without electron in onlyBuiltDependencies.
• Playwright's _electron.launch() (no executablePath) does require("electron/index.js") (playwright-core/lib/coreBundle.js). On first use, electron/index.js spawns install.js, which downloads through @electron/get and verifies the download against the checksums.json shipped in the package. I checked earlier that this file matches the v43.7.9 GitHub release SHASUMS256.txt.
• Locally on this branch, node -e "require('electron')" printed Downloading Electron binary... and produced dist/Electron.app with dist/version = 43.7.9.
• In CI the same line appears in the pnpm e2e:setup step (see Verification).

esbuild stays in ignoredBuiltDependencies, and its comment is unchanged.

Verification

• pnpm check (toolchain, pinned actions, config schema, lint, typecheck, build, bundled-deps) passes locally on this branch.
• Artifact: identical to main, as noted at the top.
• CI on this head: see the run linked from the checks. I will add a comment with the job log excerpts once it finishes.

[qawatake]

CI on head 06c0050 (run 39012758615): build, e2e and test-e2e-tools all passed. I read the job log bodies as well as the statuses.

• build: pnpm install --frozen-lockfile installs obsidian 1.14.4. The toolchain, actions-pinned, config-schema and bundled-deps checks all report ok. pnpm audit: no known vulnerabilities. Biome: 7 files checked, no fixes. Typecheck and build pass. pnpm printed no Ignored build scripts warning, and no other warning or error.
• e2e / test-e2e-tools: in both jobs, setup-obsidian.sh logs Electron 43.7.9 matches Obsidian's bundled major (43.7.7). Then, during pnpm e2e:setup, Playwright's launch prints Downloading Electron binary.... This is the lazy download described above, now running without electron in onlyBuiltDependencies. The tests then pass: 1 passed for setup and 1 passed for test or cleanup.