Modernize Electron app: fix Drive link parsing, harden security

[gomgom]

Summary

• Upgrade Electron 13.6.6 → 43.x (plus electron-builder/electron-packager/asar), resolving the outstanding dependabot security PRs (Bump electron from 13.6.6 to 18.3.7 #19, Bump json5 from 2.1.2 to 2.2.3 #20, Bump http-cache-semantics from 4.1.0 to 4.1.1 #21)
• Fix the core bug: URL parsing only recognized the old drive.google.com/open?id=... link format. Google's share UI now only generates drive.google.com/file/d/ID/view?usp=sharing, so current links silently failed. Both formats are now supported.
• Harden main.js/preload.js/renderer.js: remove nodeIntegration/webviewTag, enable contextIsolation+sandbox, bridge IPC through contextBridge in preload instead of require('electron') in the renderer
• Drop the module.exports jQuery workaround in index.html, which is no longer needed once nodeIntegration is off
• Fix a </webview> → </iframe> closing-tag typo in the generated player HTML

No feature/UI changes — this is a fix-and-modernize pass. jQuery itself was intentionally left in place.

Test plan

• URL-parsing unit test (6/6 cases: legacy open?id=, current file/d/ID/view with/without query string, invalid input)
• Headless Electron 43 boot via Xvfb: confirmed window.gdPlayer.{resizeWindow,maximize,toggleAlwaysOnTop} are exposed and window.require is undefined (contextIsolation working), no console errors
• Simulated both link formats loading correctly into the <iframe> player
• Simulated size buttons (M/L) and always-on-top toggle actually changing window size/state via IPC
• npm audit: 0 vulnerabilities after dependency bump
• Manually tested locally by the repo owner — confirmed working end-to-end, including real Google Drive video playback

🤖 Generated with Claude Code

---

Generated by Claude Code

[Copilot]

Pull request overview

Modernizes the Electron-based Google Drive video player by upgrading to a current Electron major, fixing Google Drive share-link parsing to support both legacy and current formats, and tightening renderer/main boundaries by moving window-control actions behind a preload contextBridge API.

Changes:

• Update Drive URL parsing to support both open?id=... and /file/d/ID/... formats and fix the generated player closing tag to </iframe>.
• Replace require('electron') usage in the renderer with a window.gdPlayer preload bridge.
• Upgrade Electron/tooling dependencies and harden BrowserWindow webPreferences (context isolation + sandbox) while removing the jQuery module workaround.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
renderer.js	Adds robust Drive link parsing, fixes iframe closing tag, and switches window-control actions to window.gdPlayer.
preload.js	Introduces contextBridge API (gdPlayer) to send IPC commands from a locked-down renderer.
main.js	Updates BrowserWindow security-related webPreferences (context isolation + sandbox).
index.html	Removes the module workaround now that nodeIntegration is disabled; keeps jQuery + renderer script loading.
package.json	Upgrades Electron and packaging toolchain versions to current major releases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.