fix(linux): drop unmaintained dbus-next so installs no longer pull critical advisories

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Fixed
+
+- The Linux D-Bus fallback now uses the maintained `@particle/dbus-next` fork instead of `dbus-next`, which has been unmaintained since 2022. Installs no longer pull in its optional `usocket` build chain (`node-gyp@7`, `request`, `form-data@2`, `tar@6`), which carried critical and high advisories. No behavior or config changes (#148).
+
 ## [1.1.0] - 2026-10-17
 
 ### Fixed

package.json

@@ -22,7 +22,7 @@
     "gnome-shell-extension"
   ],
   "scripts": {
-    "build": "bun build src/index.ts src/tui.ts --outdir dist --target node --external node-notifier --external dbus-next && tsc --emitDeclarationOnly",
+    "build": "bun build src/index.ts src/tui.ts --outdir dist --target node --external node-notifier --external @particle/dbus-next && tsc --emitDeclarationOnly",
     "prepublishOnly": "bun run build",
     "typecheck": "tsc --noEmit",
     "test": "bun test"
@@ -35,7 +35,7 @@
     "alerts"
   ],
   "dependencies": {
-    "dbus-next": "^0.10.2",
+    "@particle/dbus-next": "^0.11.4",
     "is-wsl": "^3.1.0",
     "node-notifier": "^10.0.1"
   },

src/notify-linux.ts

@@ -1,4 +1,4 @@
-import type { MessageBus } from "dbus-next"
+import type { MessageBus } from "@particle/dbus-next"
 
 const DESTINATION = "org.freedesktop.Notifications"
 const PATH = "/org/freedesktop/Notifications"
@@ -77,7 +77,7 @@ function handleSignal(state: Connection, member: string, id: number, value: unkn
 
 async function connect(): Promise<Connection> {
   const epoch = generation
-  const dbus = (await import("dbus-next")).default
+  const dbus = (await import("@particle/dbus-next")).default
   if (epoch !== generation) throw new Error("notification channel disposed")
   const bus = dbus.sessionBus()
   let fail!: (error: Error) => void
@@ -149,7 +149,7 @@ export function sendLinuxActionNotification(
       // Pending calls keep the client alive until delivery resolves. Idle
       // notification listeners alone must not prolong the client's lifetime.
       state.stream?.ref?.()
-      const dbus = (await import("dbus-next")).default
+      const dbus = (await import("@particle/dbus-next")).default
       if (state.callbacks.size >= MAX_ACTIONS && !(grouping && state.callbacks.has(lastID))) {
         const id = state.callbacks.keys().next().value!
         await bounded(Promise.race([state.failure, state.bus.call(new dbus.Message({

src/notify.actions.test.ts

@@ -156,7 +156,7 @@ test.skipIf(!linuxDesktop)("handler capacity closes the oldest popup before rele
 test.skipIf(!linuxDesktop || !Bun.which("node"))("pending delivery completes on Node but its idle sender does not keep the client alive", async () => {
   const directory = mkdtempSync(join(tmpdir(), "notifier-node-runtime-"))
   try {
-    const result = await Bun.build({ entrypoints: [notify], target: "node", outdir: directory, naming: "notify.mjs", external: ["dbus-next", "node-notifier"] })
+    const result = await Bun.build({ entrypoints: [notify], target: "node", outdir: directory, naming: "notify.mjs", external: ["@particle/dbus-next", "node-notifier"] })
     expect(result.success).toBe(true)
     symlinkSync(join(import.meta.dir, "../node_modules"), join(directory, "node_modules"))
     const output = await run(`

test/fixtures/notification-daemon.ts

@@ -1,5 +1,5 @@
 // Runs only inside dbus-run-session: never talks to the user's desktop daemon.
-import dbus from "dbus-next"
+import dbus from "@particle/dbus-next"
 
 const path = "/org/freedesktop/Notifications"
 const name = "org.freedesktop.Notifications"