[infra] Packaging & version hygiene: backend version drift + externalized deps may be missing

[rahulkatiyar19955]

Severity

Low

Summary

Two packaging/versioning hygiene gaps: the backend Python package version is decoupled from the app/image version, making the backend's self-reported version misleading; and externalized main-process dependencies may be missing from the packaged app because node_modules is not shipped.

Findings

• Backend package version decoupled from app/image version — backend/pyproject.toml:3 (version = "0.1.0") vs package.json:3 ("version": "0.2.4") — release-pipeline.yml:39-52 bumps only the root package.json (which drives the GHCR image tag), while pyproject.toml stays at 0.1.0. The backend's self-reported version is therefore stale/misleading in logs and health output. fix: sync the pyproject.toml version in the release pipeline, or stop treating the backend-reported version as authoritative.
• Externalized deps may be omitted from the packaged app — electron.vite.config.ts:8 (main uses externalizeDepsPlugin({ exclude: [] })), electron-builder.yml:9-11 (files: ships out/**/* + package.json, not node_modules) — the main process externalizes its runtime deps, but the packaged files list does not include node_modules, so externalized native-ish deps like dockerode may be missing at runtime in the packaged app. fix: verify a packaged run can require('dockerode'); ensure externalized runtime deps are included/unpacked (e.g. via asarUnpack/files), or bundle them instead of externalizing.

Project-rule reference

n/a (packaging correctness / observability hygiene).