server-studio 1.2.2 → 1.2.4

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 Notable changes to Server Studio. Dates are release dates.
 
+## 1.2.4 — 2026-08-30
+
+- **Fixed:** on Windows, stopping a server could kill an unrelated process. The port was matched
+  with `findstr :5173`, which also matches `0.0.0.0:51730`, so a longer port sharing the prefix was
+  caught too. Reported and patched by @anupamme in #1.
+- `killPort` no longer builds a shell command at all, on any platform. The port was already
+  sanitised by `Number()`, so this is hardening rather than a fix.
+
+## 1.2.3 — 2026-08-30
+
+- The badge shown after an update now says **quit & reopen** rather than "restart to finish".
+  Reloading the page kept the old process serving it, so the old wording sent people to do the
+  one thing that could not work.
+
 ## 1.2.2 — 2026-08-30
 
 - The version badge no longer keeps offering an update you have already installed. Once you start

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "server-studio",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "A tiny dashboard for your local dev servers. One click to run, stop and open them, with one permanent port per project.",
   "author": "Md Mahdi Hasan",
   "license": "MIT",

package/src/index.html

@@ -859,9 +859,12 @@ async function checkUpdate() {
     pending = null;
   }
   if (pending) {
+    // "restart" alone reads as reloading the page, which changes nothing: the old
+    // process is still serving it. Say which thing has to be restarted.
     pill.className = 'ver pending';
-    pill.textContent = 'restart to finish ' + pending;
-    pill.title = 'Version ' + pending + ' has been installed. Quit and reopen Server Studio to run it.';
+    pill.textContent = 'quit & reopen for ' + pending;
+    pill.title = pending + ' is installed. Quit Server Studio itself and open it again, ' +
+                 'reloading this page keeps the old version running.';
     pill.onclick = null;
     return;
   }
@@ -895,7 +898,7 @@ async function runUpdate() {
     // update. Continuing to show it after a successful update reads as a failure.
     try { localStorage.setItem('ss_updating_to', updateInfo.latest); } catch (e) {}
     checkUpdate();
-    toast('Updating in ' + TERM_NAME + '. Restart Server Studio when it finishes.');
+    toast('Updating in ' + TERM_NAME + '. Quit Server Studio and open it again when it finishes.');
   }
   else toast('Could not start the update. Run this yourself: npm install -g server-studio', true);
 }

package/src/platform.js

@@ -4,7 +4,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { execFile, exec } = require('child_process');
+const { execFile } = require('child_process');
 
 const WIN = process.platform === 'win32';
 const MAC = process.platform === 'darwin';
@@ -86,15 +86,21 @@ function killPort(port, cb) {
   if (!p) return cb(new Error('bad port'));
   if (WIN) {
     // netstat lists the owning PID in the last column of LISTENING rows.
-    return exec('netstat -ano -p tcp | findstr LISTENING | findstr :' + p, (err, stdout) => {
+    // execFile (no shell) avoids ever building a shell command string from `port`.
+    return execFile('netstat', ['-ano', '-p', 'tcp'], (err, stdout) => {
       const pids = new Set(String(stdout || '').trim().split(/\r?\n/)
+        .filter(l => /LISTENING/.test(l) && l.includes(':' + p + ' '))
         .map(l => l.trim().split(/\s+/).pop())
         .filter(x => /^\d+$/.test(x) && x !== '0'));
       if (!pids.size) return cb(null);
-      exec([...pids].map(id => 'taskkill /PID ' + id + ' /T /F').join(' & '), () => cb(null));
+      execFile('taskkill', ['/T', '/F', ...[...pids].flatMap(id => ['/PID', id])], () => cb(null));
     });
   }
-  return exec('lsof -nti tcp:' + p + ' | xargs kill 2>/dev/null', () => cb(null));
+  return execFile('lsof', ['-nti', 'tcp:' + p], (err, stdout) => {
+    const pids = String(stdout || '').trim().split(/\r?\n/).filter(Boolean);
+    if (!pids.length) return cb(null);
+    execFile('kill', pids, () => cb(null));
+  });
 }
 
 /* ---------- native "choose a folder" dialog ---------- */