make electron-dev fails: yauzl@2.10.0 silently fails Electron binary extraction on Node 24

[Davidnet]

Summary

make electron-dev (and npm run electron:dev) fails on a fresh install because the Electron binary is never extracted. Electron's install.js produces a partial dist/ (only Electron.app/ directory entry, no version file) and never writes path.txt, so require('electron') throws:

Error: ENOENT: no such file or directory, open '.../node_modules/electron/path.txt'
    at getElectronPath (.../node_modules/electron/index.js:47:25)

Root cause

Electron 42.3.0 extracts its binary via extract-zip@2.0.1, which pins yauzl@^2.10.0. yauzl@2.10.0 silently fails to extract the archive under Node 24 — its older stream handling bails out after the first entry without throwing. Because no error surfaces, install.js exits 0 with a half-extracted dist/ and no path.txt.

This is not a download problem: the cached zip (~/Library/Caches/electron/.../electron-v42.3.0-darwin-arm64.zip) is intact (unzip -t passes, contains version, LICENSE, Electron.app/).

Reproduction / evidence

Calling extract-zip directly on the cached Electron zip, varying only the yauzl version:

yauzl	result
2.10.0 (current)	resolves after 1 entry in ~100ms; version/path.txt missing
3.3.1	extracts all 585 entries in ~886ms; version = 42.3.0, binary present ✅

Environment

• Node v24.16.0
• Electron 42.3.0
• extract-zip@2.0.1 → yauzl@2.10.0
• macOS (darwin, arm64)

Proposed fix

Pin a Node 24-compatible yauzl via an overrides block in the root package.json:

"overrides": {
  "yauzl": "3.3.1"
}

Verified: with this override, extract-zip extracts the Electron archive fully and make electron-dev works.

Issue with the proposed fix is that I feel that an overrides key seems not correct.