[dependabot]

Bumps electron from 43.7.5 to 43.8.1.

Release notes

Sourced from electron's releases.

electron v43.8.1

Release Notes for v43.8.1

[!NOTE] This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

Fixes

• Fixed link-opened windows not using the opener's session and webPreferences. #55049 (Also in 42, 44, 45)
• Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55047 (Also in 42, 44, 45)

electron v43.8.0

Release Notes for v43.8.0

Fixes

• Fixed a crash on Linux at startup or on theme change with GTK modules loaded. #55016
• Fixed a crash when creating a framed window on Wayland in environments where GTK could not initialize. #54893 (Also in 44, 45)
• Fixed a Linux crash creating a window with a menu bar when GTK failed to load. #54884 (Also in 44, 45)
• Fixed an issue where clicks posted to a background app were dropped on macOS. #54905 (Also in 42, 44, 45)
• Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54908 (Also in 42, 44, 45)
• Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #54962 (Also in 42, 45)

Other Changes

• Backported fixes from upstream Chromium and V8. #55032
• Updated Node.js to v24.22.0. #55003

electron v43.7.11

Release Notes for v43.7.11

Other Changes

• Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #54899

Documentation

• Documentation changes: #54881

electron v43.7.10

Release Notes for v43.7.10

Fixes

• Fixed a crash when starting without an available display server on Linux. #54795 (Also in 45)
• Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout. #54611 (Also in 42, 44, 45)

electron v43.7.9

Release Notes for v43.7.9

... (truncated)

Commits

• 817c43f fix: apply the certificate SPKI blocklist to Node and add entries (43-x-y) (#...
• 9afe078 docs: fix code block line highlighting after docs reformats (#55103)
• 076d6db test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
• 3b068bf test: re-enable Node.js tests that now pass with BoringSSL (#55094)
• 60f928e build: stop overriding node GN declare_args defaults in patch (#55076)
• 14c73d1 build: update PGO profiles (#55092)
• 7ceb2c0 fix: avoid misaligned char16_t reads in crdtp string deserialization (#55063)
• 06f1c1f ci: use Cloudflare DNS directly on macOS runners (#55068)
• a68de91 fix: use the opener's session and webPreferences for windows opened from link...
• 6a2b850 ci: skip native builds when installing deps for type generation (#55065)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	electron@​43.7.5 ⏵ 43.8.3		+18	+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• electron@43.8.3

View full report

[claude]

🔴 Reviewers who approve this as the electron 43.8.1 security bump would merge a different, unreviewed release, 43.8.3, into every install and CI run. The lock entry at yarn.lock:728-737 resolves electron@ npm:43.8.3 with a new checksum. The commit message and its dependency-version: 43.8.1 metadata both say 43.8.1. Dependabot writes the message and the lockfile together, so this mismatch inside one commit is unexpected. Fix: make the lockfile and the PR metadata name the same version. Either regenerate the lock at 43.8.1, or have Dependabot recreate the PR for 43.8.3, and confirm the checksum against a clean yarn install.

Why this was flagged

HEAD commit 3781179 is signed off by dependabot[bot]. Its message says "bump electron from 43.7.5 to 43.8.1" and its trailer says dependency-version: 43.8.1. Its only change, to yarn.lock:728-737, sets version: 43.8.3, resolution: "electron@ npm:43.8.3" and checksum 10c0/2c3b38dd…. The release notes and GHSA-jr5w-w6x2-84p9 that reviewers are shown cover 43.8.1, not 43.8.3. Nothing in the repo would flag the mismatch. .yarnrc.yml lists electron under npmPreapprovedPackages, so the npmMinimalAgeGate: 10080 cooling-off period does not apply to it. package.json dependenciesMeta.electron.built: true lets electron's install.js run even though enableScripts: false is set. So whatever tarball matches this checksum is downloaded and its install script runs on every yarn install and in CI (xvfb-maybe electron ... in the test script). On the base branch the lock pins the reviewed 43.7.5. I could not query the registry from this sandbox. I therefore could not confirm that 43.8.3 is a legitimate published release or that the checksum matches it.

Verification: HEAD commit 3781179 (author dependabot[bot]) has the message "bump electron from 43.7.5 to 43.8.1", but yarn.lock lines 728-729 set resolution: "electron@ npm:43.8.3". So the version that merges and runs in every install and CI job is 43.8.3. .yarnrc.yml lists "electron" under npmPreapprovedPackages, so the age gate does not apply.

[dsanders11]

@SocketSecurity ignore npm/electron@43.8.3