You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by "liugddx (via GitHub)" <gi...@apache.org> on 2026/10/18 12:13:29 UTC
[PR] chore(deps): bump electron from 43.4.1 to 43.5.0 [maka]
liugddx opened a new pull request, #6153:
URL: https://github.com/apache/maka/pull/6153
## Summary
Bumps Electron from 43.4.1 to 43.5.0 (patch release) to fix [GHSA-qmv3-fv6v-rmhq](https://github.com/advisories/GHSA-qmv3-fv6v-rmhq) / CVE-2026-102677: a compromised renderer can poison the sandboxed preload code cache. Electron is the runtime inside every Desktop package. Dependabot reports the advisory as development scope only because Electron is declared under `devDependencies`, but end users are affected.
- `apps/desktop/package.json`: `43.4.1` → `43.5.0`
- `packages/runtime-host/package.json`: dev range `^43.4.1` → `^43.5.0`, so the vulnerable patch level is no longer admitted
- `package-lock.json`: only the `electron` entries change
This supersedes #5857. That PR changed `apps/desktop/package.json` without the lockfile, so `npm ci` failed in every lane ("lock file's electron@43.4.1 does not satisfy electron@43.5.0").
## Verification
- `npm ci --dry-run` passes, so the lockfile and manifests are in sync. The installed binary reports Electron 43.5.0, Node 24.19.0, Chrome 150.0.7871.250.
- `npm run build` passes.
- `@maka/desktop` `test:dist`: 3847/3847 relevant tests pass. Three failures came from a stale compiled test left in local `dist/` by another branch; that file does not exist on this branch, and I removed it.
- Real Electron window smoke (`scripts/desktop-real-window-smoke.mjs --programmatic-only`, macOS 26.5.1 arm64):
- The window, window flags, renderer mount and no-ErrorBoundary checks all pass.
- Three focus-dependent checks fail (search modal open, focus target, dock visible) because the smoke was launched from a background process.
- As a control, I ran the same smoke on Electron 43.4.1 (current `main`) the same way. It gives the identical 4 PASS / 3 FAIL result, so those failures are environmental, not from this bump.
- Not run locally: packaging and Windows/Linux lanes. CI covers them.
## AI use
- [ ] No generative tool made a substantive contribution
- [x] Generative tooling made a substantive contribution
Tool(s) and scope: Claude Code made the bump, regenerated the lockfile and ran the checks above, including the 43.4.1 control run.
## Checklist
- [ ] Tests cover the change and fail without it
- [x] Lint, format, typecheck and the affected suites pass locally
Does this PR entail a change in behavior?
- [ ] Yes — described under Summary above
- [x] No
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [PR] chore(deps): bump electron from 43.4.1 to 43.5.0 [maka]
Posted by "liugddx (via GitHub)" <gi...@apache.org>.
liugddx merged PR #6153:
URL: https://github.com/apache/maka/pull/6153
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org