fix(deps): update dependency electron to v35 [security] #1921
+10
−17
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
renovate
bot
force-pushed
the
renovate/npm-electron-vulnerability
branch
from
9ee4073 to
4ff7a3a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^31.7.7->^35.0.0GitHub Vulnerability Alerts
CVE-2025-55305
Impact
This only impacts apps that have the
embeddedAsarIntegrityValidationandonlyLoadAppFromAsarfuses enabled. Apps without these fuses enabled are not impacted.Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the
resourcesfolder in your app installation on Windows which these fuses are supposed to protect against.Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
38.0.0-beta.637.3.136.8.135.7.5For more information
If you have any questions or comments about this advisory, email us at [email protected]
Release Notes
electron/electron (electron)
v35.7.5: electron v35.7.5Compare Source
Release Notes for v35.7.5
Fixes
shell.openPathwas not non-blocking as expected. #48079 (Also in 36, 37, 38)v35.7.4: electron v35.7.4Compare Source
Release Notes for v35.7.4
v35.7.2: electron v35.7.2Compare Source
Release Notes for v35.7.2
Fixes
webContents.print({ silent: true })would fail. #47645 (Also in 36, 37)v35.7.0: electron v35.7.0Compare Source
Release Notes for v35.7.0
Other Changes
v35.6.0: electron v35.6.0Compare Source
Release Notes for v35.6.0
Features
--no-experimental-global-navigatorflag. #47416 (Also in 36, 37)Fixes
session.clearDatain some circumstances. #47410 (Also in 36, 37)electronfor the first time from an ESM module loaded by a CJS module in a packaged app. #47344 (Also in 36, 37)Fetch.continueResponsevia debugger withWebContentsViewcould cause a crash. #47443 (Also in 36, 37)webContents.print()where the callback would not be called. #47399 (Also in 36, 37)Other Changes
4206375. #47369v35.5.1: electron v35.5.1Compare Source
Release Notes for v35.5.1
Fixes
addChildView()crashes when adding a closed WebContentsView. #47339autoUpdateron macOS when zip extraction failed. #47299 (Also in 34, 36, 37)Other Changes
v35.5.0: electron v35.5.0Compare Source
Release Notes for v35.5.0
Features
screen.dipToScreenPoint(point)andscreen.screenToDipPoint(point)on Linux X11. #47124 (Also in 36, 37)--experimental-network-inspection. #47029 (Also in 36, 37)Fixes
shell.readShortcutLink. #47226 (Also in 36)backgroundMaterialfeature did not work in a frameless window on initial window creation. #47236 (Also in 36)treatPackageAsDirectoryis enabled on macOS. #47110 (Also in 36, 37)Other Changes
4033643. #47069v35.4.0: electron v35.4.0Compare Source
Release Notes for v35.4.0
Features
system-context-menuon Linux. #46977 (Also in 36)Fixes
win.setContentProtected()on Windows. #47034 (Also in 36, 37)Other Changes
v35.3.0: electron v35.3.0Compare Source
Release Notes for v35.3.0
Fixes
Other Changes
--js-flags=--perf-profon macOS. #46877 (Also in 36)v35.2.2: electron v35.2.2Compare Source
Release Notes for v35.2.2
Fixes
electron.shell.openExternalandelectron.shell.openPathto honor user-defined system defaults on Linux. #46789 (Also in 33, 34, 36)navigator.bluetooth.requestDeviceand theselect-bluetooth-deviceevent. #46784 (Also in 34, 36)enable_electron_extensions=false. #46840 (Also in 34, 36)Window.autoHideMenuBaras supported on Linux and Windows. #46829 (Also in 34, 36)visibleOnAllWorkspacesproperty on Linux. #46861v35.2.1: electron v35.2.1Compare Source
Release Notes for v35.2.1
Fixes
utilityProcess.postMessagewhen calling with an invalid transferable. #46666 (Also in 36)*filter was included. #46721 (Also in 34, 36)v35.2.0: electron v35.2.0Compare Source
Release Notes for v35.2.0
Features
nativeTheme.shouldUseDarkColorsForSystemIntegratedUIto distinguish system and app theme. #46599 (Also in 36)Fixes
window.emit('close')after toggling fullscreen mode. #46620 (Also in 36)app.commandLinefunctions. #46631 (Also in 36)--inspect-brkfailing in packaged apps. #46583 (Also in 36)assertNode.js module in the renderer process. #46632 (Also in 36)Other Changes
v35.1.5: electron v35.1.5Compare Source
Release Notes for v35.1.5
Fixes
parentPort. #46495 (Also in 34, 36)Unknown
v35.1.4: electron v35.1.4Compare Source
Release Notes for v35.1.4
Fixes
app.getGPUInfopromise. #46470 (Also in 34, 36)v35.1.3: electron v35.1.3Compare Source
Release Notes for v35.1.3
Fixes
context-menuevent weren't emitted as expected on Windows in draggable regions. #46334 (Also in 34, 36)UtilityProcess.forkprior to the app ready event would cause a crash. #46403 (Also in 34, 36)enabled = false), it is now greyed out. #46341 (Also in 34, 36)Other Changes
v35.1.2: electron v35.1.2Compare Source
Release Notes for v35.1.2
Fixes
navigationHistory.restore()failed to restore theuserAgentif it was overridden. #46300 (Also in 34, 36)Other Changes
v35.1.1: electron v35.1.1Compare Source
Release Notes for v35.1.1
Fixes
v35.1.0: electron v35.1.0Compare Source
Release Notes for v35.1.0
Features
ffmpeg.dllto delay load configuration. #46172 (Also in 34, 36)Fixes
webContents.print(). #46147 (Also in 36)system-context-menuincorrectly fired for all regions in frameless windows. #46178 (Also in 33, 34, 36)webContents.printToPDF()didn't work as expected with cross-process subframes. #46257 (Also in 34, 36)pushNotifications.registerForAPNSNotifications(). #46148 (Also in 34, 36)Other Changes
v35.0.3: electron v35.0.3Compare Source
Release Notes for v35.0.3
Fixes
Documentation
v35.0.2: electron v35.0.2Compare Source
Release Notes for v35.0.2
Fixes
Other Changes
v35.0.1: electron v35.0.1Compare Source
Release Notes for v35.0.1
Fixes
setContentProtection(true)was reverted when a given window was hidden. #45889 (Also in 34)Other Changes
4010597. #459384010597. #45943v35.0.0: electron v35.0.0Compare Source
Release Notes for v35.0.0
Stack Upgrades
134.0.6998.4422.14.013.4Breaking Changes
fromVersionIDonServiceWorkersto get an instance ofServiceWorkerMain. #45341getPreloadsandsetPreloadsonSession. #45329systemPreferences.isAeroGlassEnabled()API has been deprecated and will be removed without replacement. #45554Features
Additions
session.getSharedDictionaryUsageInfo(),session.getSharedDictionaryInfo(options),session.clearSharedDictionaryCache(), andsession.clearSharedDictionaryCacheForIsolationKey(options). #44750 (Also in 33, 34)NSPrefersDisplaySafeAreaCompatibilityMode=falseto Info.plist to remove "Scale to fit below built-in camera." from app options. #45357 (Also in 33, 34)ServiceWorkerMainclass to interact with service workers in the main process. #45341running-status-changedevent onServiceWorkersto indicate when a service worker's running status has changed.startWorkerForScopeonServiceWorkersto start a worker that may have been previously stopped.WebFrameMain.collectJavaScriptCallStack()for accessing the JavaScript call stack of unresponsive renderers. #44204 (Also in 33, 34)contextBridge.executeInMainWorldto safely execute code across world boundaries. #45330frameto 'console-message' event. #43617query-session-endevent and improvedsession-endevents on Windows. #44598view.getVisible(). #45409 (Also in 34)webContents.navigationHistory.restore(index, entries)API that allows restoration of navigation history. #45583 (Also in 34)document.executeCommand("paste"). #45471 (Also in 33, 34)roundedCornersBrowserWindow constructor option on Windows. #45740 (Also in 34)Improvements
registerPreloadScript,unregisterPreloadScript,getPreloadScriptsonSession.#45329Removed/Deprecated
Fixes
webContents.print()after switch to OOP printing on macOS and Linux. #45285window.print()on macOS/Linux. #45259webFrame.getZoomLevelandwebFrame.getZoomFactorAPIs. #45557Also in earlier versions...
chrome.i18nextension API being unavailable in service workers. #45031 (Also in 31, 32, 33, 34)trace-startupnot working on macOS. #44257 (Also in 32, 33, 34)v8.setHeapSnapshotNearHeapLimitapi in main and utility process, along with support for--diagnostic-dirNode.js cli flag to specify the directory to save the heap snapshots. #45632 (Also in 33, 34)shell.readShortcutLinkon Windows. #44784 (Also in 33, 34)shell.readShortcutLinkcaused byPKEY_AppUserModel_ToastActivatorCLSIDsometimes being represented by a string uuid. #45348 (Also in 33, 34)chrome.tabs.update(). #45302 (Also in 33, 34)getUserMediawith an invalidchromeMediaSourceId. #45755 (Also in 34)EventSourcewasundefinedin both renderer and worker processes when Node.js integration was enabled. #44475 (Also in 32, 33, 34)WebContentsViews were being improperly removed. #44656 (Also in 31, 32, 33, 34)contextmenuevents wouldn't be correctly dispatched in draggable regions on Linux. #45841 (Also in 34)resizewasn't being emitted for single-pixel resizes on Windows. #44700 (Also in 32, 33, 34)utilityProcesspid would not beundefinedafter exit. #44677 (Also in 32, 33, 34)getAsFileSystemHandleto never resolve. #45256 (Also in 33, 34)dialogmodule didn't work on Linux. #45394 (Also in 34)exitevent could be emitted twice from theutilityProcess. #44243 (Also in 31, 32, 33, 34)context-menuevent was not emitted when using-webkit-app-region: drag. #44761 (Also in 32, 33, 34)backgroundMateriallost effect on maximization. #45525 (Also in 34)context-menuevent. #44940 (Also in 32, 33, 34)