build(deps-dev): bump electron to 45.1.0 and typescript to 7 by dependabot[bot] · Pull Request #275 · electron/remote

dependabot · 2026-10-28T21:31:12Z

Bumps electron from 39.8.10 to 42.11.16.

Release notes

electron v42.11.16

Release Notes for v42.11.16

[!NOTE] This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

Fixes

Fixed link-opened windows not using the opener's session and webPreferences. #55050 (Also in 43, 44, 45)

Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55054 (Also in 43, 44, 45)

electron v42.11.15

Release Notes for v42.11.15

Fixes

Fixed a crash on Linux at startup or on theme change with GTK modules loaded. #55015

Fixed an issue where clicks posted to a background app were dropped on macOS. #54906 (Also in 43, 44, 45)

Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54925 (Also in 43, 44, 45)

Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #55000 (Also in 43, 45)

Other Changes

Backported fixes from upstream Chromium and V8. #55035

electron v42.11.14

Release Notes for v42.11.14

Other Changes

Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #54900

electron v42.11.13

Release Notes for v42.11.13

Fixes

Fixed a crash when starting without an available display server on Linux. #54796 (Also in 45)

electron v42.11.12

Release Notes for v42.11.12

Fixes

Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout. #54610 (Also in 43, 44, 45)

Other Changes

Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. #54668

... (truncated)

Commits

093583c fix: apply the certificate SPKI blocklist to Node and add entries (42-x-y) (#...
d39162f docs: fix code block line highlighting after docs reformats (#55104)
b3de384 test: keep WebContentsView visibility specs' windows on top on Windows (42-x-...
7495684 build: update PGO profiles (#55091)
83a6c43 ci: skip native builds when installing deps for type generation (#55064)
716c0b2 fix: intermittent certificate errors for concurrent requests with setCertific...
a333668 ci: use Cloudflare DNS directly on macOS runners (#55069)
ab438f1 fix: use the opener's session and webPreferences for windows opened from link...
0d40700 chore: cherry-pick 10 changes from chromium and v8 (#55035)
2276df8 test: wait for service worker activation before stopping it (#55019)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [electron](https://github.com/electron/electron) from 39.8.10 to 42.11.16. - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v39.8.10...v42.11.16) --- updated-dependencies: - dependency-name: electron dependency-version: 42.11.16 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-28T21:31:35Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
typescript@4.1.3 ⏵ 7.0.2			^-11		⁺²⁰
typescript@4.1.3 ⏵ 6.0.3	⁺¹		^-10		⁺¹⁰
mocha@11.7.4 ⏵ 10.8.2				^-2
electron@39.8.10 ⏵ 45.1.0	⁺⁶	⁺⁵⁰

View full report

socket-security · 2026-10-28T21:31:37Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	Deprecated by its maintainer: npm `inflight` Reason: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful. From: package.json → `npm/mocha@10.8.2` → `npm/inflight@1.0.6` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/inflight@1.0.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

Ignoring alerts on:

electron@45.1.0

View full report

Electron 42's electron.d.ts references the WebCodecs `VideoFrame` type (SharedTexture getVideoFrame), which TypeScript 4.1's lib.dom does not define, so `yarn tsc` failed with TS2304: Cannot find name 'VideoFrame'. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

…gate Dependabot locked @electron-internal/extract-zip@1.0.7, published hours before the PR, which bypasses the repo's npmMinimalAgeGate (7 days) and trips Socket's "Recently published" block alert. Re-resolving with yarn picks 1.0.5, the newest version satisfying the age gate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

Electron 42 adds `sharedTexture` to the browser module list, so the "includes browser process modules as properties" spec failed with "expected [ Array(40) ] to deeply equal [ Array(41) ]". Add it to browserModuleNames so remote exposes it like other main-process modules (older Electron versions simply lack it, as with other newer modules). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

Yarn 4.10.3's builtin TypeScript compat patch fails to apply to TypeScript 7 (ENOENT on lib/_tsc.js); 4.17.1+ handles it. The lockfile metadata version is bumped to 10 by the new release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

TypeScript 7 no longer auto-includes every @types package, so list the ambient type packages the sources and specs rely on, and add the es2021.intl lib that @types/node's esnext.intl reference now needs. Emitted output is unchanged. ts-node 8 cannot load TypeScript 7 (it no longer exposes the compiler API from require('typescript')), so add a typescript6 alias and point ts-node at it from the test bootstrap via TS_NODE_COMPILER. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

Electron 45's typings reference `stream/web`, which @types/node@14 does not declare, so enable skipLibCheck (this also keeps older electron.d.ts versions in the CI matrix from failing the build). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

Electron 45 adds `ClipboardItem` to the main-process exports, so the "includes browser process modules as properties" spec would fail. Add it to browserModuleNames so remote exposes it like other main-process modules (older Electron versions simply lack it). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

In Yarn 4, `-P` means `--peer`, so `yarn add "electron@N" -P` only rewrote the peerDependencies range and every matrix job actually ran against the locked devDependency version. Use `-D` so each job installs and tests the Electron version it is named for. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

erickzhao · 2026-10-28T22:50:17Z

@SocketSecurity ignore npm/electron@45.1.0

mocha 11 requires `node:`-prefixed builtins, which Node 14.16 (Electron 12-14) cannot resolve, so loading the test entry threw "Cannot find module 'node:os'" in the main process and the app never quit. These versions had not really been tested since the matrix only started installing the matrix Electron in the previous commit. - downgrade mocha to ^10.8.2 (supports Node >= 14) - exit with a non-zero code if loading mocha fails instead of hanging - add a 15 minute timeout to the test job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiGRtD3EFaCFbYyrfxjpfp

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 28, 2026

dependabot Bot requested a review from a team as a code owner October 28, 2026 21:31

dependabot Bot added the javascript Pull requests that update Javascript code label Oct 28, 2026

dependabot Bot requested review from a team as code owners October 28, 2026 21:31

dependabot Bot mentioned this pull request Oct 28, 2026

build(deps-dev): bump electron from 39.8.10 to 42.11.3 #271

Closed

claude added 8 commits October 28, 2026 21:49

claude Bot changed the title ~~build(deps-dev): bump electron from 39.8.10 to 42.11.16~~ build(deps-dev): bump electron to 45.1.0 and typescript to 7 Oct 28, 2026

erickzhao approved these changes Oct 28, 2026

View reviewed changes

dsanders11 approved these changes Oct 29, 2026

View reviewed changes

dsanders11 merged commit 70d2604 into main Oct 29, 2026
39 checks passed

dsanders11 deleted the dependabot/npm_and_yarn/electron-42.11.16 branch October 29, 2026 00:51

Navigation Menu

Repository navigation

build(deps-dev): bump electron to 45.1.0 and typescript to 7 - #275

build(deps-dev): bump electron to 45.1.0 and typescript to 7#275
dsanders11 merged 10 commits into
mainfrom
dependabot/npm_and_yarn/electron-42.11.16

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

socket-security Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

erickzhao commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Oct 28, 2026

electron v42.11.16

Release Notes for v42.11.16

Fixes

electron v42.11.15

Release Notes for v42.11.15

Fixes

Other Changes

electron v42.11.14

Release Notes for v42.11.14

Other Changes

electron v42.11.13

Release Notes for v42.11.13

Fixes

electron v42.11.12

Release Notes for v42.11.12

Fixes

Other Changes

Uh oh!

socket-security Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erickzhao commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

socket-security Bot commented Oct 28, 2026 •

edited

Loading

socket-security Bot commented Oct 28, 2026 •

edited

Loading