From 263d166553375342d8f531efb7b67b5db6f2a304 Mon Sep 17 00:00:00 2001 From: Shane Fitzpatrick Date: Wed, 28 Oct 2026 16:48:23 -0700 Subject: [PATCH] Bump Electron to 43.8.3 Summary: This diff moves Electron from 43.0.0 to 43.8.3. Electron 43.0.0 is in the affected range for CVE-2026-115570. The 43 line is fixed from 43.8.1 (T294720216). Changelog: [Internal] The `xplat/js/tools/electron` shim and the `electron` pin in `debugger-shell` must stay on the same version. In the xplat/js workspace, the pin is what links `debugger-shell` to the shim. If only the shim moves, yarn looks for npm `electron@43.0.0`, which is not in `xplat/js/yarn.lock`, and frozen installs fail. NimbleRecorder (`NR_HTML`) also uses this shim. The next diff in the stack refreshes its lockfile. Command run: ``` js1 upgrade electron --version 43.8.3 --no-ephemeral ``` The devserver that ran the command cannot reach GitHub. So `electron/get` read the release files from a local mirror (`ELECTRON_MIRROR=http://127.0.0.1:18743/`). The mirror held the 5 official zips and the official `SHASUMS256.txt`, and `electron/get` checked each zip against it. The darwin-x64, darwin-arm64, linux-x64, and win32-x64 zips come from `arvr/js/third-party/electron`. The diff author downloaded the linux-arm64 zip from the GitHub release. All 5 SHA-256 values match `SHASUMS256.txt-43.8.3` and the `checksums.json` in the npm package. Differential Revision: D128177919 --- packages/debugger-shell/package.json | 2 +- yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/debugger-shell/package.json b/packages/debugger-shell/package.json index 23a04ba7f99a..aac8074381ab 100644 --- a/packages/debugger-shell/package.json +++ b/packages/debugger-shell/package.json @@ -46,7 +46,7 @@ "fb-dotslash": "0.5.8" }, "devDependencies": { - "electron": "43.0.0", + "electron": "43.8.3", "semver": "^7.1.3" }, "files": [ diff --git a/yarn.lock b/yarn.lock index 5ff2281ce3bc..8b48c42485e1 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3930,10 +3930,10 @@ electron-to-chromium@^1.5.73: resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.113.tgz#1175b8ba4170541e44e9afa8b992e5bbfff0d150" integrity sha512-wjT2O4hX+wdWPJ76gWSkMhcHAV2PTMX+QetUCPYEdCIe+cxmgzzSSiGRCKW8nuh4mwKZlpv0xvoW7OF2X+wmHg== -electron@43.0.0: - version "43.0.0" - resolved "https://registry.yarnpkg.com/electron/-/electron-43.0.0.tgz#091f2a0442023b94db23a955bf829f25ee9b9f0c" - integrity sha512-PV60GsWU6qufhuOhw3n+Yix3WPDcqDtBqE8orbEQGQGHEkgp9o/JCPgb7L4vIL0r1HnfPdqSRtboOTqbDkcFDQ== +electron@43.8.3: + version "43.8.3" + resolved "https://registry.yarnpkg.com/electron/-/electron-43.8.3.tgz#1abeaec1e6ff4df187e6c44d2619fb8609e7c289" + integrity sha512-KgvSm3bHXz96hSXzqxyRjLeli80rIdszbDQFKlRSfckmGazTPCH/CxUN31Dp9c5rFKTQSNf9gPJRWl1yWNB3pA== dependencies: "@electron-internal/extract-zip" "^1.0.1" "@electron/get" "^5.0.0"