[dependabot]

Bumps electron from 39.8.10 to 42.11.3.

Release notes

Sourced from electron's releases.

electron v42.11.3

Release Notes for v42.11.3

Fixes

• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53695 (Also in 43, 44, 45)
• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53736 (Also in 43, 44, 45)
• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53497 (Also in 43, 44, 45)
• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53511 (Also in 43, 44, 45)
• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53585 (Also in 43, 44, 45)
• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53541 (Also in 43, 44, 45)
• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53674 (Also in 43, 44, 45)
• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53727 (Also in 43, 44, 45)
• <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53719 (Also in 43, 44, 45)
• getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53710 (Also in 43, 44, 45)
• nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53713 (Also in 43, 44, 45)
• openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53697 (Also in 43, 44, 45)
• pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53702 (Also in 43, 44, 45)

electron v42.11.2

Release Notes for v42.11.2

Fixes

• Fixed application crash after a large number of IPC messages from renderers. #53419 (Also in 43, 44, 45)
• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53394 (Also in 43, 44, 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53480
• Backported fixes from upstream Chromium, Dawn, Skia and V8. #53397
• Backported fixes from upstream Chromium, V8, ANGLE, Dawn, Skia, WebRTC and DevTools. #53367

electron v42.11.1

Release Notes for v42.11.1

Fixes

• Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get. #53355 (Also in 43, 44, 45)
• Fixed a renderer crash when an array with a throwing property getter is passed across contextBridge, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps. #53329 (Also in 43, 44)

Other Changes

• Security: backported fixes for CVE-2026-15764, CVE-2026-15765, CVE-2026-15766, CVE-2026-15767, CVE-2026-15768, CVE-2026-15769, CVE-2026-15770, CVE-2026-15771, CVE-2026-15772, CVE-2026-15773, CVE-2026-15774, CVE-2026-15775, CVE-2026-15776, CVE-2026-15777, CVE-2026-15778. #53344

electron v42.11.0

Release Notes for v42.11.0

Fixes

• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53318 (Also in 43, 44, 45)
• Fixed a crash when calling node:wasi functions in optimized code. #53267 (Also in 43, 44, 45)

... (truncated)

Commits

• 22de0a3 fix: report the requesting frame for hid and usb permission checks (42-x-y) (...
• 16c4536 test: run the Squirrel.Mac updater specs off a signed template, split, and se...
• 65d777e fix: check the sending frame for internal guest, window and reply IPCs (42-x-...
• a86ae42 fix: route modifier-click and OpenURLFromTab popups through the window-open p...
• f8600c9 fix: require a registered source id for webContents capture via getUserMedia ...
• 900eabb fix: gate preload and worker Node integration on the creating frame (42-x-y) ...
• 3275df6 fix: scope File System Access grants to the requesting document (42-x-y) (#53...
• 004b4ab fix: attribute pointer lock, keyboard lock and paste checks to the requesting...
• e0a20d5 fix: attribute openExternal permission requests to the navigation's initiator...
• 951b50f fix: resolve the capturing webContents in setDisplayMediaRequestHandler (#53674)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	electron@​39.8.10 ⏵ 42.11.3	+6	+40

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Recently published: npm undici published 6 days ago Location: Package overview From: package.json → npm/electron@42.11.3 → npm/undici@7.30.1 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.30.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block

View full report

[dsanders11]

CI is all red