-
-
Notifications
You must be signed in to change notification settings - Fork 12
chore(deps): update dependency electron to v35 [security] #470
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/npm-electron-vulnerability
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
d936f07 to
26e6804
Compare
26e6804 to
09a0244
Compare
09a0244 to
72414d7
Compare
72414d7 to
a54f486
Compare
a54f486 to
e50f837
Compare
e50f837 to
b3d88fe
Compare
b3d88fe to
5bb1990
Compare
5bb1990 to
af82fc3
Compare
af82fc3 to
96ab06d
Compare
96ab06d to
6198125
Compare
6198125 to
d8eadeb
Compare
d8eadeb to
2254c23
Compare
2254c23 to
ffc9a3d
Compare
ffc9a3d to
1da1ec7
Compare
1da1ec7 to
4e4ead6
Compare
4e4ead6 to
92de87e
Compare
92de87e to
277718a
Compare
277718a to
abd1514
Compare
abd1514 to
89f9662
Compare
89f9662 to
02f33ec
Compare
e89d6c2 to
6c35850
Compare
0af2efa to
9d5c44f
Compare
9d5c44f to
5b04dbc
Compare
5b04dbc to
d800406
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~26.2.0->~35.7.5GitHub Vulnerability Alerts
CVE-2024-46993
Impact
The
nativeImage.createFromPath()andnativeImage.createFromBuffer()functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents.Workaround
There are no app-side workarounds for this issue. You must update your Electron version to be protected.
Patches
v28.3.2v29.3.3v30.0.3For More Information
If you have any questions or comments about this advisory, email us at security@electronjs.org.
CVE-2025-55305
Impact
This only impacts apps that have the
embeddedAsarIntegrityValidationandonlyLoadAppFromAsarfuses enabled. Apps without these fuses enabled are not impacted.Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the
resourcesfolder in your app installation on Windows which these fuses are supposed to protect against.Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
38.0.0-beta.637.3.136.8.135.7.5For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Release Notes
electron/electron (electron)
v35.7.5: electron v35.7.5Compare Source
Release Notes for v35.7.5
Fixes
shell.openPathwas not non-blocking as expected. #48079 (Also in 36, 37, 38)v35.7.4: electron v35.7.4Compare Source
Release Notes for v35.7.4
v35.7.2: electron v35.7.2Compare Source
Release Notes for v35.7.2
Fixes
webContents.print({ silent: true })would fail. #47645 (Also in 36, 37)v35.7.0: electron v35.7.0Compare Source
Release Notes for v35.7.0
Other Changes
v35.6.0: electron v35.6.0Compare Source
Release Notes for v35.6.0
Features
--no-experimental-global-navigatorflag. #47416 (Also in 36, 37)Fixes
session.clearDatain some circumstances. #47410 (Also in 36, 37)electronfor the first time from an ESM module loaded by a CJS module in a packaged app. #47344 (Also in 36, 37)Fetch.continueResponsevia debugger withWebContentsViewcould cause a crash. #47443 (Also in 36, 37)webContents.print()where the callback would not be called. #47399 (Also in 36, 37)Other Changes
4206375. #47369v35.5.1: electron v35.5.1Compare Source
Release Notes for v35.5.1
Fixes
addChildView()crashes when adding a closed WebContentsView. #47339autoUpdateron macOS when zip extraction failed. #47299 (Also in 34, 36, 37)Other Changes
v35.5.0: electron v35.5.0Compare Source
Release Notes for v35.5.0
Features
screen.dipToScreenPoint(point)andscreen.screenToDipPoint(point)on Linux X11. #47124 (Also in 36, 37)--experimental-network-inspection. #47029 (Also in 36, 37)Fixes
shell.readShortcutLink. #47226 (Also in 36)backgroundMaterialfeature did not work in a frameless window on initial window creation. #47236 (Also in 36)treatPackageAsDirectoryis enabled on macOS. #47110 (Also in 36, 37)Other Changes
4033643. #47069v35.4.0: electron v35.4.0Compare Source
Release Notes for v35.4.0
Features
system-context-menuon Linux. #46977 (Also in 36)Fixes
win.setContentProtected()on Windows. #47034 (Also in 36, 37)Other Changes
v35.3.0: electron v35.3.0Compare Source
Release Notes for v35.3.0
Fixes
Other Changes
--js-flags=--perf-profon macOS. #46877 (Also in 36)v35.2.2: electron v35.2.2Compare Source
Release Notes for v35.2.2
Fixes
electron.shell.openExternalandelectron.shell.openPathto honor user-defined system defaults on Linux. #46789 (Also in 33, 34, 36)navigator.bluetooth.requestDeviceand theselect-bluetooth-deviceevent. #46784 (Also in 34, 36)enable_electron_extensions=false. #46840 (Also in 34, 36)Window.autoHideMenuBaras supported on Linux and Windows. #46829 (Also in 34, 36)visibleOnAllWorkspacesproperty on Linux. #46861v35.2.1: electron v35.2.1Compare Source
Release Notes for v35.2.1
Fixes
utilityProcess.postMessagewhen calling with an invalid transferable. #46666 (Also in 36)*filter was included. #46721 (Also in 34, 36)v35.2.0: electron v35.2.0Compare Source
Release Notes for v35.2.0
Features
nativeTheme.shouldUseDarkColorsForSystemIntegratedUIto distinguish system and app theme. #46599 (Also in 36)Fixes
window.emit('close')after toggling fullscreen mode. #46620 (Also in 36)app.commandLinefunctions. #46631 (Also in 36)--inspect-brkfailing in packaged apps. #46583 (Also in 36)assertNode.js module in the renderer process. #46632 (Also in 36)Other Changes
v35.1.5: electron v35.1.5Compare Source
Release Notes for v35.1.5
Fixes
parentPort. #46495 (Also in 34, 36)Unknown
v35.1.4: electron v35.1.4Compare Source
Release Notes for v35.1.4
Fixes
app.getGPUInfopromise. #46470 (Also in 34, 36)v35.1.3: electron v35.1.3Compare Source
Release Notes for v35.1.3
Fixes
context-menuevent weren't emitted as expected on Windows in draggable regions. #46334 (Also in 34, 36)UtilityProcess.forkprior to the app ready event would cause a crash. #46403 (Also in 34, 36)enabled = false), it is now greyed out. #46341 (Also in 34, 36)Other Changes
v35.1.2: electron v35.1.2Compare Source
Release Notes for v35.1.2
Fixes
navigationHistory.restore()failed to restore theuserAgentif it was overridden. #46300 (Also in 34, 36)Other Changes
v35.1.1: electron v35.1.1Compare Source
Release Notes for v35.1.1
Fixes
v35.1.0: electron v35.1.0Compare Source
Release Notes for v35.1.0
Features
ffmpeg.dllto delay load configuration. #46172 (Also in 34, 36)Fixes
webContents.print(). #46147 (Also in 36)system-context-menuincorrectly fired for all regions in frameless windows. #46178 (Also in 33, 34, 36)webContents.printToPDF()didn't work as expected with cross-process subframes. #46257 (Also in 34, 36)pushNotifications.registerForAPNSNotifications(). #46148 (Also in 34, 36)Other Changes
v35.0.3: electron v35.0.3Compare Source
Release Notes for v35.0.3
Fixes
Documentation
v35.0.2: electron v35.0.2Compare Source
Release Notes for v35.0.2
Fixes
Other Changes
v35.0.1: electron v35.0.1Compare Source
Release Notes for v35.0.1
Fixes
setContentProtection(true)was reverted when a given window was hidden. #45889 (Also in 34)Other Changes
4010597. #459384010597. #45943v35.0.0: electron v35.0.0Compare Source
Release Notes for v35.0.0
Stack Upgrades
134.0.6998.4422.14.013.4Breaking Changes
fromVersionIDonServiceWorkersto get an instance ofServiceWorkerMain. #45341getPreloadsandsetPreloadsonSession. #45329systemPreferences.isAeroGlassEnabled()API has been deprecated and will be removed without replacement. #45554Features
Additions
session.getSharedDictionaryUsageInfo(),session.getSharedDictionaryInfo(options),session.clearSharedDictionaryCache(), andsession.clearSharedDictionaryCacheForIsolationKey(options). #44750 (Also in 33, 34)NSPrefersDisplaySafeAreaCompatibilityMode=falseto Info.plist to remove "Scale to fit below built-in camera." from app options. #45357 (Also in 33, 34)ServiceWorkerMainclass to interact with service workers in the main process. #45341running-status-changedevent onServiceWorkersto indicate when a service worker's running status has changed.startWorkerForScopeonServiceWorkersto start a worker that may have been previously stopped.WebFrameMain.collectJavaScriptCallStack()for accessing the JavaScript call stack of unresponsive renderers. #44204 (Also in 33, 34)contextBridge.executeInMainWorldto safely execute code across world boundaries. #45330frameto 'console-message' event. #43617query-session-endevent and improvedsession-endevents on Windows. #44598view.getVisible(). #45409 (Also in 34)webContents.navigationHistory.restore(index, entries)API that allows restoration of navigation history. #45583 (Also in 34)document.executeCommand("paste"). #45471 (Also in 33, 34)roundedCornersBrowserWindow constructor option on Windows. #45740 (Also in 34)Improvements
registerPreloadScript,unregisterPreloadScript,getPreloadScriptsonSession.#45329Removed/Deprecated
Fixes
webContents.print()after switch to OOP printing on macOS and Linux. #45285window.print()on macOS/Linux. #45259webFrame.getZoomLevelandwebFrame.getZoomFactorAPIs. #45557Also in earlier versions...
chrome.i18nextension API being unavailable in service workers. #45031 (Also in 31, 32, 33, 34)trace-startupnot working on macOS. #44257 (Also in 32, 33, 34)v8.setHeapSnapshotNearHeapLimitapi in main and utility process, along with support for--diagnostic-dirNode.js cli flag to specify the directory to save the heap snapshots. #45632 (Also in 33, 34)shell.readShortcutLinkon Windows. #44784 (Also in 33, 34)shell.readShortcutLinkcaused byPKEY_AppUserModel_ToastActivatorCLSIDsometimes being represented by a string uuid. #45348 (Also in 33, 34)chrome.tabs.update(). #45302 (Also in 33, 34)getUserMediawith an invalidchromeMediaSourceId. #45755 (Also in 34)EventSourcewasundefinedin both renderer and worker processes when Node.js integration was enabled. #44475 (Also in 32, 33, 34)WebContentsViews were being improperly removed. #44656 (Also in 31, 32, 33, 34)contextmenuevents wouldn't be correctly dispatched in draggable regions on Linux. #45841 (Also in 34)resizewasn't being emitted for single-pixel resizes on Windows. #44700 (Also in 32, 33, 34)utilityProcesspid would not beundefinedafter exit. #44677 (Also in 32, 33, 34)getAsFileSystemHandleto never resolve. #45256 (Also in 33, 34)dialogmodule didn't work on Linux. #45394 (Also in 34)exitevent could be emitted twice from theutilityProcess. #44243 (Also in 31, 32, 33, 34)context-menuevent was not emitted when using-webkit-app-region: drag. #44761 (Also in 32, 33, 34)backgroundMateriallost effect on maximization. #45525 (Also in 34)context-menuevent. #44940 (Also in 32, 33, 34)