deps(dev): bump electron from 30.1.0 to 31.0.0

[dependabot]

Bumps electron from 30.1.0 to 31.0.0.

Release notes

Sourced from electron's releases.

electron v31.0.0

Release Notes for v31.0.0

Stack Upgrades

• Chromium126.0.6478.36
  • New in 126
  • New in 125
• Node 20.14.0
  • Node 20.14.0 blog post
• V8 12.6

Breaking Changes

• Made window.flashFrame(bool) flash continuously on macOS. #41391
• Updated Chromium to 126.0.6445.0. (Removed: WebSQL support) #41868
• Updated Chromium to 125.0.6412.0. (Behavior Changed: nativeImage.toDataURL will preserve PNG colorspace) #41610

Features

Additions

• Added a new instance property navigationHistory on webContents API with navigationHistory.getEntryAtIndex method, enabling applications to retrieve the URL and title of any navigation entry within the browsing history. #41577 (Also in 29, 30)
• Added options parameter to Session.clearData API. #41355
• Added proxy configuring support for requests made with net module from utility process. #41335 (Also in 28, 29, 30)
• Added support for Bluetooth ports being requested by service class ID in navigator.serial. #41638 (Also in 29, 30)
• Added support for NODE_EXTRA_CA_CERTS. #41689
• Extended webContents.setWindowOpenHandler to support manual creation of BrowserWindow. #41432
• Implemented support for the File System API. #41419 (Also in 30)
• clearData method added to Session. #40983
• Extended WebContentsView to accept pre-existing webContents object. #42319

Improvements

• Extended WebContentsView to accept pre-existing webContents object. #42319
• Improved error messages when ses.cookies.set fails. #42400 (Also in 29, 30)
• Re-adds functionality to check whether or not an app was launched as a login service on macOS. #42422

Removed/Deprecated

• The inputFieldType property in the context-menu params has been removed. #41239 (Also in 30)

Fixes

• Added missing support for the recursive option in fs.{readdir|readdirSync} as well as fs.promises.{readdir|readdirSync}. #41582
• Added support for withFileTypes when calling fs.{readdir|readdirSync} with the recursive in Asar archives. #41627
• Fixed ASAN build on macOS. #41587
• Fixed a bug where a window with maximization disabled and WCO enabled would still show its maximization button. #41793
• Fixed an issue where child views in a BrowserWindow could sometimes be. #41256
• Fixed issue where windows made visible with showInactive were blank. #42227
• Fixed potentially incorrect exit code in UtilityProcess. #42397
• originalFs.promises.cp now works. #42134

Also in earlier versions...

• BrowserWindow.show() now correctly restores focus to inactive apps on macOS. #42305 (Also in 30)

... (truncated)

Commits

• f272c5f fix: multiple selection in //shell_dialogs Portal/KDE implementations (#42424)
• 9ab67cc fix: restore wasOpenedAtLogin functionality (#42422)
• 8035eff fix: iframe.contentWindow.document.fonts resolution (#42385)
• 038e261 feat: Allow WebContentsView to accept webContents object. (#42319)
• 0d12131 fix: don't destroy BrowserView webContents when owning BrowserWindow hasn't b...
• 993d333 refactor: improve cookie failure rejection messages (#42400)
• 5f78c62 fix: utilityProcess exit codes (#42397)
• 2021c2e fix: loginService -> loginItemService (#42404)
• 52bc1dc build: fix depot_tools patch (#42401)
• 540d88f chore: bump chromium to 126.0.6478.36 (31-x-y) (#42167)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/electron@31.0.0	Transitive: environment, filesystem, network, shell	+32	5.04 MB

🚮 Removed packages: npm/electron@30.1.0

View full report↗︎

[bajtos]

This PR upgrades Electron from v30 to v31. All tests are passing, so I am inclined to go ahead and land this pull request.

WDYT, @juliangruber?

[juliangruber]

For a major upgrade, I always test the change locally. Have you done that yet?

[bajtos]

For a major upgrade, I always test the change locally. Have you done that yet?

Makes sense to do a manual test 👍🏻

I was lazy and didn't do that 😏

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note
Install scripts	npm/electron@30.1.0	Install script: postinstall Source: node install.js

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/electron@30.1.0