This repository has been archived by the owner on Oct 18, 2020. It is now read-only.
Update dependency electron to v7 [SECURITY] #27
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.0.4->7.2.4GitHub Vulnerability Alerts
CVE-2020-4077
Impact
Apps using both
contextIsolationandcontextBridgeare affected.This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.
Fixed Versions
9.0.0-beta.218.2.47.2.4For more information
If you have any questions or comments about this advisory:
CVE-2020-4076
Impact
Apps using
contextIsolationare affected.This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.
Fixed Versions
9.0.0-beta.218.2.47.2.4Non-Impacted Versions
9.0.0-beta.*For more information
If you have any questions or comments about this advisory:
CVE-2020-4075
Impact
The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.
Workarounds
Ensure you are calling
event.preventDefault()on allnew-windowevents where theurloroptionsis not something you expect.Fixed Versions
9.0.0-beta.218.2.47.2.4For more information
If you have any questions or comments about this advisory:
CVE-2020-15096
Impact
Apps using
contextIsolationare affected.This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.
Fixed Versions
9.0.0-beta.218.2.47.2.46.1.11For more information
If you have any questions or comments about this advisory:
Release Notes
electron/electron
v7.2.4Compare Source
Release Notes for v7.2.4
Fixes
nativeWindowOpen: truecould invoke the non-native-open path. #23224v7.2.3Compare Source
Release Notes for v7.2.3
Fixes
a9bead2v7.2.2Compare Source
Release Notes for v7.2.2
Fixes
zoomFactorvalues when setting the zoom factor of a webpage. #22710maximizablestate persistence of BrowserWindows on macOS. #230191065094. #23059Other Changes
1023810). #22869v7.2.1Compare Source
Release Notes for v7.2.1
Fixes
cac3884v7.2.0Compare Source
Release Notes for v7.2.0
Features
useSessionCookiesflag tonetrequests to allow them to use the session cookie store.Fixes
c16c4c2Objectprototype could cause internal Electron logic to throw errors. #22729Unknown
ace3216v7.1.14Compare Source
Release Notes for v7.1.14
Fixes
safeDialogpreferences not being passed properly. #22376v7.1.13Compare Source
Release Notes for v7.1.13
Fixes
webRequestAPI not working with WebSockets. #22141webContents.print()with custom print margins. #22187undefinedwas printed fromconsole.logon Window when no arguments were passed. #22173Other Changes
deviceNames inwebContents.print(). #22012Documentation
v7.1.12Compare Source
Release Notes for v7.1.12
Fixes
contextBridgemodule. #22112v7.1.11Compare Source
Release Notes for v7.1.11
Fixes
window.print()only worked once on a singleBrowserWindow. #21911Documentation
v7.1.10Compare Source
Release Notes for v7.1.10
Fixes
BrowserWindow.setFocusable(true)not working on Windows. #21855set-cookieheader not passed in net module. #21770Other Changes
v7.1.9Compare Source
Release Notes for v7.1.9
Fixes
nativeWindowOpen: falseand an unsandboxed parent window. Also fixeddocument.visibilityStatenot working in sandboxed<webview>. #21696shell.showItemInFolderon Windows. #21749Documentation
v7.1.8Compare Source
Release Notes for v7.1.8
Fixes
netmodule where aborting a request during a redirect could cause an error to be thrown. #21645defaultIdis passed for dialog message boxes. #21652Other Changes
crashReporterto throw an error forgetLastCrashReportifcrashReporternot started. #21683v7.1.7Compare Source
Release Notes for v7.1.7
Fixes
v7.1.6Compare Source
Release Notes for v7.1.6
Fixes
<select>tag inside<webview>and OOPIF on windows. #21526v7.1.5Compare Source
Release Notes for v7.1.5
Fixes
cookies.setnot working correctly whennameorexpirationDateis omitted. #21481v7.1.4Compare Source
Release Notes for v7.1.4
Fixes
webContents.setBackgroundThrottling. #21357Other Changes
v7.1.3Compare Source
Release Notes for v7.1.3
Fixes
--ignore-connections-limit, ironically, being ignored. #21299net.request. #21135disabled-by-default-cpu_profilertracing category now correctly records stack samples from the main process and utility processes. #21277webContents.reloadIgnoringCache()will now forcefully ignore all caches, including service workers. #21284window.rootandwindow.GLOBALare both now undefined whennodeIntegrationis disabled as expected. #21354Other Changes
netmodule. #21304v7.1.2Compare Source
Release Notes for v7.1.2
Fixes
<webview>.capturePage()resolving with an empty object instead ofNativeImageinstance. #21104webRequestmodule unable to modify CORS headers. #21123registerStreamProtocolwould sometimes fail to complete the response when the stream ended. #21179Other Changes
v7.1.1Compare Source
Release Notes for v7.1.1
Fixes
backgroundThrottling: falsenot having an effect. #21013globalShortcut.registerAll()on Windows and Linux. #20983recentDocumentsMenuItem. #20957app.setAppLogsPathdid not work when you provided a valid path. #21008Other Changes
v7.1.0Compare Source
Release Notes for v7.1.0
This release is a minor bump as it contains exactly one new feature.
contextBridgemodule, this feature is outlined below along with the other fixes and changes that went into this release. The7.1.xseries is now only release line in the7.x.ymajor release line that will receive bug fixes and security fixes. It is recommended you upgrade to7.1.x.Features
contextBridgemodule to make it easier to communicate between an isolated context and the main world. #20789Fixes
nativeThemenot accessible via theremotemodule. #20961Bluebirdwas installed in the renderer. #20947Other Changes
18176b4,ef548b6v7.0.1Compare Source
Release Notes for v7.0.1
Fixes
shell.openExternal()optionworkingDirectorynot working with Unicode characters. #20905menu.popup(). #20808recentDocumentsrole on macOS. #20670remotecould sometimes not be correctly freed. #20693webContents.printToPDF()multiple times. #20810BrowserViews. #20846remotemodule. #20715remotemodule is used in sub-frames (<iframe>or scriptable popup). #20814Other Changes
Documentation
v7.0.0Compare Source
Release Notes for v7.0.0
Notable Changes
ipcRenderer.invoke()andipcMain.handle()for asynchronous request/response-style IPC. These are strongly recommended over theremotemodule. See this "Electron’s ‘remote’ module considered harmful" blog post for more information. #18449nativeThemeAPI to read and respond to changes in the OS's theme and color scheme. #19758, #20486Breaking Changes
More information about these and future changes can be found on project's Planned Breaking Changes page.
Tray.setHighlightMode()(macOS). #18981app.enableMixedSandbox()#17894app.getApplicationMenu(),app.setApplicationMenu(),powerMonitor.querySystemIdleState(),powerMonitor.querySystemIdleTime(),webFrame.setIsolatedWorldContentSecurityPolicy(),webFrame.setIsolatedWorldHumanReadableName(),webFrame.setIsolatedWorldSecurityOrigin()#18159Session.clearAuthCache()no longer allows filtering the cleared cache entries. #17970electronmodule to use@electron/get. The minimum supported node version is now Node 8. #18413electron.asarfile no longer exists. Any packaging scripts that depend on its existence should be updated. #18577New Features
netLog.startLogging()now returns a promise which resolves when the net log has started recording.webContents/<webview>methods now return aPromise. #18792always-on-top-changedevent emission for macOS. #19462app.resignCurrentActivity()to allows marking inactive the current Handoff user activity without invalidating it. #18659captureModeandmaxFileSizeoptions to the netLog API. #19215creationTime/sandboxed/integrityLeveltoapp.getAppMetrics()output. #18718failureReasonparameter to thewebContents.print()callback function to distinguish between success, failure, and cancellation. #19000getBounds()method for BrowserView. #19370gpu-info-updateevent toapp, which is emitted whenever there is a GPU info update. #18250memorytoapp.getAppMetrics(). #18831process.getBlinkMemoryInfo(). #17762removeInsertedCSS()towebFrame/webContents/<webview>. #16579zoom-changedevent towebContents, which is emitted when the user zooms using the mouse wheel on Windows, even if the focus is inside an (x-origin) iframe. #17747Trayfrom custom to native view to be compatible with Catalina (macOS). #18981MenuItem.toolTipproperty macOS. #19099app.moveToApplicationsFolder. #18916ELECTRON_DEFAULT_ERROR_MODEin the GPU process. #17728origininwebFrame.insertCSS(). #19268mouse-moveevent of Tray API on Windows. #19265systemPreferences.isDarkMode()API on Windows. #19217systemPreferences.isHighContrastColorScheme()API on macOS. #19331BrowserWindowfor macOS. #19294BrowserWindowenablesnodeIntegrationInSubFrames. #18650ELECTRON_SKIP_BINARY_DOWNLOAD=1environment variable to skip electron binary download. #17627netLog.currentlyLoggingPath. #18289Properties
webContentsprimitive getters and setters to actual properties. #18998badgeCountto an actual property on theappmodule. #17363app.nameis now a property. #17701nativeImage.templateImageis now a property on thenativeImageprototype. #18124appLevelAppearanceto be a property onsystemPreferences. #18477autoHideMenuBarto a property onBrowserWindowinstances. #18555savePathaccessor to a property on DownloadItem instances. #18677closable,fullscreenable,maximizable,minimizable,movable, andresizableto be properties on theBrowserWindowprototype. #18618Fixes
ELECTRON_RUN_AS_NODEnow correctly parses both node options and v8 flags. E.g.--expose_gc#19403triggeredByAcceleratorEvent property behavior forMenuItems. #18865window.print(). #19728deviceNamenot working. #19668closeevent would not emit upon closing modal window on macOS. #19014addExtraParameter/removeExtraParametermethodsundefinedin macOS node child processes. #15790srcon<webview>being too slow. #18990document.visibilityStatewould be incorrect. Thewin.show()andwin.hide()methods now correctly update visibility state. #20134webkitdirectoryattribute oninput[type=file]elements. #18343process,Buffer, etc.) are no longer removed from the global scope if you havecontextIsolationenabled as it is safe for those variables to still exist in their isolated world. #18967getPath('logs')now throws a more descriptive error if it fails to find the logs path. #19514web-contents-createdandbrowser-window-createdno longer emit an empty object in place of Event. #19465netLog.startLogging()would silently fail when called immediately duringapp.on('ready').Documentation
End of Support for 4.x.y
Electron 4.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.
v6.1.12Compare Source
Release Notes for v6.1.12
Other Changes
v6.1.11Compare Source
Release Notes for v6.1.11
Fixes
Promise.thencontext usage in V8v6.1.10Compare Source
Release Notes for v6.1.10
Fixes
1065094. #23060Other Changes
1023810). #22870v6.1.9Compare Source
Release Notes for v6.1.9
Fixes
v6.1.8Compare Source
Release Notes for v6.1.8
Fixes
BrowserWindow.setFocusable(true)not working on Windows. #21856nativeWindowOpen: falseand an unsandboxed parent window. Also fixeddocument.visibilityStatenot working in sandboxed<webview>. #21697window.print()only worked once on a singleBrowserWindow. #21913Other Changes
crashReporterto throw an error forgetLastCrashReportifcrashReporternot started. #21684v6.1.7Compare Source
Release Notes for v6.1.7
Fixes
v6.1.6Compare Source
Release Notes for v6.1.6
Fixes
webContents.setBackgroundThrottling. #21359Other Changes
v6.1.5Compare Source
Release Notes for v6.1.5
Fixes
<webview>.capturePage()resolving with an empty object instead ofNativeImageinstance. #21105backgroundThrottling: falsenot having an effect. #21014globalShortcut.registerAll()on Windows and Linux. #20982v6.1.4Compare Source
Release Notes for v6.1.4
Fixes
v6.1.3Compare Source
Release Notes for v6.1.3
Fixes
menu.popup(). #20786webContents.printToPDF()multiple times. #20811BrowserViews. #20834remotemodule. #20716remotemodule is used in sub-frames (<iframe>or scriptable popup). #20815v6.1.2Compare Source
Release Notes for v6.1.2
Fixes
v6.1.1Compare Source
Release Notes for v6.1.1
Fixes
nativeWindowOpenchild window. #20547remotecould sometimes not be correctly freed. #20694v6.1.0Compare Source
Release Notes for v6.1.0
This release is a minor bump as it contains exactly one new feature.
contextBridgemodule, this feature is outlined below along with the other fixes and changes that went into this release. The6.1.xseries is now only release line in the6.x.ymajor release line that will receive bug fixes and security fixes. It is recommended you upgrade to6.1.x.Features
contextBridgemodule to make it easier to communicate between an isolated context and the main world. #20639Fixes
Other Changes
3ca62d9v6.0.12Compare Source
Release Notes for v6.0.12
Features
Fixes
worker_threadsinELECTRON_RUN_AS_NODE. #20457recentDocumentsMenuItem role on macOS. [#20409Renovate configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.