chore(deps): update dependency electron to v26 [security] #428
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-electron-vulnerability
branch
from
4721ecb
to
bd2d2e1
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-electron-vulnerability
branch
from
bd2d2e1
to
54efcb6
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-electron-vulnerability
branch
from
54efcb6
to
a6b6d7c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~19.1.0->~26.2.0GitHub Vulnerability Alerts
CVE-2023-39956
Impact
Apps that are launched as command line executables are impacted. E.g. if your app exposes itself in the path as
myapp --helpSpecifically this issue can only be exploited if the following conditions are met:
This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. Please bear this in mind when reporting similar issues in the future.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
26.0.0-beta.1325.5.024.7.123.3.1322.3.19For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Release Notes
electron/electron (electron)
v26.2.2: electron v26.2.2Compare Source
Release Notes for v26.2.2
Fixes
BrowserViewsthat had their bounds set prior to being added to aBrowserWindowcould have unexpected incorrect offsets. #39850 (Also in 25, 27)Other Changes
1477588. #39918v26.2.1: electron v26.2.1Compare Source
Release Notes for v26.2.1
Fixes
chrome.tabsevents would throw incorrectly. #39772 (Also in 25, 27)frame: falseandroundedCorners: falsewhen going fullscreen. #39795 (Also in 25, 27)webContents.sendInputEvent(). #39821 (Also in 27)Other Changes
Electron.TitleBarOverlay. #39805 (Also in 27)v26.2.0: electron v26.2.0Release Notes for v26.2.0
Features
host_permissions,author, andshort_name. #39673 (Also in 27)webContents.downloadURL(). #39562 (Also in 25, 27)Fixes
assertmodule did not work in the renderer process. #39624 (Also in 24, 25, 27)Other Changes
v26.1.0: electron v26.1.0Release Notes for v26.1.0
Features
Fixes
BrowserWindow.moveTop()on modal child windows. #39527 (Also in 24, 25)chrome://gpufailed to load. #39584 (Also in 27)chrome.tabsTab objects were not properly considered privileged. #39607 (Also in 25, 27)Other Changes
1464682.1464680.v26.0.0: electron v26.0.0Compare Source
Release Notes for v26.0.0
Stack Upgrades
116.0.5845.6218.6.111.2Breaking Changes
webContents.getPrintersAPI has been deprecated. #39459systemPreferences.getAppLevelAppearanceandsystemPreferences.setAppLevelAppearanceAPIs have been deprecated, as well as thealternate-selected-control-textvalue forsystemPreferences.getColor. #39492Features
Additions
safeStorage.setUsePlainTextEncryptionandsafeStorage.getSelectedStorageBackendapi. #39107 (Also in 25)safeStorage.setUsePlainTextEncryptionandsafeStorage.getSelectedStorageBackendapi. #39155 (Also in 25)senderIsMainFrameto messages sent viaipcRenderer.sendTo(). #39206 (Also in 24, 25)app. #37933 (Also in 25)chrome.tabs.query. #39431 (Also in 25)cursor-changedevent. #38210 (Also in 24, 25)session.downloadURL(). #38871 (Also in 25)powerMonitor. #37935 (Also in 24, 25)webContentsmethods to center text selection, scroll to the page bottom and top, as well as adjust selected text. #37978 (Also in 25)minimum_chrome_versionmanifest key. #39357context-menuevent from extensions. #38029 (Also in 25)node:prefixed requires are now supported in sandboxed renderer preloads forevents,timersandurl. #38728 (Also in 24, 25)Improvements
contentTracing.stopRecording()fails because no trace was in progress. #38488 (Also in 23, 24, 25)Removed/Deprecated
enable_desktop_capturerbuild flag has been removed. #38412Fixes
clipboard.readImage()getting blocked when there is no PNG image in the clipboard. #39487nativeImage.resize()before the appreadyevent. #38861clipboard.readImage()when reading images copied via context menu on macOS. #39101tray.popUpContextMenuon macOS. #39313desktopCapturer.getSources()on Wayland. #39189VoiceOvercouldn't trigger the tray action when selected to emit the click event. #39439window.setKiosk(false)would exit fullscreen regardless of the fullscreen state prior to kiosk mode. #38219Also in earlier versions...
abouton Linux as well. #37828 (Also in 23, 24, 25)AXManualAccessibilityattribute works as expected in all relevant protocol methods. #38142 (Also in 23, 24, 25)desktopCapturerthumbnail generation after screen sharing is cancelled on Wayland. #39246 (Also in 25)preloadscript may not run in some child windows opened bywindow.open. #38930 (Also in 23, 24, 25)webContents.printToPDFpreferCSSPageSizetype error. #38793 (Also in 24, 25)nativeThemesource during mara context menu close. #38840 (Also in 25)BrowserWindow.removeBrowserView()with a destroyedwebContents. #38885 (Also in 24, 25)webContents.printwith invalid settings. #38165 (Also in 25)webContents.printparameter validation by adding missing options required to set printer printable area. #38721 (Also in 25)chrome://accessibility. #38179 (Also in 25)FrameViews always appeared inactive regardless of focus status. #38468 (Also in 25)<datalist>popups are positions incorrectly inBrowserViews. #38610 (Also in 23, 24, 25)BrowserWindow.isMaximized()could incorrectly return true for minimized or fullscreened windows on macOS. #38291 (Also in 23, 24, 25)BrowserWindow.isVisible()would incorrectly returntruefor minimized windows on Windows. #38242 (Also in 23, 24, 25)BrowserWindow.moveAbove()andBrowserWindow.moveTop()did not work for child windows on macOS. #39070 (Also in 24, 25)MediaStreamTrack.getCaptureHandle()always returnednull. #38390 (Also in 24, 25)browserView.removeBrowserViewcould cause a crash in some cases. #39406 (Also in 24, 25)chrome.i18ndid not work properly with Chrome Extensions Manifest V3. #39328 (Also in 24, 25)chrome.tabsdid not work properly with Chrome Extensions Manifest V3. #39360 (Also in 25)chrome.tabs.updatedid not return atabobject that properly reflected potential properties that were changed. #39389 (Also in 25)getNormalBounds()returns incorrect bounds for transparent maximized windows on Windows. #38218 (Also in 23, 24, 25)navigator.connectionreturned incorrect data. #38491 (Also in 24, 25)protocol.handle()never called its callback with the'file'scheme. #39065 (Also in 25)webContents.print()stopped triggering its callback when the user cancelled the print dialog. #38735 (Also in 25)BrowserWindow.idthrew an error after the window was destroyed. #38241 (Also in 23, 24, 25)win.minimize()directly after callingwin.maximize(), and then callingwin.isMaximized()incorrectly returnstrue. #38234 (Also in 23, 24, 25)openFilewas not passed as a dialog property. #38590 (Also in 24, 25)Showbutton visible. #39013 (Also in 24, 25)webContents.print(null)could incorrectly trigger an error. #38641 (Also in 24, 25)BrowserViewscan behave inconsistently across platforms. #39004 (Also in 25)backgroundThrottlingwas disabled. #39298 (Also in 25)webContents.print({ silent: true })not working correctly. #38812 (Also in 25)AXManualAccessibilityto enable a11y features in Electron. #38102 (Also in 23, 24, 25)node:child_processimports. #39234 (Also in 24, 25)shell.openExternal()options. #38038 (Also in 22, 23, 24, 25)node-gypversion innode.herror. #37829 (Also in 22, 23, 24, 25)chrome.tabsdid not work properly with Chrome Extensions Manifest V3. #39360 (Also in 25)Other Changes
1404797. #38323 (Also in 25)Documentation
Notices
End of Support for 23.x.y
Electron 23.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.
v25.8.2: electron v25.8.2Compare Source
Release Notes for v25.8.2
Fixes
BrowserViewsthat had their bounds set prior to being added to aBrowserWindowcould have unexpected incorrect offsets. #39851 (Also in 26, 27)chrome://gpufailed to load. #39852 (Also in 26, 27)webContents.sendInputEvent(). #39820 (Also in 26, 27)Other Changes
1477588. #39919v25.8.1: electron v25.8.1Compare Source
Release Notes for v25.8.1
Fixes
chrome.tabsevents would throw incorrectly. #39770 (Also in 26, 27)frame: falseandroundedCorners: falsewhen going fullscreen. #39794 (Also in 26, 27)Other Changes
v25.8.0: electron v25.8.0Release Notes for v25.8.0
Features
webContents.downloadURL(). #39561 (Also in 26, 27)Fixes
assertmodule did not work in the renderer process. #39622 (Also in 24, 26, 27)Other Changes
v25.7.0: electron v25.7.0Release Notes for v25.7.0
Features
Fixes
chrome.tabsTab objects were not properly considered privileged. #39609 (Also in 26, 27)Other Changes
1464682.1464680.1465224. #39517v25.6.0: electron v25.6.0Compare Source
Release Notes for v25.6.0
Features
chrome.tabs.query. #39430 (Also in 26)Fixes
BrowserWindow.moveTop()on modal child windows. #39528 (Also in 26)VoiceOvercouldn't trigger the tray action when selected to emit the click event. #39448 (Also in 26)v25.5.0: electron v25.5.0Compare Source
Release Notes for v25.5.0
Features
safeStorage.setUsePlainTextEncryptionandsafeStorage.getSelectedStorageBackendapi. #39325 (Also in 26)Fixes
browserView.removeBrowserViewcould cause a crash in some cases. #39408 (Also in 24, 26)chrome.tabs.updatedid not return atabobject that properly reflected potential properties that were changed. #39388 (Also in 26)chrome.tabsdid not work properly with Chrome Extensions Manifest V3. #39359 (Also in 26)Other Changes
v25.4.0: electron v25.4.0Compare Source
Release Notes for v25.4.0
Features
senderIsMainFrameto messages sent viaipcRenderer.sendTo(). #39208 (Also in 24, 26)Fixes
chrome.i18ndid not work properly with Chrome Extensions Manifest V3. #39329 (Also in 26)backgroundThrottlingwas disabled. #39299 (Also in 26)Other Changes
1444438.v25.3.2: electron v25.3.2Compare Source
Release Notes for v25.3.2
Fixes
desktopCapturerthumbnail generation after screen sharing is cancelled on Wayland. #39245 (Also in 26)node:child_processimports. #39235 (Also in 24, 26)Other Changes
v25.3.1: electron v25.3.1Compare Source
Release Notes for v25.3.1
Fixes
BrowserWindow.moveAbove()andBrowserWindow.moveTop()did not work for child windows on macOS. #39071 (Also in 24, 26)openFilewas not passed as a dialog property. #39096 (Also in 24, 26)webContents.print({ silent: true })not working correctly. #39095 (Also in 26)Other Changes
v25.3.0: electron v25.3.0Compare Source
Release Notes for v25.3.0
Features
session.downloadURL(). #38870 (Also in 26)Fixes
protocol.handle()never called its callback with the'file'scheme. #39064Showbutton visible. #39014 (Also in 24, 26)Unknown
BrowserViewscan behave inconsistently across platforms. #39005 (Also in 26)v25.2.0: electron v25.2.0Compare Source
Release Notes for v25.2.0
Features
node:prefixed requires are now supported in sandboxed renderer preloads forevents,timersandurl. #38729 (Also in 24, 26)Fixes
webContents.printToPDFpreferCSSPageSizetype error. #38791 (Also in 24, 26)nativeThemesource during mara context menu close. #38839 (Also in 26)webContents.print()stopped triggering its callback when the user cancelled the print dialog. #38814 (Also in 26)Other Change