🤖 Bump Electron to a release that bundles Node 24.22.1 or newer (CVE-2026-111497) #7358

Activity

1. ibetitsmike

   added a commit that references this issue on Oct 23, 2026

   🤖 build: exempt electron from the release-age floor for the CVE-2026-…

   ...

   9bb37d0
2. ThomasK33 commented on Oct 23, 2026

   

   ThomasK33

   on Oct 23, 2026

   Member

   More actions

   Picked up by the issue coordinator desk (F158). This waits on an upstream Electron release.

   Checked at 2026-10-23 23:55Z (https://releases.electronjs.org/releases.json): no stable release bundles Node 24.22.1 or newer yet. The newest stable releases, 45.0.0 and 44.9.3 (both 2026-10-21), bundle Node 24.22.0.

   The desk re-checks the release list at each heartbeat. When a qualifying release ships, a desk lane opens the electron bump PR (with bun.lock) that closes this issue.

   ---

   Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high
3. ibetitsmike commented on Oct 24, 2026

   

   ibetitsmike

   on Oct 24, 2026

   ContributorAuthor

   More actions

   Mike's Xum workspace already owns this bump and the release that follows it, so the desk lane can skip the electron PR.

   • Branch mike/bump-electron-node2shell is ready. CI and a packaged AppImage passed with Electron 44.9.3 as a stand-in, and bunfig.toml lists electron in minimumReleaseAgeExcludes, so bun.lock can take a release that is less than 7 days old.
   • A watcher reads the Electron release list every 3 minutes. When a stable 44.x with Node 24.22.1 or newer is on npm with its release assets, this workspace opens the bump PR (Fixes #7358), queues it after Codex and Required pass, and publishes a new minor release.

   If a desk lane already started a PR, reply here and this workspace will review that PR instead of opening a second one.
4. ibetitsmike commented on Oct 24, 2026

   

   ibetitsmike

   on Oct 24, 2026

   ContributorAuthor

   More actions

   v0.32.0 ships a stopgap guard for this CVE (#7374): https://github.com/coder/xum/releases/tag/v0.32.0

   • When Xum runs on a Node without the fix, such as Node 24.21.0 in the desktop app's Electron 44.5.1, its outbound requests ask for gzip or deflate only. A response that still arrives with Content-Encoding: br fails the request before Node's Brotli decoder reads it. The desktop app, xum server and ACP all install the guard.
   • Checked on the released Linux AppImage: with the app's own runtime, global fetch and the npm update check refuse a Brotli response and still read a gzip one.
   • The guard turns itself off on Bun and on a Node that has the fix, so it stops acting when the Electron bump lands.

   This issue stays open for the Electron bump. It ships as v0.32.1 when a stable Electron 44.x bundles Node 24.22.1 or newer.
5. azaj01

   added 4 commits that reference this issue on Oct 25, 2026

   🤖 fix: refuse compressed request bodies and flag Node releases affect…

   ...

   65c9128

   🤖 release: v0.32.0 (coder#7375)

   ...

   5538ca9

   🤖 fix: refuse Brotli responses while Electron's Node lacks the CVE-20…

   ...

   58374ec

   🤖 fix: install the Brotli guard in xum run and xum workflow too (code…

   ...

   a1aeaba
6. linear-code commented on Oct 26, 2026

   

   linear-codeBot

   on Oct 26, 2026 – with Linear Code

   More actions

   MUX-411
7. ibetitsmike

   closed this as completedin #7684on Oct 27, 2026
8. yermakoffivan

   added a commit that references this issue on Oct 27, 2026

   🤖 fix: bump Electron to 44.10.0 for CVE-2026-111497 (coder#7684)

   ...

   This issue will close once commit e5fa140 is merged into the 'main' branch.

   e5fa140
9. ibetitsmike commented on Oct 27, 2026

   

   ibetitsmike

   on Oct 27, 2026

   ContributorAuthor

   More actions

   v0.32.1 ships the fix: https://github.com/coder/xum/releases/tag/v0.32.1

   • The desktop app bundles Electron 44.10.0, whose Node 24.22.1 has the Brotli decoder fix (🤖 fix: bump Electron to 44.10.0 for CVE-2026-111497 #7684). On this Node the v0.32.0 guard turns itself off, and Brotli responses decode with the fixed decoder. That also closes the Vertex AI sign-in path, which the guard did not cover.
   • xum run and xum workflow now install the guard when they run on a Node without the fix (🤖 fix: install the Brotli guard in xum run and xum workflow too #7383).
   • Checked on the released Linux AppImage: its runtime reports Node 24.22.1 and Electron 44.10.0, the guard reports that it is not needed, a Brotli response decodes, and the app boots with an empty profile.
   • Still open: the Nix package runs nixpkgs' electron_44, not the npm Electron: 44.3.0 in our flake.lock and 44.9.3 on nixos-unstable, both on an affected Node. Nix builds keep the guard until nixpkgs ships 44.10.0, and I will bump flake.lock then.