Repository navigation
🤖 fix: bump Electron to 44.10.0 for CVE-2026-111497 - #7684
Merged
Merged
Conversation
Electron 44.9.3 still bundles Node 24.22.0 (affected by CVE-2026-111497). This commit only exercises the 44.5.1 -> 44.9.x Chromium/Electron delta in CI while the 44.x release with Node 24.22.1 is pending. bun add --optional electron@44.9.3 --minimum-release-age=0 (the bunfig 7-day floor otherwise keeps electron@44.5.1 in bun.lock while writing the new spec, and exits 0).
…de2shell # Conflicts: # bun.lock # bunfig.toml # package.json
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
🟢 e2e stories (Haiku): 14 passed22 agent steps · 7 replayed from cache · 15 model calls · 46.2k tokens (24% cached) All 14 tests in 9 files
e2e 0.20.0 · 1m 17s · web · run artifacts 🟢 e2e Electron stories (Haiku): 3 passed3 agent steps · 3 model calls · 7.9k tokens (22% cached) All 3 tests in 3 files
e2e 0.20.0 · 22.4s · electron · run artifacts 🟢 e2e agent repros (Haiku): no tests selectedSpend: $0.00 of the $1.00 cap (proxy ledger) e2e 0.20.0 · 6.9s · 2 targets (web, phone) · run artifacts |
Merged
yermakoffivan
pushed a commit
to yermakoffivan/mux
that referenced
this pull request
Oct 27, 2026
## Summary Version bump for the v0.32.1 release. It ships the Electron 44.10.0 bump (coder#7684), whose bundled Node 24.22.1 has the Brotli decoder fix for CVE-2026-111497 ("Node2Shell"), and the guard for `xum run` and `xum workflow` (coder#7383). It also carries every change on main since v0.32.0. The GitHub Release notes will list the highlights. ## Implementation Bumped with `node ./scripts/set-package-version.js 0.32.1`, so the root `package.json` and the legacy `packages/mux-compat` forwarding package stay version-locked. A stable npm publish uses the `package.json` version as-is. `src/common/compat/productIdentity.test.ts` passes locally. After this PR merges, the GitHub Release `v0.32.1` will be published on the squash commit. That starts the desktop, Docker (`latest`), VS Code and npm (`latest`) pipelines.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the desktop app's Electron from 44.9.0 to 44.10.0, the first stable 44.x release whose bundled Node (24.22.1) has the Brotli decoder fix for CVE-2026-111497 ("Node2Shell"). Fixes #7358.
Background
#7359 made the API server refuse compressed request bodies, which closed the inbound path. For outbound requests, v0.32.0 added a guard (#7374, extended to
xum runandxum workflowby #7383) that refusesContent-Encoding: brresponses when the running Node lacks the fix. The guard cannot reach two clients that decode responses on their own: Vertex ADC through gaxios and node-fetch, and AI SDK URL downloads through provider-utils' nested undici. Electron 44.9.0 bundles Node 24.22.0, which is still affected, so the Electron version is the real control for the desktop app.On Node 24.22.1,
isBrotliResponseGuardNeeded()returns false. The guard turns itself off, and the desktop app decodes Brotli again with the fixed decoder, in every client including those two.Implementation
electron(inoptionalDependencies) moves from^44.9.0to^44.10.0. The release is younger than the 7-dayminimumReleaseAgefloor, sobunfig.tomladdselectrontominimumReleaseAgeExcludes, the route AGENTS.md gives for a security fix. Without it, bun 1.4.3 writes the new spec but keeps the old version inbun.lockand exits 0. Follow-up: remove the entry after 2026-11-03, when 44.10.0 is a week old.npm view electron@44.10.0 dist.integrity.robotjs,@lydell/node-pty;npmRebuild: false) do not change.Validation
ELECTRON_RUN_AS_NODE=1 node_modules/.bin/electron -p process.versionsreports Node 24.22.1, Electron 44.10.0 and Chrome 152.0.7977.169.fetch, the npm registry client and thexum runcore services decode abrresponse, and no proxy agent is composed with the guard. On Node 22.19.0, which is still affected, the same checks refuse the response.make static-check, andxvfb-run make test-e2eonwindowLifecycle.spec.ts(2 passed).Risks
Low. This is a minor release inside the 44 line (Chromium 152.0.7977.167 to 152.0.7977.169). Its one feature adds filter options to
session.registerPreloadScript, which Xum does not call. Windows packaging runs in the merge queue (Build / Windows) and in the release workflow.The Nix package does not use the npm binary. It runs nixpkgs'
electron_44, which is 44.3.0 (Node 24.20.0) in the pinnedflake.lockand 44.9.3 (Node 24.22.0) on nixos-unstable today. Nix builds keep the guard until their nixpkgs ships 44.10.0. A follow-up bumpsflake.lockthen.