From a5f133cd16d7dd2a0554d9f725fe8670185bf098 Mon Sep 17 00:00:00 2001 From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:02:44 +0000 Subject: [PATCH 1/3] =?UTF-8?q?=F0=9F=A4=96=20build:=20pin=20Electron=2044?= =?UTF-8?q?.9.3=20to=20pre-validate=20the=2044.x=20line=20for=20#7358?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Electron 44.9.3 still bundles Node 24.22.0 (affected by CVE-2026-111497). This commit only exercises the 44.5.1 -> 44.9.x Chromium/Electron delta in CI while the 44.x release with Node 24.22.1 is pending. bun add --optional electron@44.9.3 --minimum-release-age=0 (the bunfig 7-day floor otherwise keeps electron@44.5.1 in bun.lock while writing the new spec, and exits 0). --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index 8de89c26a4f..fb02beec75e 100644 --- a/bun.lock +++ b/bun.lock @@ -216,7 +216,7 @@ "vite-plugin-top-level-await": "^1.6.0", }, "optionalDependencies": { - "electron": "^44.5.1", + "electron": "44.9.3", "robotjs": "^0.9.1", }, }, @@ -2254,7 +2254,7 @@ "ejs": ["ejs@3.1.10", "", { "dependencies": { "jake": "^10.8.5" }, "bin": { "ejs": "bin/cli.js" } }, "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA=="], - "electron": ["electron@44.5.1", "", { "dependencies": { "@electron-internal/extract-zip": "^1.0.1", "@electron/get": "^5.0.0", "@types/node": "^24.9.0" }, "bin": { "electron": "cli.js", "install-electron": "install.js" } }, "sha512-lx7AYoFIiyvEvgvpyWO9kOC60xtNPpiPZAth6Fmg9NutzpCAMLwpUlaBY2EXfZyIgUdzEmLMj9KvK0Vrokl1yQ=="], + "electron": ["electron@44.9.3", "", { "dependencies": { "@electron-internal/extract-zip": "^1.0.1", "@electron/get": "^5.0.0", "@types/node": "^24.9.0" }, "bin": { "electron": "cli.js", "install-electron": "install.js" } }, "sha512-Cv9/yMnZxNWsMlIe8T4v//NKHdUvbeyoTJoXE3BIcRxus2meeFaO9h/P3zB5d4cBXum51IgAYrT2QjpIDWKpJA=="], "electron-builder": ["electron-builder@24.13.3", "", { "dependencies": { "app-builder-lib": "24.13.3", "builder-util": "24.13.1", "builder-util-runtime": "9.2.4", "chalk": "^4.1.2", "dmg-builder": "24.13.3", "fs-extra": "^10.1.0", "is-ci": "^3.0.0", "lazy-val": "^1.0.5", "read-config-file": "6.3.2", "simple-update-notifier": "2.0.0", "yargs": "^17.6.2" }, "bin": { "electron-builder": "cli.js", "install-app-deps": "install-app-deps.js" } }, "sha512-yZSgVHft5dNVlo31qmJAe4BVKQfFdwpRw7sFp1iQglDRCDD6r22zfRJuZlhtB5gp9FHUxCMEoWGq10SkCnMAIg=="], diff --git a/package.json b/package.json index 5d6ce22e9b2..224ac3713ae 100644 --- a/package.json +++ b/package.json @@ -261,7 +261,7 @@ "vite-plugin-top-level-await": "^1.6.0" }, "optionalDependencies": { - "electron": "^44.5.1", + "electron": "44.9.3", "robotjs": "^0.9.1" }, "files": [ From 9bb37d07448b3f7b020fe346acf003ecabdfc13f Mon Sep 17 00:00:00 2001 From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:21:35 +0000 Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=A4=96=20build:=20exempt=20electron?= =?UTF-8?q?=20from=20the=20release-age=20floor=20for=20the=20CVE-2026-1114?= =?UTF-8?q?97=20fix=20(#7358)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bunfig.toml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bunfig.toml b/bunfig.toml index 8f4043be4f4..bc17bef7345 100644 --- a/bunfig.toml +++ b/bunfig.toml @@ -8,3 +8,5 @@ preload = ["./tests/setup.ts"] # (#7227). Installs from bun.lock (--frozen-lockfile) are unaffected. To take a newer release on # purpose (an urgent fix), list the package in minimumReleaseAgeExcludes. minimumReleaseAge = 604800 +# electron: the CVE-2026-111497 fix (#7358). Remove once that release is a week old. +minimumReleaseAgeExcludes = ["electron"] From 2aa969c2028b3c26dd9374554d60043bb1a45eaf Mon Sep 17 00:00:00 2001 From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com> Date: Tue, 27 Oct 2026 18:09:49 +0000 Subject: [PATCH 3/3] =?UTF-8?q?=F0=9F=A4=96=20fix:=20bump=20Electron=20to?= =?UTF-8?q?=2044.10.0=20(Node=2024.22.1,=20CVE-2026-111497)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index f0a4f9147b3..9dbd7895ccc 100644 --- a/bun.lock +++ b/bun.lock @@ -216,7 +216,7 @@ "vite-plugin-top-level-await": "^1.6.0", }, "optionalDependencies": { - "electron": "^44.9.0", + "electron": "^44.10.0", "robotjs": "^0.9.1", }, }, @@ -2209,7 +2209,7 @@ "ejs": ["ejs@3.1.10", "", { "dependencies": { "jake": "^10.8.5" }, "bin": { "ejs": "bin/cli.js" } }, "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA=="], - "electron": ["electron@44.9.0", "", { "dependencies": { "@electron-internal/extract-zip": "^1.0.1", "@electron/get": "^5.0.0", "@types/node": "^24.9.0" }, "bin": { "electron": "cli.js", "install-electron": "install.js" } }, "sha512-boP8zA5OIoMGYe3uWP4IqB1VJNoEzdHYgcBaVYnd1DBv5TogwXkbM4yJGSfNmYCzalVQ5J3TAIbaKOY+ILTnyg=="], + "electron": ["electron@44.10.0", "", { "dependencies": { "@electron-internal/extract-zip": "^1.0.1", "@electron/get": "^5.0.0", "@types/node": "^24.9.0" }, "bin": { "electron": "cli.js", "install-electron": "install.js" } }, "sha512-ss4pCfrQKV4TWkuVYtWB4HmeysPZgB96cSYNKYZv1UVCRP4vQMGNW5oopFbvx6Bbfce1XtP5pm5RDuKehp0svQ=="], "electron-builder": ["electron-builder@24.13.3", "", { "dependencies": { "app-builder-lib": "24.13.3", "builder-util": "24.13.1", "builder-util-runtime": "9.2.4", "chalk": "^4.1.2", "dmg-builder": "24.13.3", "fs-extra": "^10.1.0", "is-ci": "^3.0.0", "lazy-val": "^1.0.5", "read-config-file": "6.3.2", "simple-update-notifier": "2.0.0", "yargs": "^17.6.2" }, "bin": { "electron-builder": "cli.js", "install-app-deps": "install-app-deps.js" } }, "sha512-yZSgVHft5dNVlo31qmJAe4BVKQfFdwpRw7sFp1iQglDRCDD6r22zfRJuZlhtB5gp9FHUxCMEoWGq10SkCnMAIg=="], diff --git a/package.json b/package.json index 31c2fe8c017..863d19e9823 100644 --- a/package.json +++ b/package.json @@ -261,7 +261,7 @@ "vite-plugin-top-level-await": "^1.6.0" }, "optionalDependencies": { - "electron": "^44.9.0", + "electron": "^44.10.0", "robotjs": "^0.9.1" }, "files": [