Update dependency electron to v43.7.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
electron	43.2.0 → 43.7.0

---

Release Notes

electron/electron (electron)

v43.7.0: electron v43.7.0

Compare Source

Release Notes for v43.7.0

Features

• Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #​53704 ^{(Also in 44, 45)}
• Added the ELECTRON_DEBUG_DRAGGABLE_REGIONS environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. #​53633 ^{(Also in 44, 45)}

Fixes

• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #​53694 ^{(Also in 42, 44, 45)}
• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #​53689 ^{(Also in 42, 44, 45)}
• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #​53496 ^{(Also in 42, 44, 45)}
• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #​53510 ^{(Also in 42, 44, 45)}
• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #​53584 ^{(Also in 42, 44, 45)}
• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #​53540 ^{(Also in 42, 44, 45)}
• Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #​53750 ^{(Also in 44, 45)}
• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #​53671 ^{(Also in 42, 44, 45)}
• Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. #​53631 ^{(Also in 44, 45)}
• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #​53726 ^{(Also in 42, 44, 45)}
• <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #​53718 ^{(Also in 42, 44, 45)}
• getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #​53707 ^{(Also in 42, 44, 45)}
• nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #​53712 ^{(Also in 42, 44, 45)}
• openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #​53698 ^{(Also in 42, 44, 45)}
• pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #​53701 ^{(Also in 42, 44, 45)}

Other Changes

• Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. #​53766
• Fixed a renderer crash that could occur when printing from an iframe. #​53761 ^{(Also in 44, 45)}
• Fixed the app becoming unresponsive when a page has a very large number of app-region draggable elements. #​53632 ^{(Also in 44, 45)}
• Updated Node.js to v24.21.0. #​53777

v43.6.0: electron v43.6.0

Compare Source

Release Notes for v43.6.0

Features

• Added a badge property to MenuItem on macOS 14+ for showing a count or custom text badge next to a menu item's label. #​53045 ^{(Also in 44)}
• Added webContents.caretBrowsingEnabled for toggling caret browsing in a WebContents. #​53034 ^{(Also in 44)}

Fixes

• Fixed VoiceOver Braille displays showing the wrong line in multi-line text fields on macOS: AXLineForIndex and AXRangeForLine now return the line containing the caret. #​53428
• Fixed a pending read on a net.request chunked upload stream inside a protocol handler never settling when the request failed or was aborted. #​53374 ^{(Also in 44, 45)}
• Fixed a potential crash when using menu.popup with a frame from an offscreen rendered window. #​53432 ^{(Also in 44)}
• Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. #​53456 ^{(Also in 44, 45)}
• Fixed application crash after a large number of IPC messages from renderers. #​53420 ^{(Also in 42, 44, 45)}
• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #​53393 ^{(Also in 42, 44, 45)}

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Skia and V8. #​53485
• Backported fixes from upstream Chromium, Dawn and V8. #​53396
• Updated Node.js to v24.20.0. #​53249

v43.5.1: electron v43.5.1

Compare Source

Release Notes for v43.5.1

Fixes

• Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get. #​53356 ^{(Also in 42, 44, 45)}
• Fixed a renderer crash when an array with a throwing property getter is passed across contextBridge, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps. #​53330 ^{(Also in 42, 44)}
• Fixed an intermittent crash at startup on Linux caused by a race between Pango and the main thread initializing fontconfig. #​53339 ^{(Also in 44, 45)}
• Fixed an issue where an exception thrown by a property getter on an object passed through contextBridge was swallowed instead of being thrown back to the caller. #​53334 ^{(Also in 44, 45)}
• Fixed main process crashes when navigating to http://accessibility/ or http://devtools/, when an extension background page used navigator.mediaDevices, and when calling SerialPort.forget() for a disconnected device. #​53332 ^{(Also in 44, 45)}
• Fixed the PDF viewer failing to save an edited PDF with NotAllowedError: Third party iframes are not allowed to show a file picker. #​53327 ^{(Also in 44, 45)}
• Fixed xdg-desktop-portal misidentifying Electron apps whose desktopName contains dashes, which broke globalShortcut and other portal-based APIs on Linux. #​52722

v43.5.0: electron v43.5.0

Compare Source

Release Notes for v43.5.0

Fixes

• Fixed DevTools device metrics overrides persisting indefinitely when a remote debugging client disconnected without clearing them. #​52946 ^{(Also in 42, 44)}
• Fixed BrowserWindow.unmaximize() and restore() having no effect on Wayland when the window was maximized immediately after creation. #​53125 ^{(Also in 42, 44)}
• Fixed Uncaught illegal access errors and possible renderer crashes after closing a same-process child window or removing an iframe with nodeIntegrationInSubFrames enabled. #​53041 ^{(Also in 42, 44)}
• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #​53319 ^{(Also in 42, 44, 45)}
• Fixed webContents.executeJavaScriptInIsolatedWorld resolving with undefined when worldId was not an integer. #​53237 ^{(Also in 44)}
• Fixed webContents.print() honoring printBackground, duplexMode, and printer default duplex settings. #​53160 ^{(Also in 42, 44)}
• Fixed a crash on Linux when the D-Bus session bus disconnected while the app was running, such as at logout or when dbus is restarted. #​53095 ^{(Also in 42, 44)}
• Fixed a crash on Windows when V8 posted a delayed worker task during shutdown. #​53013 ^{(Also in 42, 44)}
• Fixed a crash on macOS when a WebAuthn Touch ID prompt was requested while no locale resources were loaded. #​53195 ^{(Also in 44)}
• Fixed a crash on macOS when a notification's icon could not be attached; the notification is now shown without the icon. #​53147 ^{(Also in 42, 44)}
• Fixed a crash when calling node:wasi functions in optimized code. #​53265 ^{(Also in 42, 44, 45)}
• Fixed a crash when calling utilityProcess.postMessage() after the utility process had exited. #​53301 ^{(Also in 44, 45)}
• Fixed a regression where a window created with a custom title can show an empty title after using back/forward navigation. #​53219 ^{(Also in 42, 44)}
• Fixed a renderer crash when a page calls SpeechRecognition.available() or SpeechRecognition.install() with processLocally. #​53015 ^{(Also in 42, 44)}
• Fixed an issue where pages loaded in a detached WebContentsView wouldn't see the correct window size. #​53152 ^{(Also in 42, 44)}
• Fixed crashes in sharedTexture, service-worker ipcRenderer and utilityProcess.fork() caused by object lifetime bugs. #​53278 ^{(Also in 44, 45)}
• Fixed crashes in the main process when a webRequest.onBeforeRequest listener redirected a CORS preflight request, and when calling net.fetch() with a webRequest-permission extension loaded. #​53304 ^{(Also in 44, 45)}
• Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it. #​53288 ^{(Also in 44, 45)}
• Fixed crashes when certain app event handlers call back into Electron synchronously. #​53276 ^{(Also in 44, 45)}
• Fixed document title updates when using back/forward navigation using the same document without utilizing browserWindow.setTitle(). #​53023 ^{(Also in 42, 44)}
• Fixed region-qualified --lang values such as de-DE loading no locale resources on macOS, which left localized strings empty and could crash WebAuthn Touch ID prompts. #​53186 ^{(Also in 42, 44)}
• Fixed spellcheck not initializing on Linux when the dictionary was already cached from a previous run. #​52717 ^{(Also in 44)}
• Fixed the GPU process being terminated in AppX/MSIX packaged apps on Windows when WebGPU fell back to SwiftShader. #​53197 ^{(Also in 42, 44)}
• Fixed the primary instance being killed or receiving truncated arguments when a second instance passed a very long command line or large additionalData to app.requestSingleInstanceLock(). #​53156 ^{(Also in 42, 44)}
• Fixed the tray icon not appearing on GNOME (and disappearing entirely on Wayland) since 43.4.1. #​53215
• Fixed utility process crashes at exit on Windows 11 24H2 and later. #​53092 ^{(Also in 42, 44)}
• Fixed windows native message boxes being dismissed by other applications using invalid button ID. #​53155 ^{(Also in 44)}

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, Skia and V8. #​52969
• Backported fixes from upstream ANGLE, Chromium, Dawn, V8 and WebRTC. #​53190
• Backported fixes from upstream Chromium and V8. #​53055
• Fixed a 1-in-200 chance per renderer process on Windows of scripts on the first page load being compiled without their V8 code cache. #​52943 ^{(Also in 42, 44)}
• Fixed a stall of tens of milliseconds while creating the first BrowserWindow on Linux.
  • Improved the performance of file lookups inside ASAR archives and of large files served from them to the renderer.
  • Improved the performance of calls through contextBridge-exposed APIs.
  • Reduced the main-thread cost of sending large values through ipcRenderer, ipcMain handlers and webContents.send. #​53018 ^{(Also in 42, 44)}
• Improved application startup time on Linux by skipping GDK's OpenGL probe and loading FontConfig off the main thread during toolkit initialization. #​53108 ^{(Also in 44)}
• Improved startup time of utilityProcess.fork(), child_process.fork() / ELECTRON_RUN_AS_NODE child processes and Node.js-enabled renderers. #​53135 ^{(Also in 42, 44)}
• Linux arm64, Windows arm64 and macOS x64 builds now start the main process from the embedded Node.js startup snapshot like the other platforms, improving startup time. #​52881 ^{(Also in 42, 44)}
• Page resources, fetch() calls and file:// loads in renderers no longer wait for the main process to be idle when no webRequest listeners or protocol interceptors are registered. #​53142 ^{(Also in 42, 44)}
• Updated Chromium to 150.0.7871.250. #​52787
• Updated Node.js to v24.19.0. #​52635

v43.4.1: electron v43.4.1

Compare Source

Release Notes for v43.4.1

Fixes

• Fixed DevTools popup and context menus not appearing when DevTools is hosted in a custom window via webContents.setDevToolsWebContents(). #​52937 ^{(Also in 44)}
• Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle. #​52853 ^{(Also in 41, 42, 44)}
• Fixed a WebContentsView staying blank after its window is shown when setBackgroundThrottling(false) was called while the window was hidden. #​52864 ^{(Also in 42, 44)}
• Fixed a crash in systemPreferences.promptTouchID(reason) when an invalid reason value is passed. #​52782 ^{(Also in 42, 44)}
• Fixed a crash when resolving a path inside a malformed ASAR archive that contains cyclic link entries. #​52857 ^{(Also in 42, 44)}
• Fixed a crash with app.setLoginItemSettings if a non-UTF8 service name is used. #​52944 ^{(Also in 44)}
• Fixed a memory leak when creating BrowserWindows. #​52892 ^{(Also in 42, 44)}
• Fixed a possible crash (SIGABRT) during process exit when the process had loaded tls/https shortly before exiting, affecting app.exit() before ready and short-lived ELECTRON_RUN_AS_NODE / child_process.fork() scripts. #​52870 ^{(Also in 44)}
• Fixed a possible main process crash at quit when a session was created from JavaScript that runs during shutdown. #​52925 ^{(Also in 44)}
• Fixed a potential crash in contentTracing.stopRecording() when the trace file could not be written to the requested path. #​52795 ^{(Also in 42, 44)}
• Fixed a rare crash in the main process when DevTools were opened and a garbage collection ran before the DevTools frontend finished loading. #​52903 ^{(Also in 44)}
• Fixed a regression preventing from transparent frameless windows from being resized on Linux. #​52947 ^{(Also in 44)}
• Fixed an npm install failure with no recovery path when the OS blocked the native zip extractor from loading (for example, Windows Smart App Control). #​52845 ^{(Also in 44)}
• Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #​52897 ^{(Also in 41, 44)}
• Fixed crash in sharedTexture module when GPU context becomes unavailable. #​52938 ^{(Also in 44)}
• Fixed custom V8 snapshots (electron-mksnapshot, and the loadBrowserProcessSpecificV8Snapshot fuse) having no effect in the main process on macOS arm64, Linux x64 and Windows x64. #​52877 ^{(Also in 42, 44)}
• Fixed downloading files that live inside an asar archive, including saving a packed PDF from the built-in PDF viewer. #​52826 ^{(Also in 42, 44)}
• Fixed the built-in PDF viewer not rendering documents in in-memory sessions (partitions without the persist: prefix). #​52835 ^{(Also in 44)}
• Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions. #​52848 ^{(Also in 41, 42, 44)}
• <webview> and window.open now inherit nodeIntegrationInWorker from the embedder, consistent with the other Node and sandbox preferences. #​52830 ^{(Also in 41, 42, 44)}

Other Changes

• Backported fix for 5246282. #​52868
• Backported fixes for 5422242, 5420251. #​52842
• Backported fixes from upstream Chromium and V8. #​52778
• Fixed Tray icons not appearing (and their menus not opening) on Linux desktops that address the StatusNotifierItem by its unique D-Bus name or via the org.freedesktop.StatusNotifierItem interface, such as GNOME with the AppIndicator extension, Cinnamon and XFCE. #​52952
• Fixed an issue on macOS where a page's first use of speechSynthesis could block the main process for several hundred milliseconds. #​52814
• Reduced idle main-process CPU wakeups caused by Node.js timers and immediates. #​52905 ^{(Also in 44)}

v43.4.0: electron v43.4.0

Compare Source

Release Notes for v43.4.0

Features

• Added webFrameMain.printToPDF() to allow printing individual frames to PDF from the main process. #​52627 ^{(Also in 42, 44)}
• Fixed an issue where getDisplayMedia({ audio: { restrictOwnAudio: true } }) was ignored in setDisplayMediaRequestHandler, causing loopback audio to include local app playback. #​52533 ^{(Also in 44)}

Fixes

• Fixed a browser process crash that could occur during Windows logoff, shutdown, or restart. #​52620 ^{(Also in 42, 44)}
• Fixed a crash report when the X server or Wayland compositor exits while an app is running. #​52685 ^{(Also in 42, 44)}
• Fixed a crash when quickly switching menus while the app is under heavy load. #​52673 ^{(Also in 42, 44)}
• Fixed a potential crash when notifying user activation before the primary main frame was live. #​52697 ^{(Also in 42, 44)}
• Fixed an issue where a JavaScript out-of-memory crash could be reported from inside the crash-key handler instead of at the out-of-memory site. #​52725 ^{(Also in 42, 44)}
• Fixed the Linux system accent color intermittently not being applied (systemPreferences.getAccentColor() returning an empty string on some launches). #​52575

Other Changes

• Backported fixes from upstream ANGLE and Chromium. #​52709
• Backported fixes from upstream ANGLE, Chromium and V8. #​52663
• No user-facing change; semver/none. #​52732
• Updated Chromium to 150.0.7871.224. #​52693

v43.3.0: electron v43.3.0

Compare Source

Release Notes for v43.3.0

Features

• Added available to process.getSystemMemoryInfo() on Linux, exposing proc/meminfo MemAvailable. #​52379 ^{(Also in 42, 44)}

Fixes

• Fixed BrowserWindow size corruption on Windows when created with explicit x/y on a secondary monitor whose DPI differs from the primary. #​52501 ^{(Also in 42, 44)}
• Fixed Dirent.parentPath being undefined for fs.readdir, fs.readdirSync, fs.glob, and fs.globSync with withFileTypes: true inside asar archives. #​52505 ^{(Also in 42, 44)}
• Fixed dialog.showOpenDialog/dialog.showSaveDialog opening at an unusable location on Linux when defaultPath is a bare filename without a directory. #​52401 ^{(Also in 44)}
• Fixed a UAF with protocol.registerStreamProtocol when an error is emitted during a read. #​52514 ^{(Also in 41, 42, 44)}
• Fixed a crash that could occur when closing DevTools while the host WebContents was being destroyed. #​52510 ^{(Also in 41, 42, 44)}
• Fixed a graphical glitch on Linux where thin borders appeared past the drop shadows on frameless windows when multiple windows were created. #​52607 ^{(Also in 44)}
• Fixed an issue where loading ICO files from ASAR archives on Windows left temporary icon files behind. #​52478 ^{(Also in 42, 44)}
• Fixed an issue where some values passed into requestSingleInstanceLock could result in a crash. #​52471 ^{(Also in 44)}

Other Changes

• Fixed bindings for MV3 service workers. #​52503
• Improved the error message when an asar integrity check fails to name the entry that failed. #​52622 ^{(Also in 42, 44)}
• Updated Chromium to 150.0.7871.212. #​52524
• Updated Node.js to v24.18.1. #​52552

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "after 2am and before 8am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: eesast-web@2024.0.0
npm error Found: graphql@17.0.2
npm error node_modules/graphql
npm error   graphql@"17.0.2" from the root project
npm error
npm error Could not resolve dependency:
npm error peer graphql@"^15.0.0 || ^16.0.0" from @apollo/client@3.14.1
npm error node_modules/@apollo/client
npm error   @apollo/client@"3.14.1" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-14T14_19_10_553Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-14T14_19_10_553Z-debug-0.log

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request