Skip to content

chore(deps): bump the electron group across 1 directory with 5 updates - #6557

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/electron-eaecbbbe97
Open

chore(deps): bump the electron group across 1 directory with 5 updates#6557
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/electron-eaecbbbe97

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the electron group with 5 updates in the / directory:

Package From To
electron-updater 6.8.9 6.8.11
node-abi 4.35.0 4.39.0
@electron/rebuild 4.2.0 4.2.1
electron 43.7.1 43.8.3
electron-builder 26.16.1 26.18.0

Updates electron-updater from 6.8.9 to 6.8.11

Release notes

Sourced from electron-updater's releases.

electron-updater@6.8.11

Patch Changes

electron-updater@6.8.10

Patch Changes

  • Fix: make multi-range differential downloads work on real servers. Three independent defects made downloadUpdate fall back to a full download with Response ends without calling any handlers: [#10219](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10219) 7dd7f8a @​claude

    • DataSplitter only recognised CRLF. Some CDNs answer multipart/byteranges with bare LF line endings, so no part was ever split and the whole response accumulated in memory. Header lists now end at whichever of \r\n\r\n / \n\n comes first, and the <EOL>--boundary separator size follows the line ending the server actually uses.
    • A header-list terminator split across two chunks was never found: only the new chunk was searched, the buffered bytes never were, so the parser locked onto the next part's header instead. Only the last few bytes of an unfinished header list are now carried over and searched together with the next chunk, instead of accumulating the whole list.
    • The 10s watchdog armed when a batch response ends was never disarmed after that batch succeeded. With more than 1000 operations (several range requests) it failed the whole download whenever a later batch took longer than the grace period.

  • Fix: keep the cached blockmap consistent with the cached installer. A download round that did not produce a new blockmap (e.g. the differential download was skipped because the cached installer was evicted) now removes the cached current.blockmap instead of leaving a stale one next to the freshly cached file, which poisoned the next differential download and surfaced as a generic sha512 checksum mismatch before falling back to a full download (#10097). Leftover pending blockmaps from previous update rounds are also cleared before a fresh download. sha512-mismatch logging now distinguishes a differential download that failed against stale/corrupt cached inputs (including whether the old blockmap came from the local cache or the server) from a genuine checksum failure of a fully downloaded file. [#10163](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10163) 1dfe1a9 @​claude

Changelog

Sourced from electron-updater's changelog.

6.8.11

Patch Changes

6.8.10

Patch Changes

  • Fix: make multi-range differential downloads work on real servers. Three independent defects made downloadUpdate fall back to a full download with Response ends without calling any handlers: [#10219](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10219) 7dd7f8a @​claude

    • DataSplitter only recognised CRLF. Some CDNs answer multipart/byteranges with bare LF line endings, so no part was ever split and the whole response accumulated in memory. Header lists now end at whichever of \r\n\r\n / \n\n comes first, and the <EOL>--boundary separator size follows the line ending the server actually uses.
    • A header-list terminator split across two chunks was never found: only the new chunk was searched, the buffered bytes never were, so the parser locked onto the next part's header instead. Only the last few bytes of an unfinished header list are now carried over and searched together with the next chunk, instead of accumulating the whole list.
    • The 10s watchdog armed when a batch response ends was never disarmed after that batch succeeded. With more than 1000 operations (several range requests) it failed the whole download whenever a later batch took longer than the grace period.

  • Fix: keep the cached blockmap consistent with the cached installer. A download round that did not produce a new blockmap (e.g. the differential download was skipped because the cached installer was evicted) now removes the cached current.blockmap instead of leaving a stale one next to the freshly cached file, which poisoned the next differential download and surfaced as a generic sha512 checksum mismatch before falling back to a full download (#10097). Leftover pending blockmaps from previous update rounds are also cleared before a fresh download. sha512-mismatch logging now distinguishes a differential download that failed against stale/corrupt cached inputs (including whether the old blockmap came from the local cache or the server) from a genuine checksum failure of a fully downloaded file. [#10163](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10163) 1dfe1a9 @​claude

Commits
  • e2a8604 chore(deploy): Release v26.18.0 (electron-updater@6.8.11) (v26) (#10250)
  • e5e3b41 fix(updater): validate cached update filenames (v26 backport of #10115) (#10300)
  • 5cdf017 chore(deploy): Release v26.17.0 (electron-updater@6.8.10) (v26) (#10191)
  • 7dd7f8a fix(updater): make multi-range differential downloads work on real servers (v...
  • 1dfe1a9 fix(electron-updater): keep cached blockmap consistent with cached installer ...
  • See full diff in compare view

Updates node-abi from 4.35.0 to 4.39.0

Release notes

Sourced from node-abi's releases.

v4.39.0

4.39.0 (2026-10-21)

Features

v4.38.0

4.38.0 (2026-10-15)

Features

v4.37.0

4.37.0 (2026-10-08)

Features

v4.36.0

4.36.0 (2026-10-05)

Features

Commits

Updates @electron/rebuild from 4.2.0 to 4.2.1

Release notes

Sourced from @​electron/rebuild's releases.

v4.2.1

4.2.1 (2026-10-06)

Bug Fixes

Commits
  • d62d5a2 ci: set cache-mode on release workflows (#1307)
  • 3e6bfd1 fix: include target platform in .forge-meta rebuild marker (#1319)
  • e355454 chore(deps): bump undici from 6.28.0 to 6.28.1 in /test/fixture/workspace-tes...
  • 90f2542 chore(deps): bump brace-expansion from 5.0.7 to 5.0.12 (#1317)
  • af5c214 ci: add required-ci gate job (#1312)
  • 6a69b7c chore(deps): bump markdown-it from 14.2.0 to 14.3.2 (#1315)
  • 037e7d9 chore(deps): bump azure/login from 3.0.1 to 3.1.0 (#1321)
  • 8b14ce8 chore(deps): bump undici from 6.28.0 to 6.28.1 in /test/fixture/native-app1 (...
  • 7bb45ee chore(deps): bump undici from 6.27.0 to 6.28.1 (#1313)
  • dd050f3 build(deps-dev): upgrade vitest to v5 (#1310)
  • Additional commits viewable in compare view

Updates electron from 43.7.1 to 43.8.3

Release notes

Sourced from electron's releases.

electron v43.8.3

Release Notes for v43.8.3

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8. #55147

electron v43.8.2

Release Notes for v43.8.2

electron v43.8.1

Release Notes for v43.8.1

[!NOTE] This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

Fixes

  • Fixed link-opened windows not using the opener's session and webPreferences. #55049 (Also in 42, 44, 45)
  • Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55047 (Also in 42, 44, 45)

electron v43.8.0

Release Notes for v43.8.0

Fixes

  • Fixed a crash on Linux at startup or on theme change with GTK modules loaded. #55016
  • Fixed a crash when creating a framed window on Wayland in environments where GTK could not initialize. #54893 (Also in 44, 45)
  • Fixed a Linux crash creating a window with a menu bar when GTK failed to load. #54884 (Also in 44, 45)
  • Fixed an issue where clicks posted to a background app were dropped on macOS. #54905 (Also in 42, 44, 45)
  • Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54908 (Also in 42, 44, 45)
  • Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #54962 (Also in 42, 45)

Other Changes

  • Backported fixes from upstream Chromium and V8. #55032
  • Updated Node.js to v24.22.0. #55003

electron v43.7.11

Release Notes for v43.7.11

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #54899

Documentation

  • Documentation changes: #54881

... (truncated)

Commits
  • 1c0ee21 chore: cherry-pick 64 changes from angle, chromium, pdfium, skia and v8 (#55147)
  • 2eb275e test: wait for the parent's ack before utility children exit (#55122)
  • 817c43f fix: apply the certificate SPKI blocklist to Node and add entries (43-x-y) (#...
  • 9afe078 docs: fix code block line highlighting after docs reformats (#55103)
  • 076d6db test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
  • 3b068bf test: re-enable Node.js tests that now pass with BoringSSL (#55094)
  • 60f928e build: stop overriding node GN declare_args defaults in patch (#55076)
  • 14c73d1 build: update PGO profiles (#55092)
  • 7ceb2c0 fix: avoid misaligned char16_t reads in crdtp string deserialization (#55063)
  • 06f1c1f ci: use Cloudflare DNS directly on macOS runners (#55068)
  • Additional commits viewable in compare view

Updates electron-builder from 26.16.1 to 26.18.0

Release notes

Sourced from electron-builder's releases.

electron-builder@26.18.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.17.0...electron-builder@26.18.0

electron-builder@26.17.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.1...electron-builder@26.17.0

Changelog

Sourced from electron-builder's changelog.

26.18.0

Patch Changes

206d35d 3dc7c90 e703212 84f7b46 6202a27 fcd6897 160c3b4 1928adf c60987c a92517a a1e9db8 4123c27

  • app-builder-lib@26.18.0
  • dmg-builder@26.18.0

26.17.0

Patch Changes

bae1c8b 2a2dd22 07c8344 07c8344 613cd58 d4a4f50 41a027c 59f6364

  • app-builder-lib@26.17.0
  • dmg-builder@26.17.0
Commits
  • e2a8604 chore(deploy): Release v26.18.0 (electron-updater@6.8.11) (v26) (#10250)
  • 5cdf017 chore(deploy): Release v26.17.0 (electron-updater@6.8.10) (v26) (#10191)
  • See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note

Medium Risk
Patch bumps to Electron, auto-updater, and packager affect the desktop runtime, TLS/update delivery, and release artifacts without code changes—regression risk is mainly in builds, native modules, and in-app updates.

Overview
Bumps the grouped Electron toolchain and runtime dependencies in package.json / package-lock.json only—no application source changes.

Runtime & updates: electron moves 43.7.1 → 43.8.3 (Chromium/V8 backports, TLS/certificate handling including the eMudhra advisory mitigation, and fixes for windows opened from links and setCertificateVerifyProc). electron-updater 6.8.9 → 6.8.11 improves differential downloads, blockmap/cache consistency, and validation of cached update filenames—relevant to the desktop auto-update flow in redisinsight/desktop.

Build & native modules: electron-builder 26.16.1 → 26.18.0 (aligned app-builder-lib, NSIS/snap/pnpm packaging fixes). @electron/rebuild 4.2.0 → 4.2.1 and node-abi 4.35.0 → 4.39.0 support correct native addon rebuilds against the new Electron ABI.

Reviewers should validate desktop dev builds, electron-rebuild / postinstall, and update download/install on at least one target OS after merge.

Reviewed by Cursor Bugbot for commit 77c77fd. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
chore(deps): bump the electron group across 1 directory with 5 updates
77c77fd 
Bumps the electron group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [electron-updater](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater) | `6.8.9` | `6.8.11` |
| [node-abi](https://github.com/electron/node-abi) | `4.35.0` | `4.39.0` |
| [@electron/rebuild](https://github.com/electron/rebuild) | `4.2.0` | `4.2.1` |
| [electron](https://github.com/electron/electron) | `43.7.1` | `43.8.3` |
| [electron-builder](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-builder) | `26.16.1` | `26.18.0` |



Updates `electron-updater` from 6.8.9 to 6.8.11
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/electron-updater@6.8.11/packages/electron-updater/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-updater@6.8.11/packages/electron-updater)

Updates `node-abi` from 4.35.0 to 4.39.0
- [Release notes](https://github.com/electron/node-abi/releases)
- [Commits](electron/node-abi@v4.35.0...v4.39.0)

Updates `@electron/rebuild` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/electron/rebuild/releases)
- [Commits](electron/rebuild@v4.2.0...v4.2.1)

Updates `electron` from 43.7.1 to 43.8.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v43.7.1...v43.8.3)

Updates `electron-builder` from 26.16.1 to 26.18.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/electron-builder@26.18.0/packages/electron-builder/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.18.0/packages/electron-builder)

---
updated-dependencies:
- dependency-name: electron-updater
  dependency-version: 6.8.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: electron
- dependency-name: node-abi
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: electron
- dependency-name: "@electron/rebuild"
  dependency-version: 4.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: electron
- dependency-name: electron
  dependency-version: 43.8.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: electron
- dependency-name: electron-builder
  dependency-version: 26.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: electron
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 26, 2026 00:04
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review 🔄 Running since 2026-10-26T00:04:39.181778Z 77c77fd PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@dependabot
dependabot Bot temporarily deployed to production October 26, 2026 00:09 Inactive
@dependabot
dependabot Bot temporarily deployed to production October 26, 2026 00:09 Inactive
@dependabot
dependabot Bot temporarily deployed to production October 26, 2026 00:09 Inactive
@dependabot
dependabot Bot temporarily deployed to production October 26, 2026 00:09 Inactive
@dependabot
dependabot Bot temporarily deployed to production October 26, 2026 00:09 Inactive
@dependabot
dependabot Bot temporarily deployed to production October 26, 2026 00:09 Inactive
@dependabot
dependabot Bot temporarily deployed to production October 26, 2026 00:09 Inactive

This branch was previously deployed

1 inactive deployment
production — 77c77fd9 Deployed Oct 26, 2026 by dependabot[bot] via integration-tests / ITest (oss-st-8) #8689
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants