Repository navigation
chore(deps-dev): bump the npm_and_yarn group across 3 directories with 1 update - #63
dependabot[bot] wants to merge 1 commit into
Conversation
…h 1 update Bumps the npm_and_yarn group with 1 update in the / directory: [electron](https://github.com/electron/electron). Bumps the npm_and_yarn group with 1 update in the /config directory: [electron](https://github.com/electron/electron). Bumps the npm_and_yarn group with 1 update in the /creative-studio-ui directory: [electron](https://github.com/electron/electron). Updates `electron` from 41.10.3 to 41.10.6 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v41.10.3...v41.10.6) Updates `electron` from 41.10.3 to 41.10.6 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v41.10.3...v41.10.6) Updates `electron` from 41.10.3 to 41.10.6 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v41.10.3...v41.10.6) --- updated-dependencies: - dependency-name: electron dependency-version: 41.10.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: electron dependency-version: 41.10.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: electron dependency-version: 41.10.6 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
zedarvates
left a comment
zedarvates
left a comment
There was a problem hiding this comment.
Review completed on 2026-10-03 after #70's advisory/compatibility review, anchored to ca5b890a4fe010065a76294506abbde0b293ec3c.
Verified patch scope and coverage
All three manifests and lockfiles consistently move Electron 41.10.3 → 41.10.6. The lock entry retains the same Node engine requirement, >=22.12.0; this is a patch within Electron 41, not a major-version transition. The reviewed diff changes only the Electron requirement/version/download digest at root, config and Creative Studio.
The fresh npm audits on #70's 41.10.3 locks expose these five Electron advisory IDs. The exact #63 locks resolve 41.10.6 and show no Electron finding in all three roots.
| Advisory | Affected range returned by npm | Issue class |
|---|---|---|
| GHSA-hq2x-r82h-9wj4 | <41.10.4 |
Sandbox restrictions lost by iframe popups |
| GHSA-gr2m-v5gq-v685 | <41.10.6 |
Sandbox restrictions lost by top-level popups |
| GHSA-j84w-jfhq-vhvj | <41.10.6 |
Cross-origin reads through file/HTTP protocol handlers |
| GHSA-9qh4-3jw8-366w | <41.10.6 |
Worker Node integration inherited incorrectly |
| GHSA-vv43-5jgx-7qv8 | >=40.0.0-alpha.1 <41.10.5 |
macOS Squirrel update race |
#63 alone still has Axios/Undici findings addressed by #70. GitHub's private numbered Dependabot alerts are not exposed by the available API route; matching the five GHSAs to the resolved version does not prove numbered alerts have been closed.
Compatibility evidence: distinguish head from combination
- Current-head SonarCloud check: successful on
ca5b890a4fe010065a76294506abbde0b293ec3c. No npm/Electron GitHub Actions run is exposed for this head. - A local checkout of #63
ca5b890a4fe010065a76294506abbde0b293ec3cplus #7099feb3319e35a896bbdb4505a02a9fa452380329accepts the lockfile patch cleanly. The three combined dependency roots install successfully with scripts disabled; Creative Studio was tested with--legacy-peer-deps. - The official Electron 41.10.6 binary installs and starts in ELECTRON_RUN_AS_NODE mode. Its embedded Node 24.18.0 runs the Axios/Undici HTTP echo and Sharp native PNG smoke successfully. Host Node 24.19.0 passes the same smoke.
- The Sharp/Linux warning and GLib critical messages also occur with the baseline Electron 41.10.3 on #70's dependency set. They were not introduced by #63 in this bounded comparison, but the test does not establish healthy GUI/native rendering.
- Electron's Creative Studio main/preload/launcher files pass
node --check. Root build remains blocked by absent./SplashWindow, config by absentelectron/tsconfig.json, and UI type-checking by the same 2,147 diagnostics after path normalization. No packaged app, GUI renderer or Windows/macOS behavior was exercised.
The combined locks remove Axios/Undici/Electron audit entries, while other npm findings remain (39 / 39 / 7 affected-package entries, root/config/UI). Sonar's gate does not clear those dependency findings or establish runtime security.
Actual remaining review/acceptance gaps
Confirm the intended shipped Electron entrypoint and the minimum application-start/renderer acceptance on the target platform, then resolve or explicitly accept the documented build/native gaps. Creative Studio's existing main process sets nodeIntegration: true, contextIsolation: false and webSecurity: false; the package patch does not harden those preferences. The root entrypoint uses protocol.handle, so do not equate an advisory's legacy-protocol scenario with proof of exploitability in that path.
This COMMENT records dependency coverage and the limited smoke results. It grants no merge approval. Verify private alert closure and checks again on the eventual merged head.
zedarvates
left a comment
zedarvates
left a comment
There was a problem hiding this comment.
Follow-up verification — 2026-10-03
The root Electron TS2307 blocker has a separate draft repair in #73, head 3a8cac25a11ed207192d443562f899cecb54aede. Its current-head CI run passes installation, 13 splash lifecycle tests and compilation on Node 22.12.0/24.19.0. The Linux splash smoke passes with Electron 41.10.3 / embedded Node 24.18.0; Xvfb/--no-sandbox limits the claim to the splash document/progress/close lifecycle. Sonar is also successful for that repair SHA.
Local combination of exact #70 99feb3319e35a896bbdb4505a02a9fa452380329 and exact #63 ca5b890a4fe010065a76294506abbde0b293ec3c, plus the #73 source patch: root/Studio npm installations, root Electron compile and 13 splash unit tests pass with Electron 41.10.6, Axios 1.20.0 and Undici 6.29.0/7.30.0. This combination is not the head of either dependency PR and has no GitHub check of its own.
Remaining Studio gap is tracked in #74: Vite still fails on missing ComfyUIProvider; strict typecheck still yields 2,147 diagnostics, byte-identical to the baseline. Source/renderer contracts and missing editor stores need restoration before complete desktop acceptance. The legacy config/package.json scripts are not a second runnable launcher entry point.
#73 remains draft and is not incorporated into this dependency PR's unchanged head, so its green checks do not replace current-head build evidence here. Review/apply the launcher repair and obtain fresh build/renderer evidence before accepting the desktop behavior. The precise GHSA coverage in the prior review remains unchanged; this follow-up does not establish private alert closure or full-platform/runtime security acceptance.
1 participant
Bumps the npm_and_yarn group with 1 update in the / directory: electron.
Bumps the npm_and_yarn group with 1 update in the /config directory: electron.
Bumps the npm_and_yarn group with 1 update in the /creative-studio-ui directory: electron.
Updates
electronfrom 41.10.3 to 41.10.6Release notes
Sourced from electron's releases.
Commits
832e70afix: don't let pending shell operations block app exit on Windows (#52899)b8d49a4chore: cherry-pick 39 changes from angle, chromium and skia (#52707)29fc130fix: inherit sandbox flags in windows opened by a sandboxed top-level frame (...c595b05fix: return opaque responses from file and http protocol handlers for cross-o...6462a2efix: inherit nodeIntegrationInWorker from the embedder for <webview> and wind...d9c6215chore: cherry-pick 4 changes from chromium and v8 (#52775)a46a5afbuild: run the Windows builds on the VM runners (41-x-y) (#52770)5bff19cbuild: add release-assets.json expected-asset manifest (41-x-y) (#52734)15e2928fix: resolve target bundle path once at start of install (#50764)2ba8050chore: cherry-pick 33 changes from angle, chromium, skia and v8 (#52702)Updates
electronfrom 41.10.3 to 41.10.6Release notes
Sourced from electron's releases.
Commits
832e70afix: don't let pending shell operations block app exit on Windows (#52899)b8d49a4chore: cherry-pick 39 changes from angle, chromium and skia (#52707)29fc130fix: inherit sandbox flags in windows opened by a sandboxed top-level frame (...c595b05fix: return opaque responses from file and http protocol handlers for cross-o...6462a2efix: inherit nodeIntegrationInWorker from the embedder for <webview> and wind...d9c6215chore: cherry-pick 4 changes from chromium and v8 (#52775)a46a5afbuild: run the Windows builds on the VM runners (41-x-y) (#52770)5bff19cbuild: add release-assets.json expected-asset manifest (41-x-y) (#52734)15e2928fix: resolve target bundle path once at start of install (#50764)2ba8050chore: cherry-pick 33 changes from angle, chromium, skia and v8 (#52702)Updates
electronfrom 41.10.3 to 41.10.6Release notes
Sourced from electron's releases.
Commits
832e70afix: don't let pending shell operations block app exit on Windows (#52899)b8d49a4chore: cherry-pick 39 changes from angle, chromium and skia (#52707)29fc130fix: inherit sandbox flags in windows opened by a sandboxed top-level frame (...c595b05fix: return opaque responses from file and http protocol handlers for cross-o...6462a2efix: inherit nodeIntegrationInWorker from the embedder for <webview> and wind...d9c6215chore: cherry-pick 4 changes from chromium and v8 (#52775)a46a5afbuild: run the Windows builds on the VM runners (41-x-y) (#52770)5bff19cbuild: add release-assets.json expected-asset manifest (41-x-y) (#52734)15e2928fix: resolve target bundle path once at start of install (#50764)2ba8050chore: cherry-pick 33 changes from angle, chromium, skia and v8 (#52702)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.