[dependabot]

Bumps electron from 43.4.0 to 43.5.0.

Release notes

Sourced from electron's releases.

electron v43.5.0

Release Notes for v43.5.0

Fixes

• Fixed DevTools device metrics overrides persisting indefinitely when a remote debugging client disconnected without clearing them. #52946 (Also in 42, 44)
• Fixed BrowserWindow.unmaximize() and restore() having no effect on Wayland when the window was maximized immediately after creation. #53125 (Also in 42, 44)
• Fixed Uncaught illegal access errors and possible renderer crashes after closing a same-process child window or removing an iframe with nodeIntegrationInSubFrames enabled. #53041 (Also in 42, 44)
• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53319 (Also in 42, 44, 45)
• Fixed webContents.executeJavaScriptInIsolatedWorld resolving with undefined when worldId was not an integer. #53237 (Also in 44)
• Fixed webContents.print() honoring printBackground, duplexMode, and printer default duplex settings. #53160 (Also in 42, 44)
• Fixed a crash on Linux when the D-Bus session bus disconnected while the app was running, such as at logout or when dbus is restarted. #53095 (Also in 42, 44)
• Fixed a crash on Windows when V8 posted a delayed worker task during shutdown. #53013 (Also in 42, 44)
• Fixed a crash on macOS when a WebAuthn Touch ID prompt was requested while no locale resources were loaded. #53195 (Also in 44)
• Fixed a crash on macOS when a notification's icon could not be attached; the notification is now shown without the icon. #53147 (Also in 42, 44)
• Fixed a crash when calling node:wasi functions in optimized code. #53265 (Also in 42, 44, 45)
• Fixed a crash when calling utilityProcess.postMessage() after the utility process had exited. #53301 (Also in 44, 45)
• Fixed a regression where a window created with a custom title can show an empty title after using back/forward navigation. #53219 (Also in 42, 44)
• Fixed a renderer crash when a page calls SpeechRecognition.available() or SpeechRecognition.install() with processLocally. #53015 (Also in 42, 44)
• Fixed an issue where pages loaded in a detached WebContentsView wouldn't see the correct window size. #53152 (Also in 42, 44)
• Fixed crashes in sharedTexture, service-worker ipcRenderer and utilityProcess.fork() caused by object lifetime bugs. #53278 (Also in 44, 45)
• Fixed crashes in the main process when a webRequest.onBeforeRequest listener redirected a CORS preflight request, and when calling net.fetch() with a webRequest-permission extension loaded. #53304 (Also in 44, 45)
• Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it. #53288 (Also in 44, 45)
• Fixed crashes when certain app event handlers call back into Electron synchronously. #53276 (Also in 44, 45)
• Fixed document title updates when using back/forward navigation using the same document without utilizing browserWindow.setTitle(). #53023 (Also in 42, 44)
• Fixed region-qualified --lang values such as de-DE loading no locale resources on macOS, which left localized strings empty and could crash WebAuthn Touch ID prompts. #53186 (Also in 42, 44)
• Fixed spellcheck not initializing on Linux when the dictionary was already cached from a previous run. #52717 (Also in 44)
• Fixed the GPU process being terminated in AppX/MSIX packaged apps on Windows when WebGPU fell back to SwiftShader. #53197 (Also in 42, 44)
• Fixed the primary instance being killed or receiving truncated arguments when a second instance passed a very long command line or large additionalData to app.requestSingleInstanceLock(). #53156 (Also in 42, 44)
• Fixed the tray icon not appearing on GNOME (and disappearing entirely on Wayland) since 43.4.1. #53215
• Fixed utility process crashes at exit on Windows 11 24H2 and later. #53092 (Also in 42, 44)
• Fixed windows native message boxes being dismissed by other applications using invalid button ID. #53155 (Also in 44)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, Skia and V8. #52969
• Backported fixes from upstream ANGLE, Chromium, Dawn, V8 and WebRTC. #53190
• Backported fixes from upstream Chromium and V8. #53055
• Fixed a 1-in-200 chance per renderer process on Windows of scripts on the first page load being compiled without their V8 code cache. #52943 (Also in 42, 44)
• Fixed a stall of tens of milliseconds while creating the first BrowserWindow on Linux.
  • Improved the performance of file lookups inside ASAR archives and of large files served from them to the renderer.
  • Improved the performance of calls through contextBridge-exposed APIs.
  • Reduced the main-thread cost of sending large values through ipcRenderer, ipcMain handlers and webContents.send. #53018 (Also in 42, 44)
• Improved application startup time on Linux by skipping GDK's OpenGL probe and loading FontConfig off the main thread during toolkit initialization. #53108 (Also in 44)
• Improved startup time of utilityProcess.fork(), child_process.fork() / ELECTRON_RUN_AS_NODE child processes and Node.js-enabled renderers. #53135 (Also in 42, 44)
• Linux arm64, Windows arm64 and macOS x64 builds now start the main process from the embedded Node.js startup snapshot like the other platforms, improving startup time. #52881 (Also in 42, 44)
• Page resources, fetch() calls and file:// loads in renderers no longer wait for the main process to be idle when no webRequest listeners or protocol interceptors are registered. #53142 (Also in 42, 44)
• Updated Chromium to 150.0.7871.250. #52787
• Updated Node.js to v24.19.0. #52635

electron v43.4.1

... (truncated)

Commits

• 87cd122 fix: serialize the target's values into the Node.js startup snapshot on cross...
• f835161 fix: crash in webRequest proxy for redirected CORS preflights and frameless f...
• 379a50e build: update PGO profiles (#53311)
• 42e9db9 chore: clean up forward declarations (#53295)
• fe02d1a fix: crash when calling utilityProcess.postMessage() after the process has ex...
• bb2194e fix: dangling WebContents/NativeWindow pointers in debugger, devtools, login,...
• 1002688 fix: object lifetime bugs in sharedTexture, service-worker ipcRenderer and ut...
• eb3528a fix: use-after-free when event handlers re-enter chooser, protocol stream and...
• 8a24b57 fix: spellcheck failing to initialize on Linux (#52717)
• fd98d68 fix: crash when V8 optimises a call to a node:wasi import (#53265)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[atlas-commons-bot]

Atlas Commons PR review

Requirement	Status
DCO sign-off	pass
Required checks	pass
Summary filled	fail
Checklist	pass
Linked issue	warn

Overall: fail

• All commits include DCO sign-off.
• Required checks passed.
• Summary section is empty or still has placeholder text.
• All checklist items ticked or none present.
• No linked issue (advisory).

View PR #29 · Atlas-Commons/StreamBooru

[atlas-commons-bot]

Atlas Commons code review (LLM)

Summary

Dependabot bumps electron from ^43.4.0 to ^43.5.0 in package.json and refreshes the resolved tarball in package-lock.json (43.4.0 → 43.5.0 with updated integrity). This is a patch-level runtime bump; the shipped Electron stack also includes Chromium 150.0.7871.250 and embedded Node v24.19.0 per upstream release notes, not just the semver label in npm.

Potential issues

1. Embedded Node and native addons Electron 43.5.0 bundles Node 24.19.0. If the app or CI builds native addons (e.g. via electron-rebuild, optional dependencies, or tools that assume the system Node ABI), a green lockfile diff does not guarantee binary compatibility. Confirm packaged builds on Windows, macOS, and Linux after npm ci and a full electron-builder (or equivalent) run.

"scripts": {
  "postinstall": "electron-builder install-app-deps"
}

2. Chromium behavior changes The release includes a Chromium minor bump. Renderer-facing behavior (media, fetch, CORS, GPU/WebGPU, spellcheck on Linux) can shift without any application code changes. Regression risk is highest for features that load remote gallery/stream pages, autoplay, fullscreen, or hardware-accelerated video—typical for a booru-style client.

3. webRequest / net.fetch crash fixes imply prior fragility Upstream fixed main-process crashes when webRequest.onBeforeRequest redirects CORS preflights and when using net.fetch() with certain extension permissions. If StreamBooru registers webRequest listeners or custom protocol handlers, smoke-test navigation, image/video loads, and any ad-block or redirect logic on the new binary even though this PR does not touch that code.

4. Linux desktop integration 43.5.0 explicitly fixes tray icon regressions on GNOME/Wayland (introduced in 43.4.1), D-Bus disconnect crashes, and Wayland unmaximize()/restore(). Linux CI often skips GUI checks; if you ship a tray or target Wayland, manual verification on at least one GNOME/Wayland session is worthwhile—this bump is partly a fix for Linux users stuck on 43.4.x.

5. Single-instance and long CLI args Upstream fixed primary-instance kill/truncation when a second instance passes very long command lines or large additionalData to app.requestSingleInstanceLock(). If the app deep-links or passes large payloads on second-instance events, retest “open in existing window” flows after upgrade.

6. Lockfile-only drift risk The diff is minimal and correct for a Dependabot bump. Ensure no other manifest pins Electron (e.g. overrides, resolutions, or electron-builder electronVersion) that would leave CI on 43.4.0 while dev resolves 43.5.0. The PR snippet shows an overrides block in package.json that was not expanded in the diff—worth a quick read on main so one source of truth governs the packaged runtime.

Suggestions

• Run the project’s usual Electron smoke path: cold start, open a post/media view, back/forward navigation (title regression was fixed upstream), and quit cleanly on each supported OS.
• If you maintain release artifacts, rebuild and spot-check one installer/portable build so the downloaded Electron binary matches 43.5.0 from the lockfile, not a cached artifact from a previous pipeline.
• Note in release notes (if you publish them) that 43.5.0 carries many crash fixes (shutdown on Windows, utility process on Win11 24H2+, renderer lifetime bugs)—useful for users who stayed on 43.4.0 because of stability reports.
• No code changes are required for this PR; avoid mixing unrelated dependency or builder upgrades in the same merge unless CI forces it, to keep bisection simple if a platform regresses.

Overall assessment

The change is appropriate and low-risk at the diff level: semver patch, consistent package.json and package-lock.json, and upstream 43.5.0 is primarily bugfix and stability work (including a meaningful Linux tray fix for 43.4.x). Residual risk is integration testing—embedded Node/Chromium updates and platform-specific GUI behavior—not correctness of the Dependabot edit itself. Proceed after CI plus targeted packaged-app smoke tests on the platforms you ship; no blocking issues identified in the two-file diff alone.

---

Advisory review only — not a merge approval.

View PR #29 · Atlas-Commons/StreamBooru

[dependabot]

Superseded by #33.