[deps]: Update electron to v37.3.1 [SECURITY] - #862
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #862 +/- ##
=====================================
Coverage 7.72% 7.72%
=====================================
Files 68 68
Lines 2757 2757
Branches 477 477
=====================================
Hits 213 213
Misses 2529 2529
Partials 15 15 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
It does not look like this project uses It's still likely a good idea to upgrade this, however. |
|
|
New Issues (2)Checkmarx found the following issues in this Pull Request
Fixed Issues (11)Great job! The following issues were fixed in this Pull Request
|
BTreston
left a comment
BTreston
left a comment
There was a problem hiding this comment.
Build succeeds, tests pass, smoke test looks good.
2 participants
This PR contains the following updates:
37.2.4->37.3.1GitHub Vulnerability Alerts
CVE-2025-55305
Impact
This only impacts apps that have the
embeddedAsarIntegrityValidationandonlyLoadAppFromAsarfuses enabled. Apps without these fuses enabled are not impacted.Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the
resourcesfolder in your app installation on Windows which these fuses are supposed to protect against.Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
38.0.0-beta.637.3.136.8.135.7.5For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Release Notes
electron/electron (electron)
v37.3.1: electron v37.3.1Compare Source
Release Notes for v37.3.1
Fixes
shell.openPathwas not non-blocking as expected. #48088 (Also in 36, 38)window.openwould never be offscreen. #48070 (Also in 38)app.getLoginItemSettingson macOS. #48096 (Also in 36)Other Changes
v37.3.0: electron v37.3.0Compare Source
Release Notes for v37.3.0
Features
app.getRecentDocuments()on Windows and macOS. #47923 (Also in 36, 38){get|set}AccentColor. #48017 (Also in 36, 38)DIR_ASSETSinstead ofDIR_MODULE/DIR_EXEto locate assets and resources, and added "assets" as a key that can be queried viaapp.getPath. #47951 (Also in 38)Fixes
webContents.loadURL()from a failedwebContents.loadURL()call's catch handler. #48045 (Also in 36, 38)app.accessibilitySupportEnableddidn't work as expected. #48061 (Also in 38)electron/utilityin an ESM file threw an error at runtime. #48021 (Also in 36, 38)electron/utilitythrew aERR_MODULE_NOT_FOUNDerror at runtime. #47988 (Also in 36, 38)Other Changes
v37.2.6: electron v37.2.6Compare Source
Release Notes for v37.2.6
Fixes
Refererheader was not being set correctly when usingwebContents.downloadURL(). #47865 (Also in 36, 38)webContentsfunctions afterwindow.close(). #47954 (Also in 36, 38)setContentProtectiondidn't work as expected. #47887 (Also in 36, 38)accentColorwould result in a white accent color. #47800 (Also in 38)Other Changes
v37.2.5: electron v37.2.5Compare Source
Release Notes for v37.2.5
Other Changes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.