Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade electron from 33.2.0 to 34.0.1 #64

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

nerdy-tech-com-gitub
Copy link
Owner

@nerdy-tech-com-gitub nerdy-tech-com-gitub commented Feb 12, 2025

snyk-top-banner

Snyk has created this PR to upgrade electron from 33.2.0 to 34.0.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 32 versions ahead of your current version.

  • The recommended version was released 21 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Out-of-bounds Write
SNYK-JS-ELECTRON-8604283
115 No Known Exploit
high severity External Control of Assumed-Immutable Web Parameter
SNYK-JS-ELECTRON-8642946
115 No Known Exploit
high severity Out-of-bounds Read
SNYK-JS-ELECTRON-8642948
115 No Known Exploit
medium severity Access Restriction Bypass
SNYK-JS-ELECTRON-8381013
115 No Known Exploit
critical severity Out-of-bounds Write
SNYK-JS-ELECTRON-8642944
115 No Known Exploit
Release notes
Package name: electron
  • 34.0.1 - 2025-01-22
  • 34.0.0 - 2025-01-14

    Release Notes for v34.0.0

    Stack Upgrades

    Breaking Changes

    • Made menu bar hidden on fullscreen in Windows. #43402

    Features

    Additions

    • Added APIs to manage shared dictionaries for compression efficiency using Brotli or ZStandard. The new APIs are session.getSharedDictionaryUsageInfo(), session.getSharedDictionaryInfo(options), session.clearSharedDictionaryCache(), and session.clearSharedDictionaryCacheForIsolationKey(options). #44950 (Also in 33)
    • Added WebFrameMain.collectJavaScriptCallStack() for accessing the JavaScript call stack of unresponsive renderers. #44938 (Also in 33)
    • Added WebFrameMain.detached for frames in an unloading state.
      • Added WebFrameMain.isDestroyed() to determine if a frame has been destroyed.
      • Fixed webFrameMain.fromId(processId, frameId) returning a WebFrameMain instance which doesn't match the given parameters when the frame is unloading. #43473 (Also in 33)
    • Added error event in utility process to support diagnostic reports on V8 fatal errors. #43774 (Also in 33)
    • Added support for the macOS system picker in desktopCapturer and setDisplayMediaRequestHandler. #43581 (Also in 32, 33)
    • Feat: GPU accelerated shared texture offscreen rendering. #42953 (Also in 33)

    Improvements

    • Performance improvements when processing microtasks. #44471 (Also in 32, 33)

    Fixes

    • Fixed file chooser dialogs for flaptak applications. #44681
    • Fixed issue where 'contextmenu' event is emitted twice on macOS. #44997

    Also in earlier versions...

    • Fixed BrowserView auto resize issue. #43463 (Also in 31, 32, 33)
    • Fixed MenuItem.click handler not setting focusedWindow parameter when focused window is a BaseWindow. #43404 (Also in 31, 32, 33)
    • Fixed chrome.i18n extension API being unavailable in service workers. #45036 (Also in 31, 32, 33)
    • Fixed trace-startup not working on macOS. #44275 (Also in 32, 33)
    • Fixed a build failure when the enable_plugins build flag is false. #44003 (Also in 33)
    • Fixed a crash that could occur when calling shell.readShortcutLink on Windows. #44804 (Also in 33)
    • Fixed a crash when calling focus on a WebView's webContents. #43921 (Also in 31, 32, 33)
    • Fixed a potential issue accessing a child window document when overriding browserWindow creation via setWindowOpenHandler. #43775 (Also in 31, 32, 33)
    • Fixed a potential issue with fillable PDF forms saving correctly in some circumstances. #43667 (Also in 31, 32, 33)
    • Fixed an issue when dragging to resize when using Window Controls Overlay on Linux. #43724 (Also in 31, 32, 33)
    • Fixed an issue where BaseWindow.setTouchBar didn't work as expected. #43353 (Also in 30, 31, 32, 33)
    • Fixed an issue where EventSource was undefined in both renderer and worker processes when Node.js integration was enabled. #44495 (Also in 32, 33)
    • Fixed an issue where WebContentsViews did not show correctly in some circumstances on macOS after being added as child views. #43638 (Also in 31, 32, 33)
    • Fixed an issue where WebContentsViews were being improperly removed. #44670 (Also in 31, 32, 33)
    • Fixed an issue where defaultPath did not work for all users on Linux when creating an open file dialog. #43570 (Also in 30, 31, 32, 33)
    • Fixed an issue where resize wasn't being emitted for single-pixel resizes on Windows. #44722 (Also in 32, 33)
    • Fixed an issue where a utilityProcess pid would not be undefined after exit. #44695 (Also in 32, 33)
    • Fixed an issue where an exception could be thrown on BrowserView after its owner BrowserWindow was closed. #43972 (Also in 31, 32, 33)
    • Fixed an issue where buttons shown under the Window Controls Overlay API were missing tooltips. #44759 (Also in 32, 33)
    • Fixed an issue where clicking the eyedropper icon did nothing instead of opening an eyedropper for color selection as expected. #43685 (Also in 32, 33)
    • Fixed an issue where closing a window after printing on Linux triggered a crash. #44284 (Also in 31, 32, 33)
    • Fixed an issue where the exit event could be emitted twice from the utilityProcess. #44265 (Also in 31, 32, 33)
    • Fixed an issue where the webContents context-menu event was not emitted when using -webkit-app-region: drag. #44799 (Also in 32, 33)
    • Fixed an issue where the windows control overlay was unexpectedly visible in fullscreen on Linux. #44641 (Also in 31, 32, 33)
    • Fixed an issue with resize events being emitted on Windows when the window was moved but not resized. #43431 (Also in 32, 33)
    • Fixed an possible crash when using draggable regions and BaseWindows to get the context-menu event. #44952 (Also in 32, 33)
    • Fixed bug where camera permissions affected screen sharing. #43517 (Also in 32, 33)
    • Fixed build failure when the PDF viewer is disabled. #44964 (Also in 33)
    • Fixed calling setAlwaysOnTop on a hidden window which is then shown with showInactive on Linux under X11. #44322 (Also in 31, 32, 33)
    • Fixed closing a window with more than one attached sheet on macOS. #43706 (Also in 31, 32, 33)
    • Fixed crash in net api when utility process exits. #44731 (Also in 32, 33)
    • Fixed crash when network process terminates while a net log is running. #44418 (Also in 31, 32, 33)
    • Fixed crash when rendering super menu accelerator on linux. #44346 (Also in 32, 33)
    • Fixed crash when running getDisplayMedia from multiple iframes. #43905 (Also in 33)
    • Fixed custom spell checker getting stuck in infinite loop using 100% CPU. #45020 (Also in 31, 32, 33)
    • Fixed devtools to allow restoring saved dock state on Linux when WCO is enabled. #43490 (Also in 31, 32, 33)
    • Fixed electron app in ozone/wayland not being focused when launched from another app. #43481 (Also in 31, 32, 33)
    • Fixed external window focus when using shell.openExternal. #44469 (Also in 33)
    • Fixed issue with missing index arg for webContents.canGoToOffset. #45008 (Also in 32, 33)
    • Fixed mouse cursor turning into loading spinner when starting utility process on Windows. #43657 (Also in 33)
    • Fixed native addon compilation errors on macOS. #44189 (Also in 31, 32, 33)
    • Fixed other apps not being focused when launched from electron ozone/wayland. #43480 (Also in 31, 32, 33)
    • Fixed potential use-after-free during view removal on macOS. #43627 (Also in 31, 32, 33)
    • Fixed race condition in which WebContents appears as white screen on VDI machines without hardware acceleration capabilities. #44350 (Also in 32, 33)
    • Fixed regression with dynamic dependency on libgdk_pixbuf. #44438 (Also in 32, 33)
    • Fixed segfault when moving WebContentsView between BrowserWindows. #44612 (Also in 31, 32, 33)
    • Fixed theme does not work in DevTools. #44636 (Also in 32, 33)
    • Fixed update file extension bug. #44770 (Also in 33)
    • Restored Chromium default Content-Disposition header parsing. #43611 (Also in 30, 31, 32, 33)
    • Return 0 exit code for normal termination of the utility process. #44733 (Also in 32, 33)
    • Third time isn't always a charm. Fixed the native macOS Screen Share picker invocation triggering a test Chromium green screen. #43767 (Also in 32, 33)

    Other Changes

    • Backported fix for 382394791. #45023
    • Ensured that the sender-id hint is set when creating desktop notifications on DBus. #43928 (Also in 31, 32, 33)
    • Fixed an issue where a deprecation warning was being incorrectly emitted for frameless windows on macOS. #44768 (Also in 33)
    • Fixed yellow background of composition text with wayland text-input-v3. #45127 (Also in 33)

    Documentation

    Notices

    End of Support for 31.x.y

    Electron 31.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

  • 34.0.0-beta.16 - 2025-01-09
  • 34.0.0-beta.15 - 2025-01-07
  • 34.0.0-beta.14 - 2024-12-23
  • 34.0.0-beta.13 - 2024-12-19
  • 34.0.0-beta.12 - 2024-12-16
  • 34.0.0-beta.11 - 2024-12-11
  • 34.0.0-beta.10 - 2024-12-09
  • 34.0.0-beta.9 - 2024-12-05
  • 34.0.0-beta.8 - 2024-12-02
  • 34.0.0-beta.7 - 2024-11-28
  • 34.0.0-beta.6 - 2024-11-25
  • 34.0.0-beta.5 - 2024-11-21
  • 34.0.0-beta.4 - 2024-11-18
  • 34.0.0-beta.3 - 2024-11-15
  • 34.0.0-beta.2 - 2024-11-14
  • 34.0.0-beta.1 - 2024-11-12
  • 34.0.0-alpha.9 - 2024-11-11
  • 34.0.0-alpha.8 - 2024-11-07
  • 34.0.0-alpha.7 - 2024-11-04
  • 34.0.0-alpha.6 - 2024-10-31
  • 34.0.0-alpha.5 - 2024-10-28
  • 34.0.0-alpha.4 - 2024-10-25
  • 34.0.0-alpha.3 - 2024-10-23
  • 34.0.0-alpha.2 - 2024-10-17
  • 34.0.0-alpha.1 - 2024-10-16
  • 33.4.0 - 2025-02-06
  • 33.3.2 - 2025-01-22
  • 33.3.1 - 2025-01-06
  • 33.3.0 - 2024-12-05
  • 33.2.1 - 2024-11-27
  • 33.2.0 - 2024-11-07
from electron GitHub release notes

Important

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Summary by Sourcery

Upgrade Electron from 33.2.0 to 34.0.1.

New Features:

  • Add GPU accelerated shared texture offscreen rendering.

Bug Fixes:

  • Fix issues with file chooser dialogs for flatpak applications.
  • Fix issue where "contextmenu" event is emitted twice on macOS.

Enhancements:

  • Add APIs to manage shared dictionaries for compression efficiency using Brotli or ZStandard.
  • Add WebFrameMain.collectJavaScriptCallStack() for accessing the JavaScript call stack of unresponsive renderers.
  • Add WebFrameMain.detached for frames in an unloading state.
  • Add error event in utility process to support diagnostic reports on V8 fatal errors.
  • Add support for the macOS system picker in desktopCapturer and setDisplayMediaRequestHandler.
  • Improve performance when processing microtasks.

Snyk has created this PR to upgrade electron from 33.2.0 to 34.0.1.

See this package in npm:
electron

See this project in Snyk:
https://app.snyk.io/org/nerds-github/project/7ac3a559-e245-43bc-aea8-6d68ed454985?utm_source=github&utm_medium=referral&page=upgrade-pr
Copy link

sourcery-ai bot commented Feb 12, 2025

Reviewer's Guide by Sourcery

This pull request upgrades the electron dependency from version 33.2.0 to 34.0.1 by modifying the package.json file in the main app directory. The upgrade is aimed at addressing multiple security vulnerabilities and keeping the dependency up-to-date. Note that this is a major version upgrade that may introduce breaking changes.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change Details Files
Electron dependency version update
  • Updated electron version from 33.2.0 to 34.0.1 in the project configuration
  • Aims to mitigate several reported security issues as highlighted by Snyk
apps/main/package.json

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!
  • Generate a plan of action for an issue: Comment @sourcery-ai plan on
    an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have skipped reviewing this pull request. Here's why:

  • It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
  • We don't review packaging changes - Let us know if you'd like us to change this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants