chore(deps): update dependency electron to v42.5.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
electron	42.4.1 → 42.5.1

---

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

CVE-2026-70606 / GHSA-r4w5-6pfg-jxp5

More information

Details

Impact

When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions.

Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. Apps that set an explicit session, or that do not isolate content across sessions, are not affected.

Workarounds

Set ProtocolResponse.session explicitly so the request uses the intended session's cache.

Fixed Versions

• 43.0.0
• 42.5.1
• 41.9.1
• 40.10.6

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-r4w5-6pfg-jxp5
• https://github.com/advisories/GHSA-r4w5-6pfg-jxp5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

electron/electron (electron)

v42.5.1: electron v42.5.1

Compare Source

Release Notes for v42.5.1

Fixes

• Fixed ProtocolResponse.url requests being made through the default session instead of the session the protocol handler was registered on when ProtocolResponse.session was not set. #​52132 ^{(Also in 40, 41, 43)}
• Made "reload" menu items work with BaseWindow. #​52117 ^{(Also in 41, 43)}

Other Changes

• Backported fixes from upstream Chromium. #​52115
• Backported fixes from upstream Chromium. #​52169

v42.5.0: electron v42.5.0

Compare Source

Release Notes for v42.5.0

Fixes

• Fixed Windows edge case in NativeWindowViews::MoveBehindTaskBarIfNeeded(). #​52022 ^{(Also in 41, 43)}
• Fixed an issue where clicking the maximize button could progressively shrink the window in some Wayland environments. #​52045 ^{(Also in 43)}

Other Changes

• Backported fixes from upstream Chromium. #​51975
• Updated Chromium to 148.0.7778.271. #​52038
• Updated Node.js to v24.17.0. #​52066

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.