Bump electron from 40.0.0 to 43.1.1

[dependabot]

Bumps electron from 40.0.0 to 43.1.1.

Release notes

Sourced from electron's releases.

electron v43.1.1

Release Notes for v43.1.1

Fixes

• Fixed a browser-process crash (ValidateIntegrityOrDie) and spurious preload ENOENT errors when an app's app.asar is replaced on disk (e.g. by an updater or MDM software) while the app is running. #52293 (Also in 42, 44)

Other Changes

• Updated Chromium to 150.0.7871.114. #52297

electron v43.1.0

Release Notes for v43.1.0

Fixes

• Fixed crash triggered by replacing an open application menu. #52276 (Also in 41, 42, 44)

Other Changes

• Updated Chromium to 150.0.7871.47. #52235
• Updated Node.js to v24.18.0. #52106

electron v43.0.0

Release Notes for v43.0.0

Stack Upgrades

• Chromium 150.0.7871.46
  • New in 150
  • New in 149
• Node v24.147.0
  • Node 24.17.0 blog post
• V8 15.0

Breaking Changes

• File downloads will open by default in the user's Downloads folder (or Home directory if Downloads doesn't exist). #49868
• Fix: If a nativeImage was passed an image with a color profile, its pixel values will now be normalized to SRGB. This ensures that two visually identical images after color space application will receive similar pixel values when converted to a nativeImage. #51565
• On Linux, frameless windows now have rounded corners by default, just like on macOS and Windows. Rounded corners can be disabled on all platforms by setting roundedCorners: false on the window. #52111
• Removed showHiddenFiles support from the dialog API on Linux. #51880

Features

Additions

• Added Clone method to WebContents. #49959
• Added JS stack trace to crash reports on renderer OOM. #50043 (Also in 42)
• Added Linux support for app.getApplicationInfoForProtocol(). #51297 (Also in 42)
• Added Notification.remove(), removeAll(), and removeGroup() static methods for macOS. #51690 (Also in 42)
• Added Notification.getHistory() for macOS, allowing developers to restore all delivered notifications still present in Notification Center. #50325 (Also in 42)
• Added accessibilityLabel property to MenuItem constructor options and properties for defining screen-reader-friendly labels. #50240
• Added allowExtensions privilege to protocol.registerSchemesAsPrivileged() to enable Chrome extensions on custom protocols. #49951 (Also in 40, 41, 42)
• Added app.configureWebAuthn() to enable the Touch ID platform authenticator for WebAuthn on macOS, and a select-webauthn-account session event for choosing between multiple discoverable credentials. #51255 (Also in 41, 42)

... (truncated)

Commits

• 49dacb7 chore: bump chromium to 150.0.7871.114 (43-x-y) (#52297)
• 3ece4d2 ci: fail gha-done when checkout jobs fail (#52250)
• ec31a73 fix: read asar contents through the archive's retained file handle (#52293)
• 155287d docs(mas): update security scoped bookmarks link (#52281)
• a8bb2f1 chore: bump chromium to 150.0.7871.101 (43-x-y) (#52285)
• b5c102b fix: restore SelfKeepAlive in Menu (#52276)
• 295cdff build: replace chalk with node:util styleText (#52258)
• c4baa54 chore: bump chromium to 150.0.7871.47 (43-x-y) (#52235)
• e4a5c5a chore: bump node to v24.18.0 (43-x-y) (#52106)
• 74daf45 build: update PGO profiles (#52201)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Major Electron/Chromium/Node runtime jump affects packaging, native addons, and platform behavior; the unchanged rebuild:electron target vs 43.1.1 increases risk of ABI mismatch until aligned and tested.

Overview
Bumps the desktop app’s Electron dev dependency from 40.0.0 to 43.1.1 and refreshes package-lock.json (app version 0.0.70, resolved Electron 43.1.1).

The lockfile reflects Electron’s newer install stack: @electron/get v5, @electron-internal/extract-zip, optional undici, and a Node ≥22.12.0 engine requirement for the electron package. Several transitive packages tied to the old download/extract path (e.g. global-agent, standalone extract-zip) drop out of the tree.

Review note: package.json still sets rebuild:electron’s npm_config_target to 40.0.0 while Electron is now 43.x—native rebuilds (e.g. better-sqlite3) may need that target updated and a full npm run rebuild:electron / e2e pass on macOS builds.

^{Reviewed by Cursor Bugbot for commit bca7142. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit bca7142. Configure here.}

[cursor]

SQLite rebuild targets wrong Electron

High Severity

The electron devDependency is 43.x, but rebuild:electron still targets Electron 40.0.0. This builds better-sqlite3 for Electron 40 while the app runs Electron 43, causing an ABI mismatch that prevents the native module from loading, for example in stills-queue or storage.js.

 

^{Reviewed by Cursor Bugbot for commit bca7142. Configure here.}

[dependabot]

Superseded by #102.