[dependabot]

Bumps electron from 44.4.3 to 44.9.1.

Release notes

Sourced from electron's releases.

electron v44.9.1

Release Notes for v44.9.1

[!NOTE] This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

electron v44.9.0

Release Notes for v44.9.0

Features

• Added app shims on macOS to show windows under another app's Dock icon. #55073 (Also in 45)

Fixes

• Fixed link-opened windows not using the opener's session and webPreferences. #55048 (Also in 42, 43, 45)
• Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55046 (Also in 42, 43, 45)

electron v44.8.0

Release Notes for v44.8.0

Features

• Added support for Notification action buttons on Linux. #54890 (Also in 45)

Fixes

• Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. #54987
• Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54909 (Also in 42, 43, 45)
• Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #54960 (Also in 42, 43, 45)
• Fixed win.isFullScreen() being stale in fullscreen events on Windows. #55009 (Also in 45)

Other Changes

• Backported fixes from upstream Chromium and V8. #55034
• Updated Chromium to 152.0.7977.167. #54928
• Updated Node.js to v24.22.0. #55004

electron v44.7.2

Release Notes for v44.7.2

Fixes

• Fixed an issue where clicks posted to a background app were dropped on macOS. #54819 (Also in 45)
• Fixed interrupted macOS updates leaving a broken app behind. #54844 (Also in 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #54898

... (truncated)

Commits

• e02265b fix: apply the certificate SPKI blocklist to Node and add entries (44-x-y) (#...
• 0545d89 test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
• 0ec830f docs: fix code block line highlighting after docs reformats (#55102)
• 68ddc64 test: re-enable Node.js tests that now pass with BoringSSL (#55095)
• cb2bde2 build: stop overriding node GN declare_args defaults in patch (#55077)
• aa16ac2 build: update PGO profiles (#55090)
• fd148b9 feat: add app shims on macOS (#55073)
• fe5dd7e fix: avoid misaligned char16_t reads in crdtp string deserialization (#55061)
• c6874c5 fix: use the opener's session and webPreferences for windows opened from link...
• 790b4b8 ci: skip native builds when installing deps for type generation (#55066)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[claude]

🟡 (optional) Merging would install Electron 44.10.0, not the 44.9.1 this PR says it bumps to and whose release notes reviewers read. The electron@ npm:^44.4.3 entry resolves to electron@ npm:44.10.0, with a new 10c0 checksum. No release notes cover that version, and nothing ties the checksum to it. Fix: make the lockfile and the PR agree before merging. Either let Dependabot regenerate the lockfile so it pins 44.9.1, or retitle the PR to 44.10.0 and check that version's notes and its checksum against the registry tarball.

Why this was flagged

yarn.lock:7634-7635 sets version: 44.10.0 and resolution: "electron@ npm:44.10.0". yarn.lock:7643 swaps in a new checksum. The PR title, the description and the compare link (v44.4.3...v44.9.1) all name 44.9.1 as the target, and the notes stop at v44.9.1. A yarn install --immutable after merge would fetch and run electron 44.10.0, including its install.js postinstall that downloads the Electron binary. Its changes and its integrity hash were never in the reviewed material. On the base branch, 44.4.3 is pinned with the old checksum. This kind of mismatch can come from a Dependabot rebase that was never retitled, or from a hand-edited lockfile. Neither can be ruled out from this checkout, and the 10c0 checksum only guards against cache corruption, not against an unreviewed version. package.json:55 keeps ^44.4.3, so the range does not stop either version.

Verification: Trigger: any yarn install after merge uses the lockfile. In the "electron@ npm:^44.4.3" entry the diff sets version: 44.10.0 and resolution: "electron@ npm:44.10.0" (yarn.lock:7634-7635) and swaps the checksum at yarn.lock:7643. The only commit in the range, b2438aa, is titled "build(deps-dev): bump electron from 44.4.3 to 44.9.1". If 44.10.0 is not published, installs fail.