Skip to content

build(deps-dev): bump electron from 44.4.3 to 44.10.0 #4456

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erickzhao merged 1 commit into from
Oct 28, 2026
Merged

build(deps-dev): bump electron from 44.4.3 to 44.10.0 #4456

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7631,16 +7631,16 @@ __metadata:
linkType: hard

"electron@npm:^44.4.3":
version: 44.4.3
resolution: "electron@npm:44.4.3"
version: 44.10.0
resolution: "electron@npm:44.10.0"
dependencies:
"@electron-internal/extract-zip": "npm:^1.0.1"
"@electron/get": "npm:^5.0.0"
"@types/node": "npm:^24.9.0"
bin:
electron: cli.js
install-electron: install.js
checksum: 10c0/6c26e1d9c4351ebee7a4e3ceff189a7112f408600ff21f37ac345e42fe643b366f60d44fce0b4ebf4c5bdd9b1923e98298340b1263036c9e29565bf9e713b6c9
checksum: 10c0/32fcc950d31206c9db555dfb80b34478cbf01505ddd22f899caf960ed3618b03fbd114c1f61d9837b1067f33e4760fc0de37ec9e6a8e363a250eb8c2ba9d78ba
Comment on lines +7634 to +7643

@claude claude Bot Oct 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) Merging would install Electron 44.10.0, not the 44.9.1 this PR says it bumps to and whose release notes reviewers read. The electron@ npm:^44.4.3 entry resolves to electron@ npm:44.10.0, with a new 10c0 checksum. No release notes cover that version, and nothing ties the checksum to it. Fix: make the lockfile and the PR agree before merging. Either let Dependabot regenerate the lockfile so it pins 44.9.1, or retitle the PR to 44.10.0 and check that version's notes and its checksum against the registry tarball.

Why this was flagged

yarn.lock:7634-7635 sets version: 44.10.0 and resolution: "electron@ npm:44.10.0". yarn.lock:7643 swaps in a new checksum. The PR title, the description and the compare link (v44.4.3...v44.9.1) all name 44.9.1 as the target, and the notes stop at v44.9.1. A yarn install --immutable after merge would fetch and run electron 44.10.0, including its install.js postinstall that downloads the Electron binary. Its changes and its integrity hash were never in the reviewed material. On the base branch, 44.4.3 is pinned with the old checksum. This kind of mismatch can come from a Dependabot rebase that was never retitled, or from a hand-edited lockfile. Neither can be ruled out from this checkout, and the 10c0 checksum only guards against cache corruption, not against an unreviewed version. package.json:55 keeps ^44.4.3, so the range does not stop either version.

Verification: Trigger: any yarn install after merge uses the lockfile. In the "electron@ npm:^44.4.3" entry the diff sets version: 44.10.0 and resolution: "electron@ npm:44.10.0" (yarn.lock:7634-7635) and swaps the checksum at yarn.lock:7643. The only commit in the range, b2438aa, is titled "build(deps-dev): bump electron from 44.4.3 to 44.9.1". If 44.10.0 is not published, installs fail.

languageName: node
linkType: hard

Expand Down
Loading