[dependabot]

Bumps electron from 43.5.0 to 43.7.0.

Release notes

Sourced from electron's releases.

electron v43.7.0

Release Notes for v43.7.0

Features

• Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #53704 (Also in 44, 45)
• Added the ELECTRON_DEBUG_DRAGGABLE_REGIONS environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. #53633 (Also in 44, 45)

Fixes

• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53694 (Also in 42, 44, 45)
• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53689 (Also in 42, 44, 45)
• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53496 (Also in 42, 44, 45)
• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53510 (Also in 42, 44, 45)
• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53584 (Also in 42, 44, 45)
• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53540 (Also in 42, 44, 45)
• Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #53750 (Also in 44, 45)
• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53671 (Also in 42, 44, 45)
• Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. #53631 (Also in 44, 45)
• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53726 (Also in 42, 44, 45)
• <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53718 (Also in 42, 44, 45)
• getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53707 (Also in 42, 44, 45)
• nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53712 (Also in 42, 44, 45)
• openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53698 (Also in 42, 44, 45)
• pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53701 (Also in 42, 44, 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. #53766
• Fixed a renderer crash that could occur when printing from an iframe. #53761 (Also in 44, 45)
• Fixed the app becoming unresponsive when a page has a very large number of app-region draggable elements. #53632 (Also in 44, 45)
• Updated Node.js to v24.21.0. #53777

electron v43.6.0

Release Notes for v43.6.0

Features

• Added a badge property to MenuItem on macOS 14+ for showing a count or custom text badge next to a menu item's label. #53045 (Also in 44)
• Added webContents.caretBrowsingEnabled for toggling caret browsing in a WebContents. #53034 (Also in 44)

Fixes

• Fixed VoiceOver Braille displays showing the wrong line in multi-line text fields on macOS: AXLineForIndex and AXRangeForLine now return the line containing the caret. #53428
• Fixed a pending read on a net.request chunked upload stream inside a protocol handler never settling when the request failed or was aborted. #53374 (Also in 44, 45)
• Fixed a potential crash when using menu.popup with a frame from an offscreen rendered window. #53432 (Also in 44)
• Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. #53456 (Also in 44, 45)
• Fixed application crash after a large number of IPC messages from renderers. #53420 (Also in 42, 44, 45)
• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53393 (Also in 42, 44, 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53485
• Backported fixes from upstream Chromium, Dawn and V8. #53396

... (truncated)

Commits

• c440db5 docs: add REVIEW.md and treat it as a docs-only change in CI (#53804)
• 206e0d7 feat: identify the requesting frame and initiator on network, auth and downlo...
• 9678a7f build: remove git add from lint-staged config (#53795)
• 3687f12 chore: cherry-pick a871bdb05932 from angle (#53772)
• 4315b8a chore: cherry-pick f0d76fefb52c from chromium (#53761)
• 39c5ed0 chore: bump node to v24.21.0 (43-x-y) (#53777)
• 0c64245 docs: hand-port Chrome security picks in-PR instead of dropping them (backpor...
• f480403 test: use badge fields in ts-smoke so spec type-check passes (43-x-y) (#53788)
• afe4fb7 chore: cherry-pick 159482bbcaf4 from chromium (#53771)
• e0dad4a chore: cherry-pick 31 changes from angle, chromium, libyuv, pdfium and v8 (#5...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.