[dependabot]

Bumps electron from 44.7.0 to 44.9.1.

Release notes

Sourced from electron's releases.

electron v44.9.1

Release Notes for v44.9.1

[!NOTE] This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

electron v44.9.0

Release Notes for v44.9.0

Features

• Added app shims on macOS to show windows under another app's Dock icon. #55073 (Also in 45)

Fixes

• Fixed link-opened windows not using the opener's session and webPreferences. #55048 (Also in 42, 43, 45)
• Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55046 (Also in 42, 43, 45)

electron v44.8.0

Release Notes for v44.8.0

Features

• Added support for Notification action buttons on Linux. #54890 (Also in 45)

Fixes

• Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. #54987
• Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54909 (Also in 42, 43, 45)
• Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #54960 (Also in 42, 43, 45)
• Fixed win.isFullScreen() being stale in fullscreen events on Windows. #55009 (Also in 45)

Other Changes

• Backported fixes from upstream Chromium and V8. #55034
• Updated Chromium to 152.0.7977.167. #54928
• Updated Node.js to v24.22.0. #55004

electron v44.7.2

Release Notes for v44.7.2

Fixes

• Fixed an issue where clicks posted to a background app were dropped on macOS. #54819 (Also in 45)
• Fixed interrupted macOS updates leaving a broken app behind. #54844 (Also in 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #54898

... (truncated)

Commits

• e02265b fix: apply the certificate SPKI blocklist to Node and add entries (44-x-y) (#...
• 0545d89 test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
• 0ec830f docs: fix code block line highlighting after docs reformats (#55102)
• 68ddc64 test: re-enable Node.js tests that now pass with BoringSSL (#55095)
• cb2bde2 build: stop overriding node GN declare_args defaults in patch (#55077)
• aa16ac2 build: update PGO profiles (#55090)
• fd148b9 feat: add app shims on macOS (#55073)
• fe5dd7e fix: avoid misaligned char16_t reads in crdtp string deserialization (#55061)
• c6874c5 fix: use the opener's session and webPreferences for windows opened from link...
• 790b4b8 ci: skip native builds when installing deps for type generation (#55066)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[styayur]

The unchanged dependency gate requires zero desktop/production findings. The current integration fixes Brotli/Electron/Undici/fast-uri, but npm still reports 15 moderate desktop and 4 moderate web-tool findings. No compatible complete patched upstream builder graph is currently published.

Created isolated Draft #54 with Brotli 1.2.1, Electron 44.9.1, builder 26.18.0, Undici 6.29.1 and 7.30.1 in their exact desktop paths, and fast-uri 3.1.9. 98 API tests and full pip audit pass. Current API/Windows packaged renderer/Android candidate/CodeQL CI pass. Web gate correctly fails. Inspected modern upstream asar/universal/EJS alternatives and the remaining electron-winstaller -> temp 0.9.4 -> rimraf 2.6.3 -> glob 7.2.3 -> function-export minimatch 3.1.5 chain; no callback-compatible upgrade exists within that chain. A blind minimatch 11 or rimraf 6 override changes the legacy callable APIs. No policy expansion or API shim/version masquerading was applied.

Keep #54 Draft and originals open. Recheck a released builder/winstaller/temp chain or an upstream advisory-range correction, then rerun the full zero-finding gate, real browser tests, Windows packaged renderer and Android candidate checks on the exact combined head. A different packaging toolchain would need its own full migration acceptance. Default-branch Brotli remains an unresolved risk until a valid merge; branch-only fixes are not reported as resolved.

Evidence: #54 https://github.com/styayur/calligra/actions/runs/41487847608 GHSA-g3hv-75wg-m249 github/advisory-database#10811 https://github.com/electron/asar/releases