Skip to content

fix: bump the development-dependencies group across 1 directory with 4 updates - #589

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-4408a1d075
Closed

fix: bump the development-dependencies group across 1 directory with 4 updates#589
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-4408a1d075

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 4 updates in the / directory: electron, electron-builder, vite and expo-doctor.

Updates electron from 44.9.1 to 45.0.0

Release notes

Sourced from electron's releases.

electron v45.0.0

Release Notes for v45.0.0

Stack Upgrades

Breaking Changes

  • Reduced sandboxed renderer startup work for preload scripts that do not use Buffer. #54048
    • Removed the events, timers and url modules and the Buffer, setImmediate and clearImmediate globals from sandboxed preload scripts; use a polyfill.
    • Made sandboxed renderers without a preload script start faster.
    • Made sandboxed preload scripts start faster; Electron no longer evaluates a JavaScript bundle of its own in sandboxed renderers unless webviewTag is enabled.
  • With nodeIntegrationInWorker: true, a Worker created from an <iframe> in the same process as the main frame used to get Node.js integration even though the iframe itself had none. Workers now only get Node.js integration when the frame that creates them has it: the main frame, or any frame when nodeIntegrationInSubFrames is enabled.
  • A chrome-extension:// document used to receive the window's preload script (and session preload scripts) wherever it was embedded. It now only does so when it is a top-level frame or is hosted inside the DevTools front-end (a devtools_page or panel); an extension frame embedded in an ordinary page is treated like any other subframe and follows nodeIntegrationInSubFrames.
  • The legacy chromeMediaSource: 'desktop' constraint now only accepts screen and window source ids from desktopCapturer.getSources. Passing a WebContents source id there now fails with an "Invalid state" error. To capture a WebContents, use chromeMediaSource: 'tab' with an id from webContents.getMediaSourceId(), or use ses.setDisplayMediaRequestHandler.
  • The experimental contentTracing.enableHeapProfiling() API has been removed. Chromium removed the memlog implementation that backed this API and replaced it with a Perfetto heap-profiling data source. Pass a nativeHeapProfiling option to contentTracing.startRecording() to enable heap profiling for the duration of a trace. Like all recordings, heap-enabled recordings use the Perfetto protobuf format.
  • Changed heap profiling in contentTracing recordings to now use a perfetto heap-profiling data source. #54863
  • Screen, window and tab capture requests are now reported to setPermissionRequestHandler as display-capture instead of media; a handler that allows only media must also allow display-capture to keep screen sharing working. #52824
  • Chromium has disabled document.requestStorageAccessFor by default ahead of its removal. The API can temporarily be restored with the enableBlinkFeatures web preference set to RequestStorageAccessFor. See Chromium's intent to remove discussion for more information.
  • fs.open, fs.openSync and fs.promises.open on a file inside an ASAR archive used to extract the file to a temporary copy and return a descriptor for that copy. They now return a descriptor that only identifies the entry to Node's fs module, which reads directly out of the archive with no temporary file (fs.read, fs.readv, fs.fstat, fs.readFile(fd), fs.createReadStream and the FileHandle methods). The descriptor itself is not backed by the file's contents: code that reads the raw descriptor (a native addon, child_process stdio, net.Socket({ fd }), http2stream.respondWithFile() / respondWithFD(), a FileHandle transferred to a worker, ...) fails with EBADF and is not supported. Opening a file inside an archive with a flag that allows writing (w, a, r+, ...) now fails with EACCES instead of silently writing to the temporary copy, and fs.fchmod, fs.fchown and fs.futimes on these descriptors fail with EACCES.
  • A window.open() child whose sandbox state differs from its opener's renderer process is now created in its own process with no opener relationship instead of silently sharing the opener's process; set sandbox: false in setWindowOpenHandler to keep sharing an unsandboxed opener's process. #52472
  • The synchronous safeStorage methods are deprecated and will be removed in Electron 46, following Chromium's removal of the synchronous OSCrypt backend they are built on. Use the asynchronous methods instead, which use the same per-platform key stores. Data encrypted with safeStorage.encryptString() can be decrypted with safeStorage.decryptStringAsync().
  • Added select-client-certificate event support for net.request and net.fetch; requests to servers requesting a client certificate no longer fail with ERR_SSL_CLIENT_AUTH_CERT_NEEDED, and applications can now select a certificate to present. #52162 (Also in 44)
  • Clipboard module is now aligned with the W3C Clipboard API. #51707 (Also in 44)
  • Removed 32-bit builds (Windows ia32 and Linux armv7l). Electron is now published only for 64-bit (x64 and arm64) platforms. #51816 (Also in 44)
  • Removed openAsHidden option from app.setLoginItemSettings(). #52351 (Also in 44)
    • Removed openAsHidden, wasOpenedAsHidden and restoreState fields from return value of app.getLoginItemSettings().
    • Fixed potential deadlock inside app.getLoginItemSettings() on macOS.
  • Updated the Linux support policy. #52429 (Also in 44)

See the Breaking Changes doc for more details about these changes.

Features

  • Added a badge property to MenuItem on macOS 14+ for showing a count or custom text badge next to a menu item's label. #50805 (Also in 43, 44)
  • Added a Save/Restore Window State API for cross-platform use. #51510 (Also in 44)
  • Added a Windows Error Reporting helper (electron_wer.dll, renamed to <app>_wer.dll alongside the executable) so crashReporter captures __fastfail and other crashes that bypass the in-process handler on Windows. #53851
  • Added app shims on macOS to show windows under another app's Dock icon. #55072 (Also in 44)
  • Added app.configureWebAuthn() API to enable iCloud Keychain passkey support on macOS. When enabled, navigator.credentials.create() and .get() present Apple's native passkey UI via ASAuthorizationController. #51563
  • Added available to process.getSystemMemoryInfo() on Linux, exposing proc/meminfo MemAvailable. #52299 (Also in 42, 43, 44)
  • Added disableWakeLocks option to WebPreferences. #52342
  • Added getIsolatedWorlds method and isolated-world-created event for webFrame to enable discovery of isolated worlds. #50633

... (truncated)

Commits
  • 54f961b chore: bump chromium to 156.0.8078.48 (45-x-y) (#55144)
  • a7f3579 chore: cherry-pick 29 changes from chromium, pdfium, skia and v8 (#55145)
  • 8807961 fix: cherry-pick 431b8be6a111 from chromium (#54912)
  • a6ce292 test: fix unload-IPC and protocol.handle 'is fast' flakes (#55132)
  • 0f79472 test: wait for the parent's ack before utility children exit (#55123)
  • 1d2f13b fix: apply the certificate SPKI blocklist to Node and add entries (45-x-y) (#...
  • 21ea802 docs: add UIPI note for setIgnoreMouseEvents forward option (#55112)
  • aa25341 test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
  • f17325a docs: update breaking-changes.md ahead of 45.0.0 release (#55121)
  • 528eb6f docs: fix code block line highlighting after docs reformats (#55105)
  • Additional commits viewable in compare view

Updates electron-builder from 26.15.3 to 26.18.0

Release notes

Sourced from electron-builder's releases.

electron-builder@26.18.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.17.0...electron-builder@26.18.0

electron-builder@26.17.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.1...electron-builder@26.17.0

electron-builder@26.16.1

What's Changed

... (truncated)

Changelog

Sourced from electron-builder's changelog.

26.18.0

Patch Changes

206d35d 3dc7c90 e703212 84f7b46 6202a27 fcd6897 160c3b4 1928adf c60987c a92517a a1e9db8 4123c27

  • app-builder-lib@26.18.0
  • dmg-builder@26.18.0

26.17.0

Patch Changes

bae1c8b 2a2dd22 07c8344 07c8344 613cd58 d4a4f50 41a027c 59f6364

  • app-builder-lib@26.17.0
  • dmg-builder@26.17.0

26.16.1

Patch Changes

b9b2e8a d6d4125 a4ec75f 5ae5a02 7c04b35

  • app-builder-lib@26.16.1
  • dmg-builder@26.16.1

... (truncated)

Commits

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)
Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)
Commits
  • 981f07f release: v8.3.5 (#23856)
  • 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
  • 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
  • 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
  • 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
  • 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
  • df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
  • a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
  • 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
  • 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
  • Additional commits viewable in compare view

Updates expo-doctor from 1.21.4 to 1.21.5

Changelog

Sourced from expo-doctor's changelog.

1.21.5

Patch Changes

  • Fix the "Check Expo config (app.json/ app.config.js) schema" check for ios.icon. A .icon directory was reported as "cannot access file", and a .png as "should point to a .icon directory". With the light/dark/tinted object form, the check reported no asset errors at all, not even a missing image or a missing file in another field such as android.icon. (#51635 by @​brentvatne)
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-26T10:09:24.795786Z 8262377 New commits
🔒 Security Review ✅ Completed 2026-10-26T10:12:03.222502Z 8262377 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 26, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 52d8d64562

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread pnpm-lock.yaml
Comment on lines 142 to +144
electron-builder:
specifier: ^26.15.3
version: 26.15.3(electron-builder-squirrel-windows@26.15.3)
version: 26.18.0(electron-builder-squirrel-windows@26.15.3)

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep electron-builder pinned to the release-tooling version

When a desktop packaging or release path runs after this lockfile is installed, it now resolves electron-builder 26.18.0, but the repository's release tooling explicitly requires both electron-builder and app-builder-lib to be exactly 26.15.3 and throws final_artifact_builder_version_mismatch otherwise (apps/desktop/scripts/cua-driver-signing/final-artifact-extractor.mjs:291 and scripts/release/nsis-extractor.mjs:23). This makes packaging/release fail before producing an artifact; either keep the lockfile at 26.15.3 or update the pinned tooling, templates, and version contracts together.

Useful? React with 👍 / 👎.

@dependabot dependabot Bot changed the title fix: bump the development-dependencies group with 4 updates fix: bump the development-dependencies group across 1 directory with 4 updates Oct 26, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-4408a1d075 branch from 52d8d64 to e79c5e8 Compare October 26, 2026 09:00
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 26, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e79c5e8f4d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread apps/desktop/package.json
"ajv": "8.20.0",
"ajv-formats": "3.0.1",
"electron": "44.9.1",
"electron": "45.0.0",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep Electron aligned with the reviewed native runtime

On packaged macOS arm64 builds, this changes Electron to 45.0.0 while native/office-local/reviewed-packaged-source-v1.json still records Electron 44.8.0. resolveOriginalPackagedOfficeResources() requires process.versions.electron to exactly equal that reviewed value, so the packaged office-native resource loader rejects the application and the native Office functionality cannot start until the review artifacts and associated runtime proof are regenerated together.

Useful? React with 👍 / 👎.

@gansx

gansx commented Oct 26, 2026

Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot
fix: bump the development-dependencies group across 1 directory with …
8262377 
…4 updates

Bumps the development-dependencies group with 4 updates in the / directory: [electron](https://github.com/electron/electron), [electron-builder](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-builder), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [expo-doctor](https://github.com/expo/expo/tree/HEAD/packages/expo-doctor).


Updates `electron` from 44.9.1 to 45.0.0
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v44.9.1...v45.0.0)

Updates `electron-builder` from 26.15.3 to 26.18.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/electron-builder@26.18.0/packages/electron-builder/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.18.0/packages/electron-builder)

Updates `vite` from 8.3.4 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

Updates `expo-doctor` from 1.21.4 to 1.21.5
- [Release notes](https://github.com/expo/expo/releases)
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo-doctor/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/expo-doctor@1.21.5/packages/expo-doctor)

---
updated-dependencies:
- dependency-name: electron
  dependency-version: 45.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: electron-builder
  dependency-version: 26.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: expo-doctor
  dependency-version: 1.21.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-4408a1d075 branch from e79c5e8 to 8262377 Compare October 26, 2026 10:05
@gansx gansx mentioned this pull request Oct 26, 2026
Merged
@gansx

gansx commented Oct 26, 2026

Copy link
Copy Markdown
Collaborator

Electron 45 大版本和 electron-builder 升级会打破已审核原生运行时记录，需要专门的升级任务评估。expo-doctor 补丁会随下批组包再来。

@gansx gansx closed this Oct 26, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development-dependencies-4408a1d075 branch October 26, 2026 15:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@tianxiaochannel-oss88 tianxiaochannel-oss88 Awaiting requested review from tianxiaochannel-oss88 tianxiaochannel-oss88 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gansx