chore(deps): upgrade Electron to v42 and devtools-installer to v4

[cwillisf]

Proposed Changes

• Upgrade electron from 25.9.8 to 42.0.1.
• Upgrade electron-devtools-installer from 3.2.1 to 4.0.0.
• Adjust the dev-only import('electron-devtools-installer') destructure and success log for v4's API changes.

Reason for Changes

renovate/npm-electron-vulnerability (#519) has been sitting open targeting v35. Two real CVEs are unpatched on the v25 we currently ship: CVE-2024-46993 (heap overflow in nativeImage.createFromPath/Buffer, patched in v28.3.2 / v29.3.3 / v30.0.3) and CVE-2025-55305 (ASAR integrity validation, patched later). Going to current (v42) instead of v35 picks up additional security fixes for free and avoids stacking another Electron PR a few months from now.

scratch-desktop's main-process API surface is small, and the two spots that would have broken under any post-v25 Electron — app.allowRendererProcessReuse (setter removed in v28) and webContents.on('new-window', ...) (event removed in v22) — already landed cleanup in #610, so the only code change here is for electron-devtools-installer's v3→v4 API shifts in the dev-only DevTools install path:

• v4 publishes installExtension as a named export. v3 published it as the default export. Destructure the named export.
• v4's installExtension resolves with an Electron Extension object ({id, name, path, version, ...}). v3 resolved with the extension's string name. The success log now reads .name off the returned object so it prints something human-readable instead of [object Object].

Verification

• npm run test:lint passes with 0 errors locally on node 24.15.0.
• npm run compile builds both renderer and main bundles successfully.
• npm start smoke-tested locally on macOS: editor launches, both React DevTools and Redux DevTools install and appear in the detached DevTools window, success log now prints the extension name correctly.

Two upstream-noise items observed during the smoke test that are not actionable here:

• (electron) 'session.getAllExtensions' is deprecated… use 'session.extensions.getAllExtensions'
• (electron) 'session.loadExtension' is deprecated… use 'session.extensions.loadExtension'

Both originate inside electron-devtools-installer@4's own implementation (which still calls the older session.* shape Electron has since moved). v4.0.0 is the latest published version; we'd track this as an upstream issue.

Closes / supersedes

• Should supersede chore(deps): update dependency electron to v35 [security] - autoclosed #519 (the v35 security renovate PR).

Follow-up still on the list

electron-store@11 is the remaining piece of the Electron-family refresh — held back to its own PR because v11 is ESM-only and may need an import() adjustment we don't want to tangle with this version bump.

[Copilot]

Pull request overview

This PR upgrades Scratch Desktop’s Electron runtime to a currently supported major version to pick up security fixes, and updates the dev-only DevTools installer integration to match the new electron-devtools-installer API/module shape.

Changes:

• Bump electron from 25.9.8 to 42.0.1.
• Bump electron-devtools-installer from 3.2.1 to 4.0.0.
• Update the dev-only dynamic import('electron-devtools-installer') destructuring and logging to accommodate the new return type from installExtension.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/main/index.js	Updates dev-only DevTools installer import/destructure and installed-extension logging for v4 behavior.
package.json	Upgrades Electron and electron-devtools-installer versions.
package-lock.json	Locks the upgraded Electron + installer versions and their updated transitive dependency graph.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.