build(deps-dev): bump electron from 43.0.0 to 43.5.0

[dependabot]

Bumps electron from 43.0.0 to 43.5.0.

Release notes

Sourced from electron's releases.

electron v43.5.0

Release Notes for v43.5.0

Fixes

• Fixed DevTools device metrics overrides persisting indefinitely when a remote debugging client disconnected without clearing them. #52946 (Also in 42, 44)
• Fixed BrowserWindow.unmaximize() and restore() having no effect on Wayland when the window was maximized immediately after creation. #53125 (Also in 42, 44)
• Fixed Uncaught illegal access errors and possible renderer crashes after closing a same-process child window or removing an iframe with nodeIntegrationInSubFrames enabled. #53041 (Also in 42, 44)
• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53319 (Also in 42, 44, 45)
• Fixed webContents.executeJavaScriptInIsolatedWorld resolving with undefined when worldId was not an integer. #53237 (Also in 44)
• Fixed webContents.print() honoring printBackground, duplexMode, and printer default duplex settings. #53160 (Also in 42, 44)
• Fixed a crash on Linux when the D-Bus session bus disconnected while the app was running, such as at logout or when dbus is restarted. #53095 (Also in 42, 44)
• Fixed a crash on Windows when V8 posted a delayed worker task during shutdown. #53013 (Also in 42, 44)
• Fixed a crash on macOS when a WebAuthn Touch ID prompt was requested while no locale resources were loaded. #53195 (Also in 44)
• Fixed a crash on macOS when a notification's icon could not be attached; the notification is now shown without the icon. #53147 (Also in 42, 44)
• Fixed a crash when calling node:wasi functions in optimized code. #53265 (Also in 42, 44, 45)
• Fixed a crash when calling utilityProcess.postMessage() after the utility process had exited. #53301 (Also in 44, 45)
• Fixed a regression where a window created with a custom title can show an empty title after using back/forward navigation. #53219 (Also in 42, 44)
• Fixed a renderer crash when a page calls SpeechRecognition.available() or SpeechRecognition.install() with processLocally. #53015 (Also in 42, 44)
• Fixed an issue where pages loaded in a detached WebContentsView wouldn't see the correct window size. #53152 (Also in 42, 44)
• Fixed crashes in sharedTexture, service-worker ipcRenderer and utilityProcess.fork() caused by object lifetime bugs. #53278 (Also in 44, 45)
• Fixed crashes in the main process when a webRequest.onBeforeRequest listener redirected a CORS preflight request, and when calling net.fetch() with a webRequest-permission extension loaded. #53304 (Also in 44, 45)
• Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it. #53288 (Also in 44, 45)
• Fixed crashes when certain app event handlers call back into Electron synchronously. #53276 (Also in 44, 45)
• Fixed document title updates when using back/forward navigation using the same document without utilizing browserWindow.setTitle(). #53023 (Also in 42, 44)
• Fixed region-qualified --lang values such as de-DE loading no locale resources on macOS, which left localized strings empty and could crash WebAuthn Touch ID prompts. #53186 (Also in 42, 44)
• Fixed spellcheck not initializing on Linux when the dictionary was already cached from a previous run. #52717 (Also in 44)
• Fixed the GPU process being terminated in AppX/MSIX packaged apps on Windows when WebGPU fell back to SwiftShader. #53197 (Also in 42, 44)
• Fixed the primary instance being killed or receiving truncated arguments when a second instance passed a very long command line or large additionalData to app.requestSingleInstanceLock(). #53156 (Also in 42, 44)
• Fixed the tray icon not appearing on GNOME (and disappearing entirely on Wayland) since 43.4.1. #53215
• Fixed utility process crashes at exit on Windows 11 24H2 and later. #53092 (Also in 42, 44)
• Fixed windows native message boxes being dismissed by other applications using invalid button ID. #53155 (Also in 44)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, Skia and V8. #52969
• Backported fixes from upstream ANGLE, Chromium, Dawn, V8 and WebRTC. #53190
• Backported fixes from upstream Chromium and V8. #53055
• Fixed a 1-in-200 chance per renderer process on Windows of scripts on the first page load being compiled without their V8 code cache. #52943 (Also in 42, 44)
• Fixed a stall of tens of milliseconds while creating the first BrowserWindow on Linux.
  • Improved the performance of file lookups inside ASAR archives and of large files served from them to the renderer.
  • Improved the performance of calls through contextBridge-exposed APIs.
  • Reduced the main-thread cost of sending large values through ipcRenderer, ipcMain handlers and webContents.send. #53018 (Also in 42, 44)
• Improved application startup time on Linux by skipping GDK's OpenGL probe and loading FontConfig off the main thread during toolkit initialization. #53108 (Also in 44)
• Improved startup time of utilityProcess.fork(), child_process.fork() / ELECTRON_RUN_AS_NODE child processes and Node.js-enabled renderers. #53135 (Also in 42, 44)
• Linux arm64, Windows arm64 and macOS x64 builds now start the main process from the embedded Node.js startup snapshot like the other platforms, improving startup time. #52881 (Also in 42, 44)
• Page resources, fetch() calls and file:// loads in renderers no longer wait for the main process to be idle when no webRequest listeners or protocol interceptors are registered. #53142 (Also in 42, 44)
• Updated Chromium to 150.0.7871.250. #52787
• Updated Node.js to v24.19.0. #52635

electron v43.4.1

... (truncated)

Commits

• 87cd122 fix: serialize the target's values into the Node.js startup snapshot on cross...
• f835161 fix: crash in webRequest proxy for redirected CORS preflights and frameless f...
• 379a50e build: update PGO profiles (#53311)
• 42e9db9 chore: clean up forward declarations (#53295)
• fe02d1a fix: crash when calling utilityProcess.postMessage() after the process has ex...
• bb2194e fix: dangling WebContents/NativeWindow pointers in debugger, devtools, login,...
• 1002688 fix: object lifetime bugs in sharedTexture, service-worker ipcRenderer and ut...
• eb3528a fix: use-after-free when event handlers re-enter chooser, protocol stream and...
• 8a24b57 fix: spellcheck failing to initialize on Linux (#52717)
• fd98d68 fix: crash when V8 optimises a call to a node:wasi import (#53265)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	electron@​43.0.0 ⏵ 43.7.5	+1	+40

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• electron@43.7.5

View full report

[claude]

LGTM — routine devDependency version bump.

What was reviewed: the yarn.lock diff, confirming it only bumps the electron resolution from 43.0.0 to 43.7.5 and updates the matching checksum, with no other files, source code, or config changed.

Extended reasoning...

The diff touches only yarn.lock, bumping the pinned electron (devDependency) resolution from 43.0.0 to 43.7.5 and its integrity checksum; no source, build, or CI configuration changed. There is no security-sensitive surface exercised by this change itself (it doesn't modify code paths, only a lockfile pin), and the bump is a patch-level dependabot update with no outstanding review objections in the timeline. Given the mechanical, self-contained nature of a lockfile-only version bump, this qualifies for approval per the guidelines.

[dsanders11]

@SocketSecurity ignore npm/electron@43.7.5