fix(desktop): bump Electron to 40.9.3 to resolve Dependabot alerts

Merged
AV
3mo ago
+3-3

Summary

  • Bumps electron from 40.8.5 to 40.9.3 in apps/desktop/package.json
  • Resolves all 9 open Dependabot alerts on this repo (#263–#271), including 2 high-severity issues:
    • #270 (high): custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
    • #267 (high): context isolation bypass via Function.prototype.bind hijack
    • #263, #265, #268, #269, #271 (medium)
    • #264, #266 (low)
  • bun install re-ran @electron/rebuild for native deps (better-sqlite3, node-pty, @parcel/watcher, etc.) against 40.9.3 — all rebuilt cleanly.

Test plan

  • bun install — native modules rebuilt successfully against Electron 40.9.3
  • bun run lint:fix — clean, no issues
  • bun run typecheck (apps/desktop) — clean
  • Manual smoke test of the desktop app on a dev build (not run in this session)

Summary by cubic

Upgrade electron from 40.8.5 to 40.9.3 in apps/desktop to patch security vulnerabilities. Resolves 9 Dependabot alerts (#263–#271), including high-severity custom-protocol CORS bypass and context isolation bypass.