fix(security): update Electron to patched release (CVE-2026-70608)

Merged
AV
3mo ago
+25-23

Summary

  • Resolves Dependabot alert #273: GHSA-9f4c-93c8-jc8g / CVE-2026-70608 (high severity) — sandboxed iframes could bypass the allow-popups restriction via Electron's OpenURL navigation path in setWindowOpenHandler.
  • Bumps electron 40.9.3 → 41.10.3 in apps/desktop — Electron does not backport security patches to the 40.x line; 41.10.3 is the first patched release.
  • Bumps better-sqlite3 12.6.2 → 12.11.1 in apps/desktop, packages/host-service, and packages/chat-runtime, since its native bindings called a V8 PropertyCallbackInfo::This() API that Electron 41's newer bundled V8 removed (fixed upstream in better-sqlite3@12.8.0 via HolderV2()).
  • Confirmed the app's own setWindowOpenHandler implementations (apps/desktop/src/lib/electron-app/factories/windows/create.ts, apps/desktop/src/main/lib/browser/browser-manager.ts) already unconditionally deny window creation — the pattern the advisory calls out as unaffected even pre-patch — so this is a supply-chain version fix, not a behavioral gap.

Test plan

  • bun install — native modules (better-sqlite3, node-pty, @parcel/watcher, etc.) rebuild cleanly against Electron 41.10.3
  • bun run typecheck (apps/desktop) — passes with 0 errors
  • bun run lint:fix — clean, no fixes needed
  • bun test (apps/desktop) — 2532 pass, 0 fail

https://claude.ai/code/session_019C4QXK3fZBBKtxJud6mNkB

Summary by cubic

Update electron to 41.10.3 to patch CVE-2026-70608 (GHSA-9f4c-93c8-jc8g) that allowed sandboxed iframes to bypass allow-popups via the OpenURL path. Our setWindowOpenHandler already denies new windows, but this ensures we ship the patched runtime.

  • Dependencies
    • electron: 40.9.3 → 41.10.3 in apps/desktop
    • better-sqlite3: 12.6.2 → 12.11.1 in apps/desktop, packages/host-service, packages/chat-runtime (required for Electron 41’s V8 changes)

Summary by CodeRabbit

  • Chores
    • Updated the desktop app’s underlying runtime and database components.
    • Improved compatibility and stability through routine platform component updates.