[dependabot]

Bumps the development-dependencies group with 3 updates in the / directory: @electron/packager, electron and playwright-core.

Updates @electron/packager from 20.1.1 to 20.3.0

Release notes

Sourced from @​electron/packager's releases.

v20.3.0

20.3.0 (2026-08-11)

Features

• asar integrity digest (#1890) (8c5cc94), closes electron/fuses#96

v20.2.1

20.2.1 (2026-08-10)

Bug Fixes

• declare osxSign.continueOnError in PackagerOsxSignOptions (#1951) (2f8df6d), closes #1579

v20.2.0

20.2.0 (2026-08-06)

Bug Fixes

• set mtimes to extraction time after extracting Electron zips (#1940) (e0e697f)

Features

• add sanitizePackageJson option to strip dev-only package.json fields (#1931) (dd4f276), closes #1184

Commits

• 8c5cc94 feat: asar integrity digest (#1890)
• 2f8df6d fix: declare osxSign.continueOnError in PackagerOsxSignOptions (#1951)
• e0e697f fix: set mtimes to extraction time after extracting Electron zips (#1940)
• dd4f276 feat: add sanitizePackageJson option to strip dev-only package.json fields (#...
• ce1c69a chore: bump ip-address from 10.1.1 to 10.3.1 (#1948)
• 147959b chore: bump postcss from 8.5.19 to 8.5.24 (#1950)
• a9c4063 chore: bump undici from 7.28.0 to 7.29.0 (#1949)
• See full diff in compare view

Updates electron from 43.3.0 to 44.2.0

Release notes

Sourced from electron's releases.

electron v44.2.0

Release Notes for v44.2.0

Fixes

• Fixed a pending read on a net.request chunked upload stream inside a protocol handler never settling when the request failed or was aborted. #53373 (Also in 43, 45)
• Fixed a potential crash when using menu.popup with a frame from an offscreen rendered window. #53362 (Also in 43)
• Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. #53455 (Also in 43, 45)
• Fixed application crash after a large number of IPC messages from renderers. #53417 (Also in 42, 43, 45)
• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53392 (Also in 42, 43, 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53479
• Improved throughput of responses that protocol.handle handlers return straight from net.fetch. #53378
• Updated Chromium to 152.0.7977.76. #53382
• Updated Node.js to v24.20.0. #53250

electron v44.1.1

Release Notes for v44.1.1

Fixes

• Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get. #53354 (Also in 42, 43, 45)
• Fixed a renderer crash when an array with a throwing property getter is passed across contextBridge, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps. #53331 (Also in 42, 43)
• Fixed an intermittent crash at startup on Linux caused by a race between Pango and the main thread initializing fontconfig. #53340 (Also in 43, 45)
• Fixed an issue where an exception thrown by a property getter on an object passed through contextBridge was swallowed instead of being thrown back to the caller. #53335 (Also in 43, 45)
• Fixed main process crashes when navigating to http://accessibility/ or http://devtools/, when an extension background page used navigator.mediaDevices, and when calling SerialPort.forget() for a disconnected device. #53333 (Also in 43, 45)
• Fixed the PDF viewer failing to save an edited PDF with NotAllowedError: Third party iframes are not allowed to show a file picker. #53328 (Also in 43, 45)

electron v44.1.0

Release Notes for v44.1.0

Fixes

• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53320 (Also in 42, 43, 45)
• Fixed webContents.executeJavaScriptInIsolatedWorld resolving with undefined when worldId was not an integer. #53238 (Also in 43)
• Fixed webContents.print() honoring printBackground, duplexMode, and printer default duplex settings. #53159 (Also in 42, 43)
• Fixed a crash on Windows when V8 posted a delayed worker task during shutdown. #53201 (Also in 42, 43)
• Fixed a crash on macOS when a WebAuthn Touch ID prompt was requested while no locale resources were loaded. #53194 (Also in 43)
• Fixed a crash on macOS when a notification's icon could not be attached; the notification is now shown without the icon. #53146 (Also in 42, 43)
• Fixed a crash when calling node:wasi functions in optimized code. #53268 (Also in 42, 43, 45)
• Fixed a crash when calling utilityProcess.postMessage() after the utility process had exited. #53300 (Also in 43, 45)
• Fixed a regression where a window created with a custom title can show an empty title after using back/forward navigation. #53218 (Also in 42, 43)
• Fixed an issue where pages loaded in a detached WebContentsView wouldn't see the correct window size. #53153 (Also in 42, 43)
• Fixed crashes in sharedTexture, service-worker ipcRenderer and utilityProcess.fork() caused by object lifetime bugs. #53279 (Also in 43, 45)
• Fixed crashes in the main process when a webRequest.onBeforeRequest listener redirected a CORS preflight request, and when calling net.fetch() with a webRequest-permission extension loaded. #53303 (Also in 43, 45)
• Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it. #53287 (Also in 43, 45)
• Fixed crashes when certain app event handlers call back into Electron synchronously. #53275 (Also in 43, 45)
• Fixed region-qualified --lang values such as de-DE loading no locale resources on macOS, which left localized strings empty and could crash WebAuthn Touch ID prompts. #53188 (Also in 42, 43)
• Fixed the GPU process being terminated in AppX/MSIX packaged apps on Windows when WebGPU fell back to SwiftShader. #53198 (Also in 42, 43)

... (truncated)

Commits

• aa650d7 ci: bump build-tools to pick up the .patches merge driver (#53483)
• aad3008 chore: cherry-pick 10 changes from angle, chromium, skia and v8 (#53479)
• 17a16f1 build: pin the siso revision in build/siso_revision instead of fetching Chrom...
• fef76a6 ci: retry the depot_tools clones and the angle fetch on transient network err...
• e255208 ci: use a download-artifact fork that doesn't parse the event file at import ...
• 81fe24e perf: relay untouched net.fetch responses from protocol.handle without pumpin...
• 5a7a11d fix: backport Node.js cleanup hook fixes for node::ObjectWrap addons (44-x-y)...
• 3e1fc8b fix: terminate immediately on asar integrity violation (#53455)
• 5abd26a test: run the Squirrel.Mac updater specs concurrently off a signed template (...
• 0faf4b9 ci: don't fail the macOS build when Homebrew can't reach its API during clean...
• Additional commits viewable in compare view

Updates playwright-core from 1.62.0 to 1.63.0

Release notes

Sourced from playwright-core's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view