chore(deps-dev): bump the desktop-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #60 · ezzy1630/Terminus

dependabot · 2026-09-07T14:40:55Z

Bumps the desktop-dependencies group with 4 updates in the /apps/desktop directory: electron, typescript, undici and vitest.

Updates electron from 43.7.3 to 44.4.2

Release notes

Sourced from electron's releases.

electron v44.4.2

Release Notes for v44.4.2

Fixes

Fixed a potential UAF when a select-usb-device handler destroys the requesting webContents. #54009 (Also in 43, 45)

Other Changes

Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53985

Updated Chromium to 152.0.7977.130. #53778

electron v44.4.1

Release Notes for v44.4.1

Fixes

Fixed default protocol client APIs falsely returning true on Windows. #53959 (Also in 43, 45)

Fixed several object lifetime issues in Debugger, Menu, Tray, Notification, globalShortcut, utilityProcess, ServiceWorkerMain, WebFrameMain, webFrame, sharedTexture, systemPreferences, netLog, MessagePortMain, net.request and shell.openPath(). #53968 (Also in 45)

electron v44.4.0

Release Notes for v44.4.0

Features

Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #53703 (Also in 43, 45)

Fixes

Added validation to protocol.registerSchemesAsPrivileged() to reject protocol names that do not conform to RFC 3986 URI scheme grammar. #53743 (Also in 45)

Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported chrome.webstorePrivate API. #53776 (Also in 45)

Fixed a main-process crash when an app called loadURL() again right after a load failed because the renderer process exited before the page committed. #53943 (Also in 43, 45)

Fixed a memory leak on Windows when app.getPreferredSystemLanguages() was called. #53868 (Also in 43, 45)

Fixed a potential UAF in app.getPreferredSystemLanguages() on Windows. #53865 (Also in 43, 45)

Fixed a renderer crash that could occur when printing from an iframe. #53762 (Also in 43, 45)

Fixed a renderer crash when an iframe was removed right after loading with nodeIntegrationInSubFrames enabled and sandbox disabled, e.g. on pages that embed Meta Pixel. #53885 (Also in 42, 43, 45)

Fixed a Windows renderer crash when no default locale could be determined. #53947

Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #53749 (Also in 43, 45)

Fixed helper executables on macOS starting a second app instance when launched without a process type, for example through child_process.fork() with the runAsNode fuse disabled; fork() now throws in that configuration. #53840 (Also in 45)

Fixed V8 code caching for https scripts loaded by file:// and custom-scheme pages. #53745 (Also in 45)

Fixed webContents emitting unresponsive right after the system wakes from sleep on Windows, and emitting responsive when a hung window was hidden rather than when it recovered. #53764 (Also in 45)

Fixed webContents.capturePage() on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's offscreen.deviceScaleFactor. #53816 (Also in 43, 45)

Fixed Window Controls Overlay CSS environment variables and navigator.windowControlsOverlay not being populated for WebContentsViews in a BaseWindow. #53812 (Also in 45)

Other Changes

Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. #53769

Updated Node.js to v24.21.0. #53779

electron v44.3.0

... (truncated)

Commits

34a45a2 build: update PGO profiles (#54031)
5d2b2fe chore: bump chromium to 152.0.7977.130 (44-x-y) (#53778)
5e32952 build: fix native addon cross-compilation (#54018)
566efa2 fix: don't crash if guest destroyed in select-usb-device handler (#54009)
b45d4f1 build: allow empty .patches files (#54004)
adf6470 ci: ignore transient curl error in audit (#54002)
8ec91c6 docs: search gitiles history before treating a Chrome fix CL as restricted (#...
91d5485 chore: cherry-pick 18 changes from angle, chromium, skia and v8 (#53985)
09d1a65 fix: cppgc object lifetime follow-ups (44-x-y) (#53968)
8f9454a test: gate specs on testing bindings (#53964)
Additional commits viewable in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

npm

Commits

1e4744d Merge branch 'main' into ts7-release
a5a219cmicrosoft/typescript-go#4558
ecfe30d Update status localization
5de25b5 Hide executable name in TypeScript status
d7ce74a Show bundled TypeScript version for packaged servers
29be66a Correct TS 7 release version to 7.0.2
ed2bd1b Merge branch 'main' into ts7-release
8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
d4eaca5microsoft/typescript-go#4549
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates undici from 7.29.1 to 8.10.2

Release notes

Sourced from undici's releases.

v8.10.2

⚠️ Security fixes

High severity

GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.

GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.

GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.

GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.

GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.

GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.

GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.

GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.

GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

build(deps-dev): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in nodejs/undici#5653

build(deps-dev): bump jest from 30.4.2 to 30.5.0 by @dependabot[bot] in nodejs/undici#5750

build(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.9 by @dependabot[bot] in nodejs/undici#5752

build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.9 by @dependabot[bot] in nodejs/undici#5754

test(h2): cover stream reset with NGHTTP2_INTERNAL_ERROR by @zeexzeex in nodejs/undici#5725

fix(retry): reject invalid resumed responses by @mcollina in nodejs/undici#5724

test: make stale-while-revalidate cache update test deterministic by @mcollina in nodejs/undici#5722

fix: avoid unbounded recursion in Set-Cookie attribute parser by @mcollina in nodejs/undici#5757

fix: honor SOCKS5 connection timeout by @mcollina in nodejs/undici#5733

fix(eventsource): validate Last-Event-ID on reconnect by @mcollina in nodejs/undici#5746

fix: avoid duplicate release attempts by @mcollina in nodejs/undici#5745

fix(cache): refetch when 304 adds vary fields by @mcollina in nodejs/undici#5732

types: expose PendingInterceptor and PendingInterceptorsFormatter on the MockAgent namespace by @RaphaelFakhri in nodejs/undici#5721

ci(codeql): align CodeQL action versions to v4.37.9 by @mcollina in nodejs/undici#5759

build(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 by @dependabot[bot] in nodejs/undici#5760

fix(proxy-agent): guard Proxy-Authorization in iterable header containers by @mcollina in nodejs/undici#5758

docs: name the parameters these two blocks describe by @darkdi in nodejs/undici#5735

fix(websocket): fail the connection on a non-200 h2 extended CONNECT response by @kjsik11 in nodejs/undici#5751

test(node-fetch): re-enable the set-cookie header combining test by @pacocartones in nodejs/undici#5730

fix(retry): forward rawHeaders writes through RetryController by @official-burak in nodejs/undici#5727

fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs by @kjsik11 in nodejs/undici#5738

New Contributors

@darkdi made their first contribution in nodejs/undici#5735

@kjsik11 made their first contribution in nodejs/undici#5751

... (truncated)

Commits

5e541e0 Bumped v8.10.2 (#5771)
eb04cc3 fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs (#5738)
e905b5b fix(retry): settle exposed body on terminal failure
0160a71 fix(retry): validate resumed response framing
66e1281 fix(websocket): reject unrequested subprotocols
7aac7f1 fix(decompress): limit decompressed response size
cb75bbb fix(cache): do not cache Set-Cookie in shared caches
6d58312 fix(interceptor/dump): abort oversized chunked responses
8f5868f fix: preserve BalancedPool connection options
2be07bf fix(cache): reject unsafe method response caching
Additional commits viewable in compare view

Updates vitest from 4.1.11 to 5.0.1

Release notes

Sourced from vitest's releases.

v5.0.1

   🚀 Features

ui:

Move trace attempts selector to viewer header - by @hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11189 (5dc4b)

Add focused trace view layout mode - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11190 (376dc)

   🐞 Bug Fixes

Exit 1 when vitest list fails collection - by @hamed-bavar in vitest-dev/vitest#11145 and vitest-dev/vitest#11146 (6108b)

Keep parse error details in static collection - by @hamed-bavar in vitest-dev/vitest#11150 and vitest-dev/vitest#11151 (7c818)

Avoid recursive prototype in automocking - by @sheremet-va in vitest-dev/vitest#11195 (99fc5)

Prevent false Vitest import resolution - by @sheremet-va in vitest-dev/vitest#11196 (b426c)

Keep metadata file when clearing the cache - by @sheremet-va in vitest-dev/vitest#11199 (73614)

Correct typos in error message and comments - by @shinji00222 and Shinji in vitest-dev/vitest#11187 (115c3)

Resolve ResolvedConfig exactOptionalPropertyTypes errors - by @LukeAbby in vitest-dev/vitest#11175 (498fb)

Share the server on self-referencing extends - by @sheremet-va in vitest-dev/vitest#11034 (23dda)

Warn when deprecated deps.optimizer.web is used - by @im10furry in vitest-dev/vitest#11214 (2ce29)

browser:

Avoid double quotes in config.define - by @sheremet-va in vitest-dev/vitest#11198 (972e2)

doctor:

Measure vm pools for custom environments - by @sheremet-va in vitest-dev/vitest#11212 (91ab1)

expect:

Correct return value in toMatchAriaSnapshot - by @sheremet-va in vitest-dev/vitest#11208 (c119b)

fakeTimers:

Force queueMicrotask and nextTick in toNotFake - by @kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @hi-ogawa in vitest-dev/vitest#11261 (a47d7)

snapshot:

Report obsolete keys next to skipped tests - by @hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11157 and vitest-dev/vitest#11158 (17e2b)

types:

Make public declarations self-contained - by @ZoeySigel in vitest-dev/vitest#11141 (45546)

ui:

Fix collapse/expand suite with file name search - by @hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11260 (0a712)

Fix explorer file summary count - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11125 (05982)

utils:

Fix deepMerge to handle prototype - by @hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11215 (4944c)

    View changes on GitHub

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

Replace loupe.inspect with pretty-format - by @hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)

Remove quotes from string values in test.for/each title $ variable (take 2) - by @hi-ogawa in vitest-dev/vitest#10170 (04d37)

Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/ - by @MdSadiqMd in vitest-dev/vitest#10186 (1ba73)

Remove sequential test/suite options in favor of concurrent - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)

Represent locator as an object instead of a string - by @sheremet-va in vitest-dev/vitest#10212 (80f07)

Inline expect package - by @sheremet-va in vitest-dev/vitest#10221 (ad162)

Remove deprecated entry points - by @sheremet-va in vitest-dev/vitest#10222 (994c6)

... (truncated)

Commits

03630a5 chore: release v5.0.1 (#11275)
a47d790 fix(fakeTimers): force queueMicrotask and nextTick in toNotFake (#11261)
2ce29d5 fix: warn when deprecated deps.optimizer.web is used (#11214)
ccd6d05 docs: fix typecheck exclude default in documentation (#11223)
91ab158 fix(doctor): measure vm pools for custom environments (#11212)
23dda73 fix: share the server on self-referencing extends (#11034)
498fbe9 fix: resolve ResolvedConfig exactOptionalPropertyTypes errors (#11175)
115c3f6 fix: correct typos in error message and comments (#11187)
7361465 fix: keep metadata file when clearing the cache (#11199)
972e24b fix(browser): avoid double quotes in config.define (#11198)
Additional commits viewable in compare view

deepsource-io · 2026-09-07T14:41:19Z

DeepSource Code Review

We reviewed changes in c84c898...0dafa0d on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
Docker	Sep 21, 2026 2:40p.m.	Review ↗
JavaScript	Sep 21, 2026 2:40p.m.	Review ↗
Python	Sep 21, 2026 2:40p.m.	Review ↗
Rust	Sep 21, 2026 2:40p.m.	Review ↗
Shell	Sep 21, 2026 2:40p.m.	Review ↗
SQL	Sep 21, 2026 2:40p.m.	Review ↗
Secrets	Sep 21, 2026 2:40p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

…ry with 4 updates Bumps the desktop-dependencies group with 4 updates in the /apps/desktop directory: [electron](https://github.com/electron/electron), [typescript](https://github.com/microsoft/TypeScript), [undici](https://github.com/nodejs/undici) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `electron` from 43.7.3 to 44.4.2 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v43.7.3...v44.4.2) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) Updates `undici` from 7.29.1 to 8.10.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.29.1...v8.10.2) Updates `vitest` from 4.1.11 to 5.0.1 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/vitest) --- updated-dependencies: - dependency-name: electron dependency-version: 44.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: desktop-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: desktop-dependencies - dependency-name: undici dependency-version: 8.10.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: desktop-dependencies - dependency-name: vitest dependency-version: 5.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: desktop-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-21T14:40:25Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ecd41fa7-d50b-4322-9158-26e92ac0a72d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026

dependabot Bot requested a review from ezzy1630 as a code owner September 7, 2026 14:40

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026

dependabot Bot changed the title ~~chore(deps-dev): bump the desktop-dependencies group in /apps/desktop with 4 updates~~ chore(deps-dev): bump the desktop-dependencies group across 1 directory with 4 updates Sep 21, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/apps/desktop/desktop-dependencies-3c33f71b43 branch from 6777476 to 0dafa0d Compare September 21, 2026 14:40

Navigation Menu

chore(deps-dev): bump the desktop-dependencies group across 1 directory with 4 updates - #60

chore(deps-dev): bump the desktop-dependencies group across 1 directory with 4 updates#60
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/desktop/desktop-dependencies-3c33f71b43

dependabot Bot commented on behalf of github Sep 7, 2026 •

edited

Loading

Uh oh!

deepsource-io Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 21, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

electron v44.4.2

Release Notes for v44.4.2

Fixes

Other Changes

electron v44.4.1

Release Notes for v44.4.1

Fixes

electron v44.4.0

Release Notes for v44.4.0

Features

Fixes

Other Changes

electron v44.3.0

TypeScript 7.0.2

TypeScript 6.0.3

TypeScript 6.0

TypeScript 6.0.1 RC

TypeScript 6.0 Beta

v8.10.2

⚠️ Security fixes

High severity

Medium severity

Low severity

What's Changed

New Contributors

v5.0.1

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v5.0.0

🚨 Breaking Changes

Uh oh!

deepsource-io Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

coderabbitai Bot commented Sep 21, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 7, 2026 •

edited

Loading

deepsource-io Bot commented Sep 7, 2026 •

edited

Loading