[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
electron	44.7.2 → 44.9.1

---

Electron: Mitigation for compromised eMudhra intermediate certificates

CVE-2026-115570 / GHSA-jr5w-w6x2-84p9

More information

Details

Impact

A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js tls, https and fetch. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.

Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.

Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

• 45.0.0-beta.6
• 44.9.1
• 43.8.1
• 42.11.16

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9
• https://github.com/electron/electron/pull/55127
• https://github.com/electron/electron/pull/55128
• https://github.com/electron/electron/pull/55129
• https://github.com/electron/electron/pull/55130
• https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc
• https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad
• https://github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20
• https://github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499
• https://github.com/electron/electron
• https://github.com/electron/electron/releases/tag/v42.11.16
• https://github.com/electron/electron/releases/tag/v43.8.1
• https://github.com/electron/electron/releases/tag/v44.9.1
• https://github.com/electron/electron/releases/tag/v45.0.0-beta.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

electron/electron (electron)

v44.9.1: electron v44.9.1

Compare Source

Release Notes for v44.9.1

[!NOTE]
This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

v44.9.0: electron v44.9.0

Compare Source

Release Notes for v44.9.0

Features

• Added app shims on macOS to show windows under another app's Dock icon. #​55073 ^{(Also in 45)}

Fixes

• Fixed link-opened windows not using the opener's session and webPreferences. #​55048 ^{(Also in 42, 43, 45)}
• Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #​55046 ^{(Also in 42, 43, 45)}

v44.8.0: electron v44.8.0

Compare Source

Release Notes for v44.8.0

Features

• Added support for Notification action buttons on Linux. #​54890 ^{(Also in 45)}

Fixes

• Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. #​54987
• Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #​54909 ^{(Also in 42, 43, 45)}
• Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #​54960 ^{(Also in 42, 43, 45)}
• Fixed win.isFullScreen() being stale in fullscreen events on Windows. #​55009 ^{(Also in 45)}

Other Changes

• Backported fixes from upstream Chromium and V8. #​55034
• Updated Chromium to 152.0.7977.167. #​54928
• Updated Node.js to v24.22.0. #​55004

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud