deps: bump the npm group across 1 directory with 3 updates

[dependabot]

Bumps the npm group with 3 updates in the / directory: bplist-parser, plist and electron.

Updates bplist-parser from 0.3.2 to 0.5.0

Release notes

Sourced from bplist-parser's releases.

v0.5.0

Breaking Changes

• Integer values above Number.MAX_SAFE_INTEGER are now returned as a native bigint instead of a big-integer-wrapped instance (#45). If you upgrade from 0.3.2 and serialize parsed results with JSON.stringify, this will now throw (Do not know how to serialize a BigInt) the first time a plist contains a large integer. See the README's Integers section for how to handle this with a replacer function.

What's Changed

• Convert to EcmaScript module by @​hsorbo in joeferner/node-bplist-parser#42
• Cleanups after ESM-conversion by @​hsorbo in joeferner/node-bplist-parser#43
• Fix binary plist integer parsing by @​dnicolson in joeferner/node-bplist-parser#45
• Fix #36: parseFile() throws TypeError on fs error if no callback is p… by @​mvillalba in joeferner/node-bplist-parser#37
• Convert to dual ESM/CJS build with esbuild, vitest, and flat ESLint c… by @​joeferner in joeferner/node-bplist-parser#50
• Convert to TypeScript by @​joeferner in joeferner/node-bplist-parser#51

New Contributors

• @​hsorbo made their first contribution in joeferner/node-bplist-parser#42
• @​mvillalba made their first contribution in joeferner/node-bplist-parser#37
• @​joeferner made their first contribution in joeferner/node-bplist-parser#50

Full Changelog: joeferner/node-bplist-parser@v0.3.2...v0.5.0

Commits

• 3174d14 Fix repository/homepage/bugs URLs to point at the current repo
• be75a59 Merge pull request #51 from joeferner/typescript-conversion
• 958f4a5 Convert to TypeScript
• 39629b6 Merge pull request #50 from joeferner/esm-dual-build
• 6b0628e Merge master into esm-dual-build to pick up CI matrix fix
• aa71e82 Restore package-lock.json for CI
• b34141a Drop Node 18 from CI matrix
• 9dffd8e Convert to dual ESM/CJS build with esbuild, vitest, and flat ESLint config
• e0c2775 github ci/cd
• b3b7e36 Merge pull request #37 from mvillalba/bug-36
• Additional commits viewable in compare view

Updates plist from 3.1.1 to 5.0.0

Release notes

Sourced from plist's releases.

plist@5.0.0

Major Changes

• 982349e: BREAKING: null values are now skipped during build(), matching undefined behavior and aligning with Apple's plist DTD which does not include a <null/> element. Parsing <null/> on read is still supported for backwards compatibility.

Minor Changes

• 592f243: Added binary plist (bplist00) support: parseBinary() and buildBinary() for reading and writing binary plists. parse() now auto-detects binary format.
• 8f0e2cc: Add browser-native implementations using DOMParser and XMLSerializer for parsing, and native DOM APIs for building XML. Bundlers that support the "browser" export condition (Vite, webpack, esbuild) will automatically use these lighter implementations, dramatically reducing bundle size by eliminating the @xmldom/xmldom and xmlbuilder dependencies.
• 754240c: Added OpenStep/ASCII plist parsing support via parseOpenStep(). parse() now auto-detects all three plist formats: XML, binary, and OpenStep.
• 3463937: Rewritten in TypeScript with full type declarations. Switched to vitest for testing and pnpm for package management.

Patch Changes

• 8ce0162: Fixed exponential parse blowup when parsing deeply nested plist files. The dict parser was eagerly evaluating error message arguments, causing every value to be parsed twice.
• f8102c0: Replaced legacy patterns with modern JS equivalents: native toISOString(), Object.hasOwn(), and direct type checks.

Changelog

Sourced from plist's changelog.

5.0.0

Major Changes

• 982349e: BREAKING: null values are now skipped during build(), matching undefined behavior and aligning with Apple's plist DTD which does not include a <null/> element. Parsing <null/> on read is still supported for backwards compatibility.

Minor Changes

• 592f243: Added binary plist (bplist00) support: parseBinary() and buildBinary() for reading and writing binary plists. parse() now auto-detects binary format.
• 8f0e2cc: Add browser-native implementations using DOMParser and XMLSerializer for parsing, and native DOM APIs for building XML. Bundlers that support the "browser" export condition (Vite, webpack, esbuild) will automatically use these lighter implementations, dramatically reducing bundle size by eliminating the @xmldom/xmldom and xmlbuilder dependencies.
• 754240c: Added OpenStep/ASCII plist parsing support via parseOpenStep(). parse() now auto-detects all three plist formats: XML, binary, and OpenStep.
• 3463937: Rewritten in TypeScript with full type declarations. Switched to vitest for testing and pnpm for package management.

Patch Changes

• 8ce0162: Fixed exponential parse blowup when parsing deeply nested plist files. The dict parser was eagerly evaluating error message arguments, causing every value to be parsed twice.
• f8102c0: Replaced legacy patterns with modern JS equivalents: native toISOString(), Object.hasOwn(), and direct type checks.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for plist since your current version.

Updates electron from 33.4.11 to 44.3.0

Release notes

Sourced from electron's releases.

electron v44.3.0

Release Notes for v44.3.0

Features

• Added the ELECTRON_DEBUG_DRAGGABLE_REGIONS environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. #53627 (Also in 43, 45)

Fixes

• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53691 (Also in 42, 43, 45)
• Fixed Ctrl+Y not yanking text killed with Ctrl+K in text fields on macOS. #53714 (Also in 45)
• Fixed Tray icons not appearing when running inside Flatpak or Snap sandboxes on Linux. #53653 (Also in 45)
• Fixed app.getGPUInfo('complete') stalling the GPU process for several seconds on some Windows systems. #53644 (Also in 45)
• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53688 (Also in 42, 43, 45)
• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53494 (Also in 42, 43, 45)
• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53509 (Also in 42, 43, 45)
• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53583 (Also in 42, 43, 45)
• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53539 (Also in 42, 43, 45)
• Fixed a spurious node_init error being logged when creating a ShadowRealm with Node.js integration enabled. #53579 (Also in 45)
• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53672 (Also in 42, 43, 45)
• Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. #53630 (Also in 43, 45)
• Fixed window state not being persisted when a window entered or left fullscreen, or was maximized or unmaximized, without also being moved or resized. #53576 (Also in 45)
• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53723 (Also in 42, 43, 45)
• <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53721 (Also in 42, 43, 45)
• getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53709 (Also in 42, 43, 45)
• nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53711 (Also in 42, 43, 45)
• openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53699 (Also in 42, 43, 45)
• pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53693 (Also in 42, 43, 45)

Other Changes

• Fixed the app becoming unresponsive when a page has a very large number of app-region draggable elements. #53597 (Also in 43, 45)
• Updated Chromium to 152.0.7977.78. #53523

electron v44.2.0

Release Notes for v44.2.0

Fixes

• Fixed a pending read on a net.request chunked upload stream inside a protocol handler never settling when the request failed or was aborted. #53373 (Also in 43, 45)
• Fixed a potential crash when using menu.popup with a frame from an offscreen rendered window. #53362 (Also in 43)
• Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. #53455 (Also in 43, 45)
• Fixed application crash after a large number of IPC messages from renderers. #53417 (Also in 42, 43, 45)
• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53392 (Also in 42, 43, 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53479
• Improved throughput of responses that protocol.handle handlers return straight from net.fetch. #53378
• Updated Chromium to 152.0.7977.76. #53382
• Updated Node.js to v24.20.0. #53250

electron v44.1.1

... (truncated)

Commits

• 07e4607 test: split the Squirrel.Mac updater specs and run them serially on x64 (#53729)
• 79ceb1e fix: check the sending frame for internal guest, window and reply IPCs (#53723)
• fb5f8e2 feat: add ELECTRON_DEBUG_DRAGGABLE_REGIONS debugging aid (#53627)
• 079b9b1 fix: route modifier-click and OpenURLFromTab popups through the window-open p...
• b6a4d49 fix: gate preload and worker Node integration on the creating frame (44-x-y) ...
• 779cba5 fix: restore the kill ring on non-MAS macOS builds (#53714)
• d024d25 fix: require a registered source id for webContents capture via getUserMedia ...
• a450ce4 fix: scope File System Access grants to the requesting document (44-x-y) (#53...
• 8aa5414 fix: attribute openExternal permission requests to the navigation's initiator...
• 88bad31 fix: attribute pointer lock, keyboard lock and paste checks to the requesting...
• Additional commits viewable in compare view

[manar-mk]

Проверено локально на Windows 11: с этим набором зависимостей хост не стартует.

plist@5.0.0 перешёл на ESM и в exports оставил только условия import и browser — условия require там нет. Поэтому любой require('plist') падает ещё до открытия окна:

App threw an error during load
Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: No "exports" main defined in node_modules/plist/package.json

Затронуты usbmux.js (а его тянет main.js), tools/device-info.js и tools/list-apps.js — то есть весь путь по USB.

CI этого не ловит: host-windows и host-macos только упаковывают приложение через electron-builder и не запускают его.

Сам electron 44.3.0 при этом в порядке — с plist, закреплённым на ^3.1.1, хост поднимается нормально: перечисление дисплеев, аппаратный H.264 (h264 encoder available: true), захват звука с кабеля. Сквозной путь до iPad в этот момент проверить не удалось — устройство не было подключено.

Предлагаю закрыть этот PR и поднять electron отдельно, а plist/bplist-parser держать на мажорных версиях до перехода кода на ESM.

[manar-mk]

Закрываю: в этом виде PR ломает хост (см. комментарий выше — plist@5 ESM-only). После #9 dependabot пересоберёт групповое обновление уже без plist/bplist-parser, а electron можно поднять через #7.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml