[dependabot]

Bumps electron from 44.7.2 to 45.0.0.

Release notes

Sourced from electron's releases.

electron v45.0.0

Release Notes for v45.0.0

Stack Upgrades

• Chromium 156.0.8078.48
  • Chrome 156 Release Notes
  • Chrome 155 Release Notes
  • New in 154
  • New in 153
• Node v24.22.0
  • Node 24.22.0 blog post
• V8 15.6

Breaking Changes

• Reduced sandboxed renderer startup work for preload scripts that do not use Buffer. #54048
  • Removed the events, timers and url modules and the Buffer, setImmediate and clearImmediate globals from sandboxed preload scripts; use a polyfill.
  • Made sandboxed renderers without a preload script start faster.
  • Made sandboxed preload scripts start faster; Electron no longer evaluates a JavaScript bundle of its own in sandboxed renderers unless webviewTag is enabled.
• With nodeIntegrationInWorker: true, a Worker created from an <iframe> in the same process as the main frame used to get Node.js integration even though the iframe itself had none. Workers now only get Node.js integration when the frame that creates them has it: the main frame, or any frame when nodeIntegrationInSubFrames is enabled.
• A chrome-extension:// document used to receive the window's preload script (and session preload scripts) wherever it was embedded. It now only does so when it is a top-level frame or is hosted inside the DevTools front-end (a devtools_page or panel); an extension frame embedded in an ordinary page is treated like any other subframe and follows nodeIntegrationInSubFrames.
• The legacy chromeMediaSource: 'desktop' constraint now only accepts screen and window source ids from desktopCapturer.getSources. Passing a WebContents source id there now fails with an "Invalid state" error. To capture a WebContents, use chromeMediaSource: 'tab' with an id from webContents.getMediaSourceId(), or use ses.setDisplayMediaRequestHandler.
• The experimental contentTracing.enableHeapProfiling() API has been removed. Chromium removed the memlog implementation that backed this API and replaced it with a Perfetto heap-profiling data source. Pass a nativeHeapProfiling option to contentTracing.startRecording() to enable heap profiling for the duration of a trace. Like all recordings, heap-enabled recordings use the Perfetto protobuf format.
• Changed heap profiling in contentTracing recordings to now use a perfetto heap-profiling data source. #54863
• Screen, window and tab capture requests are now reported to setPermissionRequestHandler as display-capture instead of media; a handler that allows only media must also allow display-capture to keep screen sharing working. #52824
• Chromium has disabled document.requestStorageAccessFor by default ahead of its removal. The API can temporarily be restored with the enableBlinkFeatures web preference set to RequestStorageAccessFor. See Chromium's intent to remove discussion for more information.
• fs.open, fs.openSync and fs.promises.open on a file inside an ASAR archive used to extract the file to a temporary copy and return a descriptor for that copy. They now return a descriptor that only identifies the entry to Node's fs module, which reads directly out of the archive with no temporary file (fs.read, fs.readv, fs.fstat, fs.readFile(fd), fs.createReadStream and the FileHandle methods). The descriptor itself is not backed by the file's contents: code that reads the raw descriptor (a native addon, child_process stdio, net.Socket({ fd }), http2stream.respondWithFile() / respondWithFD(), a FileHandle transferred to a worker, ...) fails with EBADF and is not supported. Opening a file inside an archive with a flag that allows writing (w, a, r+, ...) now fails with EACCES instead of silently writing to the temporary copy, and fs.fchmod, fs.fchown and fs.futimes on these descriptors fail with EACCES.
• A window.open() child whose sandbox state differs from its opener's renderer process is now created in its own process with no opener relationship instead of silently sharing the opener's process; set sandbox: false in setWindowOpenHandler to keep sharing an unsandboxed opener's process. #52472
• The synchronous safeStorage methods are deprecated and will be removed in Electron 46, following Chromium's removal of the synchronous OSCrypt backend they are built on. Use the asynchronous methods instead, which use the same per-platform key stores. Data encrypted with safeStorage.encryptString() can be decrypted with safeStorage.decryptStringAsync().
• Added select-client-certificate event support for net.request and net.fetch; requests to servers requesting a client certificate no longer fail with ERR_SSL_CLIENT_AUTH_CERT_NEEDED, and applications can now select a certificate to present. #52162 (Also in 44)
• Clipboard module is now aligned with the W3C Clipboard API. #51707 (Also in 44)
• Removed 32-bit builds (Windows ia32 and Linux armv7l). Electron is now published only for 64-bit (x64 and arm64) platforms. #51816 (Also in 44)
• Removed openAsHidden option from app.setLoginItemSettings(). #52351 (Also in 44)
  • Removed openAsHidden, wasOpenedAsHidden and restoreState fields from return value of app.getLoginItemSettings().
  • Fixed potential deadlock inside app.getLoginItemSettings() on macOS.
• Updated the Linux support policy. #52429 (Also in 44)

See the Breaking Changes doc for more details about these changes.

Features

• Added a badge property to MenuItem on macOS 14+ for showing a count or custom text badge next to a menu item's label. #50805 (Also in 43, 44)
• Added a Save/Restore Window State API for cross-platform use. #51510 (Also in 44)
• Added a Windows Error Reporting helper (electron_wer.dll, renamed to <app>_wer.dll alongside the executable) so crashReporter captures __fastfail and other crashes that bypass the in-process handler on Windows. #53851
• Added app shims on macOS to show windows under another app's Dock icon. #55072 (Also in 44)
• Added app.configureWebAuthn() API to enable iCloud Keychain passkey support on macOS. When enabled, navigator.credentials.create() and .get() present Apple's native passkey UI via ASAuthorizationController. #51563
• Added available to process.getSystemMemoryInfo() on Linux, exposing proc/meminfo MemAvailable. #52299 (Also in 42, 43, 44)
• Added disableWakeLocks option to WebPreferences. #52342
• Added getIsolatedWorlds method and isolated-world-created event for webFrame to enable discovery of isolated worlds. #50633

... (truncated)

Commits

• 54f961b chore: bump chromium to 156.0.8078.48 (45-x-y) (#55144)
• a7f3579 chore: cherry-pick 29 changes from chromium, pdfium, skia and v8 (#55145)
• 8807961 fix: cherry-pick 431b8be6a111 from chromium (#54912)
• a6ce292 test: fix unload-IPC and protocol.handle 'is fast' flakes (#55132)
• 0f79472 test: wait for the parent's ack before utility children exit (#55123)
• 1d2f13b fix: apply the certificate SPKI blocklist to Node and add entries (45-x-y) (#...
• 21ea802 docs: add UIPI note for setIgnoreMouseEvents forward option (#55112)
• aa25341 test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
• f17325a docs: update breaking-changes.md ahead of 45.0.0 release (#55121)
• 528eb6f docs: fix code block line highlighting after docs reformats (#55105)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
xod-post	Ready	Preview	Oct 25, 2026 3:43pm UTC