[dependabot]

Bumps electron from 43.8.0 to 43.8.1.

Release notes

Sourced from electron's releases.

electron v43.8.1

Release Notes for v43.8.1

[!NOTE] This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

Fixes

• Fixed link-opened windows not using the opener's session and webPreferences. #55049 (Also in 42, 44, 45)
• Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55047 (Also in 42, 44, 45)

Commits

• 817c43f fix: apply the certificate SPKI blocklist to Node and add entries (43-x-y) (#...
• 9afe078 docs: fix code block line highlighting after docs reformats (#55103)
• 076d6db test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
• 3b068bf test: re-enable Node.js tests that now pass with BoringSSL (#55094)
• 60f928e build: stop overriding node GN declare_args defaults in patch (#55076)
• 14c73d1 build: update PGO profiles (#55092)
• 7ceb2c0 fix: avoid misaligned char16_t reads in crdtp string deserialization (#55063)
• 06f1c1f ci: use Cloudflare DNS directly on macOS runners (#55068)
• a68de91 fix: use the opener's session and webPreferences for windows opened from link...
• 6a2b850 ci: skip native builds when installing deps for type generation (#55065)
• Additional commits viewable in compare view

[qawatake]

Update review: electron 43.7.9 → 43.8.1 (security update, GHSA-jr5w-w6x2-84p9)

Reviewed head: af8f709f338a4c73bce799e9c4aba21b6ad35a57 (base cd4bb0b8d5ecdfff90feaecae1a954e018806c78, i.e. main after #56)

Final verdict: On hold — waiting for the repository owner's decision on the release-age gate (see Blocking conditions)
Risk: Medium — axes hit: supply chain (electron 43.8.1 was published 2026-10-20, 4 days ago, and the @electron-internal/extract-zip 1.0.6 it pulls in on 2026-10-22, 2 days ago; both are younger than the repository's 7-day minimum-release-age, which dependabot disabled for this security update; electron ships without npm provenance). The other axes are low: patch release, e2e runner only, no untrusted input, rollback is reverting the lockfile, e2e covers the path, licenses permissive.
Review type: Comment
Release/deploy: Not needed (no-release) — reason: electron and extract-zip only run / unpack the e2e runner binary and never enter main.js / styles.css / manifest.json. This repository ships no artifact at all (no releases or tags, main.js gitignored). I add no-release for the same reason as on #55 / #56.

Changes reviewed (2.1)

• Primary sources read: electron GitHub release v43.8.1 (and v43.7.10 / v43.7.11 / v43.8.0 as reviewed in #56), releases.electronjs.org/releases.json, advisory GHSA-jr5w-w6x2-84p9 and commit 817c43f9; electron/extract-zip release v1.0.6 and compare v1.0.5...v1.0.6; undici release v7.30.1 and compare v7.30.0...v7.30.1; npm registry metadata, provenance attestations and tarball diffs of every moved package.
• Version range covered: electron 43.8.0 → 43.8.1 and @electron-internal/extract-zip 1.0.5 → 1.0.6 (dependabot rebased this PR onto main after #56 landed electron 43.8.0 and undici 7.30.1; the earlier head 5352cd2 also carried those). The lockfile diff contains exactly these two packages; the set of package names is unchanged.
• Breaking / behavior changes: electron 43.8.1 (vs 43.8.0): applies the SPKI blocklist for the compromised eMudhra intermediate certificates, in Chromium and in the embedded Node (fix: apply the certificate SPKI blocklist to Node and add entries, #55130; this is the GHSA-jr5w-w6x2-84p9 mitigation); link-opened windows now use the opener's session and webPreferences (#55049); setCertificateVerifyProc is applied to concurrent first requests (#55047). Chromium 150.0.7871.250, Node 24.22.0 and V8 are unchanged vs 43.8.0. 43.7.9 → 43.8.0: as in #56 (Node 24.21.0 → 24.22.0, crash fixes, no breaking changes). extract-zip 1.0.6: bumps the Rust zip crate to 9.0.3 for RUSTSEC-2026-0367/0368/0369 (the native .node binaries are rebuilt; index.js, binding.js, *.d.ts byte-identical) and relicenses BSD-2-Clause → MIT (new LICENSE file). undici is no longer part of this PR (7.30.1 already on main via #56).

Impact and adequacy of the PR (2.2, 2.3)

Change	Affected location / none	Evidence	PR handling adequate?
SPKI blocklist (GHSA-jr5w-w6x2-84p9)	TLS trust of the e2e Obsidian process launched from the npm electron binary (tests/e2e-setup/setup.ts, tests/e2e/sample.spec.ts)	Nothing in this repo configures certificate verification (grep `setCertificateVerifyProc	certificate-error
link-opened windows / setCertificateVerifyProc race	None	grep `window.open	setWindowOpenHandler
extract-zip 1.0.6 (rebuilt native unzip)	install.js of electron, which unpacks the downloaded electron-v43.8.1-darwin-arm64.zip on first require('electron')	e2e log on this head: Downloading Electron binary... then the suite ran, so the new binary unpacked correctly	Yes
Files dependabot does not touch	None	No version of these packages is hardcoded in workflows, scripts or configs (grep `43.7.9	43.8.0

Verification (2.4)

• CI on this head (https://github.com/qawatake/obsidian-e2e-sample/actions/runs/40096052691): all jobs passed, with electron 43.8.1 installed (install summary in the logs) and the e2e suite green (e2e:setup / e2e:test / e2e:cleanup each "1 passed"). This CI ran on 2026-10-24 (after the rebase, against the current main cd4bb0b and after both advisories were published), and pnpm audit --audit-level=high reported "No known vulnerabilities found": this is the only open lockfile change in the repository whose audit is green against the current advisory database; main itself still fails on GHSA-jr5w-w6x2-84p9 alone. I read the logs.
• Merge state: CLEAN on the current main (cd4bb0b) at review time.
• Additional checks I did: tarball diff electron 43.8.0 → 43.8.1 (only package.json version, the electron.d.ts header comment and checksums.json differ; cli.js, index.js, install.js byte-identical); checksums.json of 43.8.1 equals the GitHub release SHASUMS256.txt for all 75 entries; tarball diff extract-zip 1.0.5 → 1.0.6 (JS and .d.ts identical, 9 native binaries differ, LICENSE added, package.json version + license field).

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert the lockfile / package.json change. No persistent data involved.
• Supply chain: electron 43.8.1 — no npm provenance (none for any 43.x); publisher electron-nightly, maintainers unchanged; integrity matches the registry; GitHub release by sudowoodo-release-bot[bot]; annotated tag v43.8.1 → commit 817c43f9, GPG-verified, by Samuel Attard (Electron maintainer), contained in 43-x-y; the binary it downloads is verified against checksums.json, which equals the release SHASUMS256.txt. Published 2026-10-20T02:54Z: 4 days, below the 7-day gate; without provenance the compensating checks 1–3 of the guideline (provenance, publish-path continuity, commit = tag) cannot be met for the npm package itself, only for the GitHub release assets via the checksum match. extract-zip 1.0.6 — npm provenance from electron/extract-zip .github/workflows/release.yml on refs/heads/main, github-hosted, commit ade400e3 = tag v1.0.6 = gitHead, the same path as 1.0.5; commits in the range are GPG-verified (claude[bot] / dependabot[bot], merged by the Electron team); scripts unchanged (prepublishOnly only, not run on install), no dependencies. Published 2026-10-22T05:22Z: 2 days. Dependabot resolved the lockfile with --config.minimum-release-age=0 (its job log), so the gate did not apply.
• License: electron MIT → MIT (LICENSE identical); extract-zip BSD-2-Clause → MIT (permissive → permissive, no obligation change for an unpublished dev dependency).

Blocking conditions

• Hit: supply-chain risk unresolved under the repository's own policy. .github/dependabot.yml states that a fix version gets no special trust and should age past minimum-release-age unless the advisory is severe and the vulnerable path is actually reachable from this plugin. electron 43.8.1 (4 days, no provenance) and extract-zip 1.0.6 (2 days) are inside the gate. Whether GHSA-jr5w-w6x2-84p9 (high, CVSS 7.4: trust in compromised intermediate CAs by the e2e runner's Chromium/Node) is reachable enough here to take them early is the repository owner's decision, not the reviewer's.

Requests

• None for dependabot. For the repository owner, one of:
  a. Accept now on the compensating evidence above (identical JS, release checksum match, extract-zip provenance) and merge.
  b. Wait: electron 43.8.1 passes the gate at 2026-10-27T02:54Z, extract-zip 1.0.6 at 2026-10-29T05:23Z. Nothing needs to be redone then; confirm the head is unchanged and merge.
  Until then main's pnpm audit keeps failing on GHSA-jr5w-w6x2-84p9 alone (undici is fixed by #56).

Unverified / notes for other reviewers (2.9)

• The npm electron tarball cannot be tied to a GitHub commit (no provenance, no gitHead).
• The rebuilt extract-zip native binaries were not reproduced; trust rests on the provenance attestation.
• Whether a TLS man-in-the-middle against the e2e process on a GitHub-hosted runner is realistic was not assessed beyond "network traffic exists".

[qawatake]

Addendum to the review above (reachability, for the "take it early or wait" decision):

• What GHSA-jr5w-w6x2-84p9 is: Chromium/Node in Electron < 43.8.1 still trust TLS certificates chained to compromised eMudhra intermediate CAs, so a network attacker holding such a certificate could impersonate HTTPS hosts to the Electron process. 43.8.1 adds those SPKIs to the blocklist.
• Where electron sits in this repository: a devDependency used only as the runtime for the Playwright e2e suite (tests/e2e-setup/*.ts, tests/e2e/sample.spec.ts). It is not bundled into the shipped artifact (this repository publishes nothing at all), and the e2e run opens a local test vault only; it does not load untrusted remote content. Exposure is limited to whatever network traffic Obsidian itself makes during a CI or local e2e run.
• Consequence: the vulnerable path is not reachable from the published plugin, so under .github/dependabot.yml this does not meet the "severe and reachable" bar for skipping the 7-day gate. Waiting until 2026-10-27 (electron 43.8.1) / 2026-10-29 (extract-zip 1.0.6) costs nothing but a red pnpm audit on main in the meantime; taking it now is defensible on the compensating checks listed above (tag = commit for both packages, no new or removed package names, no install scripts, lockfile diff confined to electron + extract-zip, and a green CI including audit on this head). Either way the head to merge is the one reviewed above (af8f709).

[qawatake]

Update review: electron 43.8.0 → 43.8.1

Final decision: Proceed (実施)
Risk: Medium — axes: change type (patch with documented behavior changes, none applicable to this repo), supply chain (electron publishes no npm provenance; compensated, see below; 43.8.1 is 11 days old)
Review type: Approve
Release/deploy: Not needed (no-release) — electron is a devDependency used only to run Obsidian in the e2e tests; it is external in esbuild and not bundled. Built base (main cd4bb0b) and this PR merged onto main with pnpm build: main.js and manifest.json are byte-identical (artifact = main.js,manifest.json passed explicitly; this repo has no hardenDeps declaration) (artifact-diff exit 0).

Changes reviewed (2.1)

• Primary sources: release notes v43.8.1, advisory GHSA-jr5w-w6x2-84p9 (high; patched in 43.x = 43.8.1), compare v43.8.0...v43.8.1 (12 commits, behind 0), and the npm tarball diff 43.8.0 → 43.8.1. Upstream research was done once for electron@43.8.1 and reused here; basis for reuse: same version and the lockfile integrity in this PR (sha512-Qa6/xXOD…RcQ==) equals the registry dist.integrity for electron@43.8.1.
• Version range: 43.8.0 → 43.8.1 (no intermediate versions).
• Breaking / behavior changes:
  • [security] eMudhra intermediate-certificate SPKI blocklist now also applied to Node's tls/https/fetch (TLS to those certs now fails).
  • [behavior] windows opened from links (window.open / target=_blank) now use the opener's session and webPreferences.
  • [fix] setCertificateVerifyProc now applied to requests concurrent with the first request to a host.
  • No breaking API change in the release notes or commit list.
• Transitive change in the lockfile: @electron-internal/extract-zip 1.0.5 → 1.0.6 (electron's ^1.0.1 dependency re-resolved). Checked separately: 1.0.6 = upstream tag v1.0.6 (ade400e, on main), changes are a Rust zip 9.0.3 bump for RUSTSEC-2026-0367/0368/0369, a CI gate, and a relicense BSD-2-Clause → MIT.
• No other package in the lockfile changed; lockfile package-name set is identical before/after.

Impact and adequacy (2.2, 2.3)

Change	Affected / not affected	Basis	PR handling adequate?
Cert blocklist for Node TLS	Not affected	e2e opens a local vault only; no TLS to third-party hosts in tests	Yes (no change needed)
Link-opened windows inherit opener session/webPreferences	Not affected	git grep over the whole repository for window.open, setWindowOpenHandler, _blank: no hits. The plugin imports electron only as an esbuild external (runtime is Obsidian's own Electron)	Yes
setCertificateVerifyProc fix	Not affected	not used (git grep setCertificateVerifyProc: no hits)	Yes
extract-zip 1.0.6	Used only by electron's binary download (install.js)	lockfile snapshot	Yes

Verification (2.4)

• CI on this PR head (af8f709, run 40096052691): build, e2e and test-e2e-tools passed; at that time pnpm audit had no findings. The build failures currently seen on the other open PRs are the pnpm audit --audit-level=high step failing on GHSA-jr5w-w6x2-84p9 (electron <43.8.1), i.e. the advisory this PR fixes.
• e2e: setup-obsidian.sh reports "Electron 43.8.1 matches Obsidian's bundled major (43.8.3)"; Playwright e2e:setup 1 passed, e2e:test 1 passed, e2e:cleanup 1 passed on macOS.
• Run locally on this PR merged onto current main (this PR's base is current main), pnpm 10.34.7 / Node 24.22.1 via mise: pnpm install --frozen-lockfile OK, check-toolchain OK, check-actions-pinned OK, check-config-schema OK, pnpm audit --audit-level=high exit 0 (main: exit 1 with the electron high; remaining 2 moderates are pre-existing @electron/asar > minimatch/glob, unchanged), pnpm lint OK, pnpm typecheck OK, pnpm build OK, check-bundled-deps OK.
• Artifact diff (base main vs. merged head): identical.

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert this commit; no persistent side effects (dev-only binary).
• Supply chain:
  • Same package name; repository electron/electron; publisher electron-nightly (same as 43.8.0 and other recent lines); tag v43.8.1 (annotated, deref 817c43f9) exists with a release; lockfile integrity = registry integrity; no lifecycle scripts (43.8.x tarballs have no scripts); dependencies string unchanged; MIT.
  • electron publishes no npm provenance (never has, including the 43.8.0 we run today), so 2.6 compensating checks 1–3 cannot be satisfied. Decision: not treated as an unresolved supply-chain risk for this repo. Reasoning:
    1. The age criterion of the main 2.6 table is met at its lower bound (published 2026-10-20, 11 days; also past this repo's minimum-release-age of 7 days), so we are not on the "take before the waiting period" path where provenance is mandatory.
    2. Independent-channel evidence: the npm tarball changes only checksums.json, electron.d.ts and package.json (no JS change in index.js/cli.js/install.js); the binary is fetched from the GitHub release and verified against checksums.json, and all 75 entries of checksums.json match the GitHub release SHASUMS256.txt. A registry-only compromise would have to show up in exactly those files.
    3. Exposure is dev-only: the binary runs on dev machines and in the macOS e2e job (contents: read token); nothing reaches users (artifact identical).
    4. No alternative: staying on 43.8.0 keeps the same provenance gap plus a known high advisory.
    • Monitoring / stop condition: if a compromise or regression report appears for electron 43.8.x, revert this commit and pin 43.8.0 until resolved.
  • extract-zip 1.0.6: trusted publisher with SLSA provenance, workflow electron/extract-zip/.github/workflows/release.yml@refs/heads/main, commit ade400e = tag v1.0.6 (same repo/workflow as 1.0.5 → continuous); no install scripts (only prepublishOnly).
• License: electron MIT → MIT. extract-zip BSD-2-Clause → MIT (both permissive; acceptable for this MIT plugin and dev-only use).

Block conditions

• Hit: none.

Requests

• None.

Unverified / notes for reviewers (2.9)

• The npm tarball ↔ git commit link for electron (no gitHead/provenance) and the signature of SHASUMS256.txt were not verified; binary contents cannot be inspected. Accepted as a known constraint for the reasons above.
• Overlap: #60 (npm-minor-patch group) also bumps electron (→ 43.8.3). This PR is landed first because #60 is blocked on a Biome config change; after this merges, #60's electron part becomes 43.8.1 → 43.8.3.