chore(deps): bump the electron group across 1 directory with 4 updates

[dependabot]

Bumps the electron group with 4 updates in the / directory: node-abi, @electron/rebuild, electron and electron-builder.

Updates node-abi from 4.35.0 to 4.37.0

Release notes

Sourced from node-abi's releases.

v4.37.0

4.37.0 (2026-10-08)

Features

• update ABI registry (#311) (6b535c1)

v4.36.0

4.36.0 (2026-10-05)

Features

• update ABI registry (#308) (879bacf)

Commits

• 6b535c1 feat: update ABI registry (#311)
• 927c214 ci: set cache-mode on release workflows (#306)
• 99cec5b ci: add required-ci gate job (#307)
• 879bacf feat: update ABI registry (#308)
• df1359e build(deps): bump lint-staged to 17.4.1 (#305)
• See full diff in compare view

Updates @electron/rebuild from 4.2.0 to 4.2.1

Release notes

Sourced from @​electron/rebuild's releases.

v4.2.1

4.2.1 (2026-10-06)

Bug Fixes

• include target platform in .forge-meta rebuild marker (#1319) (3e6bfd1), closes electron-userland/electron-builder#10031

Commits

• d62d5a2 ci: set cache-mode on release workflows (#1307)
• 3e6bfd1 fix: include target platform in .forge-meta rebuild marker (#1319)
• e355454 chore(deps): bump undici from 6.28.0 to 6.28.1 in /test/fixture/workspace-tes...
• 90f2542 chore(deps): bump brace-expansion from 5.0.7 to 5.0.12 (#1317)
• af5c214 ci: add required-ci gate job (#1312)
• 6a69b7c chore(deps): bump markdown-it from 14.2.0 to 14.3.2 (#1315)
• 037e7d9 chore(deps): bump azure/login from 3.0.1 to 3.1.0 (#1321)
• 8b14ce8 chore(deps): bump undici from 6.28.0 to 6.28.1 in /test/fixture/native-app1 (...
• 7bb45ee chore(deps): bump undici from 6.27.0 to 6.28.1 (#1313)
• dd050f3 build(deps-dev): upgrade vitest to v5 (#1310)
• Additional commits viewable in compare view

Updates electron from 43.7.1 to 43.7.9

Release notes

Sourced from electron's releases.

electron v43.7.9

Release Notes for v43.7.9

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. #54667
• Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. #54658

electron v43.7.8

Release Notes for v43.7.8

Fixes

• Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. #54597
• Fixed webview.findInPage() hanging when the host page also has an iframe. #54584 (Also in 44, 45)
• Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. #54622

electron v43.7.7

Release Notes for v43.7.7

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn and V8. #54569

electron v43.7.6

Release Notes for v43.7.6

Fixes

• Fixed --xdg-portal-required-version having no effect and a spurious portal warning being logged for file dialogs on Linux. #54304 (Also in 44, 45)
• Fixed a child WebContentsView losing focus when its window is reactivated. #54456 (Also in 44, 45)
• Fixed a crash when a WebAuthn request used a security key that required its PIN. #54404 (Also in 45)
• Fixed a crash when sending a DevTools protocol command with a non-string value for an optional string parameter via webContents.debugger. #54443 (Also in 44, 45)
• Fixed a grey border around frameless windows on Linux WMs without compositing. #54390 (Also in 44, 45)
• Fixed a main process crash when a native API method was called with a this value of a different native type; it now throws a TypeError. #54316 (Also in 44)
• Fixed a possible crash during process exit when vm.Script or vm contexts created in the main process had been garbage collected shortly before quitting. #54268 (Also in 44, 45)
• Fixed a possible renderer crash in 32-bit Windows and Linux ARM builds caused by under-aligned Blink heap vector allocations. #54259
• Fixed a renderer crash calling image.toPNG() from a sandboxed preload script. #54503 (Also in 44, 45)
• Fixed clipboard.read(), readText() and has() resolving seconds late on Linux while the app was idle. #54309 (Also in 42, 44, 45)
• Fixed desktopCapturer.getSources() leaving non-resizable windows resizable on macOS. #54396 (Also in 44, 45)
• Fixed fs.rmSync failing to remove read-only files on Windows. #54256 (Also in 42, 44, 45)
• Fixed GDK_BACKEND leaking into processes spawned by Electron apps on Linux. #54426 (Also in 44, 45)
• Fixed pointerLock permission requests from some iframes reporting the parent frame. #54465 (Also in 42, 44, 45)
• Fixed setIgnoreMouseEvents() taking effect late on X11. #54498 (Also in 44, 45)
• Fixed setIgnoreMouseEvents(true) being undone by the next resize on X11. #54423 (Also in 44, 45)
  • Added setIgnoreMouseEvents support on Wayland.
• Fixed the default action label on Linux notifications not being localized. #54400 (Also in 44, 45)
• Fixed the GPU process crash-looping on Windows when the sandbox cannot read the install folder; the folder is now reported instead. #54485 (Also in 44, 45)
• Fixed the zoom level resetting on file: and other host-less pages after a location.hash change. #54440 (Also in 44, 45)
• Fixed typing not working after closing an alert() or confirm() on Windows. #54462 (Also in 44, 45)

... (truncated)

Commits

• c41115b chore: cherry-pick 47 changes from angle, chromium, dawn, fontconfig, skia, v...
• e546dde test: add mouse-input addon for setIgnoreMouseEvents specs (#54606)
• b2a89a1 chore: cherry-pick 9 changes from angle, chromium, skia, v8 and webrtc (#54658)
• e23db61 fix: update ICU time zone data to tzdata 2026d (#54622)
• 83a7520 build: update PGO profiles (#54640)
• 0b605a8 chore: cherry-pick 69403d85b78b from chromium (#54597)
• f5e30a9 fix: webview findInPage() hang when the embedder page has an iframe (#54584)
• ddb762f chore: cherry-pick 26 changes from angle, chromium, dawn and v8 (#54569)
• 661853d refactor: remove electron::ScopedHString in favor of base::win::ScopedHString...
• bd9e012 test: run pointer lock permission spec serially (#54581)
• Additional commits viewable in compare view

Updates electron-builder from 26.16.1 to 26.17.0

Release notes

Sourced from electron-builder's releases.

electron-builder@26.17.0

What's Changed

• fix: detect pnpm workspace root on Windows without shelling out to pwd (v26 backport) by @​claude[bot] in electron-userland/electron-builder#10189
• test: pin globTest "failed peer dep" deps via lockfile fixture and update snapshot for moment 2.31.0 (v26 backport of #10197) by @​claude[bot] in electron-userland/electron-builder#10198
• feat(nsis): "store-asar" mode for proportional differential updates (v26 backport) by @​claude[bot] in electron-userland/electron-builder#10201
• test(v26): bump package manager pins and disable dependency lifecycle scripts in fixture installs (backport #10199) by @​claude[bot] in electron-userland/electron-builder#10203
• fix(app-builder-lib): resolve pnpm deps omitted from deduped list output by declared range (backport #10200) by @​claude[bot] in electron-userland/electron-builder#10207
• fix(pkg): add rootVolumeOnly to for macOS 26 Installer prompt (v26 backport of #10193) by @​claude[bot] in electron-userland/electron-builder#10211
• fix(node-module-collector): clear error on empty output and fall back to traversal when a collector throws (v26 backport of #10210) by @​claude[bot] in electron-userland/electron-builder#10213
• fix(electron-updater): keep cached blockmap consistent with cached installer (v26 backport of #10098) by @​claude[bot] in electron-userland/electron-builder#10163
• fix(updater): make multi-range differential downloads work on real servers (v26 backport of #10192) by @​claude[bot] in electron-userland/electron-builder#10219
• fix(flatpak): stop linux.files from corrupting flatpak files (v26 backport of #10209 + #10227) by @​claude[bot] in electron-userland/electron-builder#10229
• fix(pnpm-collector): pick in-range nested deps with pnpm 11 hoisted layout (v26) by @​claude[bot] in electron-userland/electron-builder#10230
• chore(deploy): Release (v26) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#10191

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.1...electron-builder@26.17.0

Changelog

Sourced from electron-builder's changelog.

26.17.0

Patch Changes

bae1c8b 2a2dd22 07c8344 07c8344 613cd58 d4a4f50 41a027c 59f6364

• app-builder-lib@26.17.0
• dmg-builder@26.17.0

Commits

• 5cdf017 chore(deploy): Release v26.17.0 (electron-updater@6.8.10) (v26) (#10191)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Medium Risk
Electron and electron-builder updates affect the desktop runtime, installers, and auto-update packaging; validate desktop builds and native module rebuilds on CI before release.

Overview
Bumps the grouped Electron toolchain dependencies in package.json and refreshes package-lock.json with no application source changes.

Runtime and packaging: electron moves from 43.7.1 to 43.7.9 (patch releases with upstream Chromium/V8 backports and assorted desktop fixes). electron-builder is pinned from 26.16.1 to 26.17.0, pulling matching app-builder-lib / dmg-builder versions and related packaging fixes (pnpm workspace detection, updater blockmaps, macOS pkg installer behavior, and similar).

Native module tooling: @electron/rebuild goes 4.2.0 → 4.2.1 (rebuild marker includes target platform). node-abi goes 4.35.0 → 4.37.0 (updated ABI registry), which affects native add-on compatibility checks during rebuilds.

^{Reviewed by Cursor Bugbot for commit 18e4fb6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T23:08:26.375389Z	18e4fb6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.