build(deps-dev): bump electron from 43.4.0 to 43.5.0

[dependabot]

Bumps electron from 43.4.0 to 43.5.0.

Release notes

Sourced from electron's releases.

electron v43.5.0

Release Notes for v43.5.0

Fixes

• Fixed DevTools device metrics overrides persisting indefinitely when a remote debugging client disconnected without clearing them. #52946 (Also in 42, 44)
• Fixed BrowserWindow.unmaximize() and restore() having no effect on Wayland when the window was maximized immediately after creation. #53125 (Also in 42, 44)
• Fixed Uncaught illegal access errors and possible renderer crashes after closing a same-process child window or removing an iframe with nodeIntegrationInSubFrames enabled. #53041 (Also in 42, 44)
• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53319 (Also in 42, 44, 45)
• Fixed webContents.executeJavaScriptInIsolatedWorld resolving with undefined when worldId was not an integer. #53237 (Also in 44)
• Fixed webContents.print() honoring printBackground, duplexMode, and printer default duplex settings. #53160 (Also in 42, 44)
• Fixed a crash on Linux when the D-Bus session bus disconnected while the app was running, such as at logout or when dbus is restarted. #53095 (Also in 42, 44)
• Fixed a crash on Windows when V8 posted a delayed worker task during shutdown. #53013 (Also in 42, 44)
• Fixed a crash on macOS when a WebAuthn Touch ID prompt was requested while no locale resources were loaded. #53195 (Also in 44)
• Fixed a crash on macOS when a notification's icon could not be attached; the notification is now shown without the icon. #53147 (Also in 42, 44)
• Fixed a crash when calling node:wasi functions in optimized code. #53265 (Also in 42, 44, 45)
• Fixed a crash when calling utilityProcess.postMessage() after the utility process had exited. #53301 (Also in 44, 45)
• Fixed a regression where a window created with a custom title can show an empty title after using back/forward navigation. #53219 (Also in 42, 44)
• Fixed a renderer crash when a page calls SpeechRecognition.available() or SpeechRecognition.install() with processLocally. #53015 (Also in 42, 44)
• Fixed an issue where pages loaded in a detached WebContentsView wouldn't see the correct window size. #53152 (Also in 42, 44)
• Fixed crashes in sharedTexture, service-worker ipcRenderer and utilityProcess.fork() caused by object lifetime bugs. #53278 (Also in 44, 45)
• Fixed crashes in the main process when a webRequest.onBeforeRequest listener redirected a CORS preflight request, and when calling net.fetch() with a webRequest-permission extension loaded. #53304 (Also in 44, 45)
• Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it. #53288 (Also in 44, 45)
• Fixed crashes when certain app event handlers call back into Electron synchronously. #53276 (Also in 44, 45)
• Fixed document title updates when using back/forward navigation using the same document without utilizing browserWindow.setTitle(). #53023 (Also in 42, 44)
• Fixed region-qualified --lang values such as de-DE loading no locale resources on macOS, which left localized strings empty and could crash WebAuthn Touch ID prompts. #53186 (Also in 42, 44)
• Fixed spellcheck not initializing on Linux when the dictionary was already cached from a previous run. #52717 (Also in 44)
• Fixed the GPU process being terminated in AppX/MSIX packaged apps on Windows when WebGPU fell back to SwiftShader. #53197 (Also in 42, 44)
• Fixed the primary instance being killed or receiving truncated arguments when a second instance passed a very long command line or large additionalData to app.requestSingleInstanceLock(). #53156 (Also in 42, 44)
• Fixed the tray icon not appearing on GNOME (and disappearing entirely on Wayland) since 43.4.1. #53215
• Fixed utility process crashes at exit on Windows 11 24H2 and later. #53092 (Also in 42, 44)
• Fixed windows native message boxes being dismissed by other applications using invalid button ID. #53155 (Also in 44)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, Skia and V8. #52969
• Backported fixes from upstream ANGLE, Chromium, Dawn, V8 and WebRTC. #53190
• Backported fixes from upstream Chromium and V8. #53055
• Fixed a 1-in-200 chance per renderer process on Windows of scripts on the first page load being compiled without their V8 code cache. #52943 (Also in 42, 44)
• Fixed a stall of tens of milliseconds while creating the first BrowserWindow on Linux.
  • Improved the performance of file lookups inside ASAR archives and of large files served from them to the renderer.
  • Improved the performance of calls through contextBridge-exposed APIs.
  • Reduced the main-thread cost of sending large values through ipcRenderer, ipcMain handlers and webContents.send. #53018 (Also in 42, 44)
• Improved application startup time on Linux by skipping GDK's OpenGL probe and loading FontConfig off the main thread during toolkit initialization. #53108 (Also in 44)
• Improved startup time of utilityProcess.fork(), child_process.fork() / ELECTRON_RUN_AS_NODE child processes and Node.js-enabled renderers. #53135 (Also in 42, 44)
• Linux arm64, Windows arm64 and macOS x64 builds now start the main process from the embedded Node.js startup snapshot like the other platforms, improving startup time. #52881 (Also in 42, 44)
• Page resources, fetch() calls and file:// loads in renderers no longer wait for the main process to be idle when no webRequest listeners or protocol interceptors are registered. #53142 (Also in 42, 44)
• Updated Chromium to 150.0.7871.250. #52787
• Updated Node.js to v24.19.0. #52635

electron v43.4.1

... (truncated)

Commits

• 87cd122 fix: serialize the target's values into the Node.js startup snapshot on cross...
• f835161 fix: crash in webRequest proxy for redirected CORS preflights and frameless f...
• 379a50e build: update PGO profiles (#53311)
• 42e9db9 chore: clean up forward declarations (#53295)
• fe02d1a fix: crash when calling utilityProcess.postMessage() after the process has ex...
• bb2194e fix: dangling WebContents/NativeWindow pointers in debugger, devtools, login,...
• 1002688 fix: object lifetime bugs in sharedTexture, service-worker ipcRenderer and ut...
• eb3528a fix: use-after-free when event handlers re-enter chooser, protocol stream and...
• 8a24b57 fix: spellcheck failing to initialize on Linux (#52717)
• fd98d68 fix: crash when V8 optimises a call to a node:wasi import (#53265)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

High-level PR Summary

This PR bumps the electron development dependency from version 43.4.0 to 43.5.0, which includes numerous bug fixes related to crashes, rendering issues, and performance improvements across Windows, macOS, and Linux platforms. The update also brings in updated versions of Chromium (150.0.7871.250) and Node.js (v24.19.0), along with various startup time optimizations.

⏱️ Estimated Review Time: 15-30 minutes

💡 Review Order Suggestion

Order	File Path
1	desktop/package.json
2	package-lock.json

[ecc-tools]

ECC Tools / Security Evidence

Commit: cf44fc817455d15a4c69105956efe61ceea19ea2

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 2 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Risk Taxonomy

Commit: cf44fc817455d15a4c69105956efe61ceea19ea2

PR taxonomy review recommended (neutral)

Detected 2 PR taxonomy bucket(s): Install Manifest Integrity, CI/CD Recommendation.

Scanned 2 changed file(s).

Roadmap taxonomy buckets:

Install Manifest Integrity

Install manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance.

Signals:

• 1 install or manifest path(s) changed

Paths:

• package-lock.json

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

• 1 CI or workflow path(s) changed

Paths:

• package-lock.json

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Reference Set Readiness

Commit: cf44fc817455d15a4c69105956efe61ceea19ea2

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 2 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Hosted Promotion Readiness

Commit: cf44fc817455d15a4c69105956efe61ceea19ea2

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 2 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 726c19a6-2c6b-4664-b3b5-4482e89fdea4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}