chore(deps): bump electron to ^43.0.0 + npm audit fix#121
Merged
Conversation
Bumps Chromium from 138 to 148. Rationale: on some Linux + NVIDIA setups (Pop!_OS COSMIC + NVIDIA proprietary driver 580.159.03 observed 2026-07-07), Electron 40's Chromium 138 GPU process fails to load NVIDIA EGL via glvnd and disables all hardware acceleration, breaking WebGL2 and Neuroglancer. Electron 42 (Chromium 144) exhibits the same failure. Chromium 148 in standalone Flatpak Chrome and Firefox both work fine on the same driver stack, so we're matching Chromium 148 in Electron form (release 43.0.0, 2026-06-30). Command-line workarounds (--disable-gpu-sandbox, --no-sandbox, --use-gl=angle, --use-angle=gl, --ignore-gpu-blocklist) had no effect on either version; the libEGL loader failure happens before any of those flags apply. Verified locally: - npm install: clean - npm run typecheck: passes both node + web configs - npm run build: clean Manual UI smoke and packaging tests (build:linux, build:mac, build:win) not run here; called out for reviewer verification.
tavateva
force-pushed
the
chore/electron-42-bump
branch
from
July 7, 2026 17:18
367d6a4 to
76823fe
Compare
tavateva
changed the title
Clears 15 advisories (1 low, 7 moderate, 7 high) reported by 'npm audit' — includes tar path-traversal, vite server.fs.deny bypass, and launch-editor NTLM hash disclosure. Semver-compatible bumps only; no direct-dependency major upgrades.
tavateva
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Routine maintenance bumps, no functional change:
electron^40.1.0→^43.0.0— Chromium 138 → 148. Two commits ahead of what's already reviewed; typecheck + build clean.npm audit fix— clears 15 advisories reported at HEAD (1 low, 7 moderate, 7 high). Semver-compatible transitive-dependency bumps only; no direct-dependency majors touched. Notable CVEs cleared:tarpath-traversal (GHSA-ph9p-34f9-6g65)viteserver.fs.denybypass on Windows alternate paths (GHSA-fx2h-pf6j-xcff)launch-editorNTLMv2 hash disclosure via UNC path handling (GHSA-v6wh-96g9-6wx3)Why now
Electron 40 goes EOL in ~5 months. Electron 43 (current stable, Chromium 148) matches the Chromium version most Linux distros ship as standalone Chrome, gets us a broad batch of security patches, and puts us on a supported line for another year+.
The specific incident that prompted looking at Electron versions today turned out to be a workstation environment leak (
__EGL_VENDOR_LIBRARY_DIRSset by a stale Miniconda base env, hijacking glvnd's EGL dispatcher and forcing Mesa selection on an NVIDIA card), not an Electron issue. This PR does not fix or claim to fix that — that was a per-machine misconfiguration and is outside Ouroboros' scope. But the Electron bump is worth doing on its own merits, so keeping it.Verify
Locally:
npm install— cleannpm audit— 0 vulnerabilitiesnpm run typecheck— passes both node + web configsnpm run build— clean, 2.54sNot verified here (reviewer checklist):
npm run devopens a working window on a stock Linux dev machinenpm run build:linuxproduces a working AppImage / debnpm run build:macproduces a working notarized/signed app (macOS runners only)npm run build:winproduces a working installer (Windows runners only)Not in this diff
Package-lock updated to match. Reproducible via
rm package-lock.json && npm install.