chore(deps): Electron 42, and the binary fetch its install no longer does

[mindaugaskasp]

Blocks any release, not just this one: the release workflow audits before spending build minutes, and Electron 39 is out of support — which is why neither advisory against it has an in-line patch.

advisory	where it bites
GHSA-jmr9-qjv8-65gv — extract-zip symlink traversal	build-time only, never shipped. Gone in Electron 40+
GHSA-9f4c-93c8-jc8g — sandboxed iframe bypasses allow-popups	the shipped runtime, present through 41.10.2

42.9.0 is the nearest line clear of both — npm audit reports zero. (43 exists; this stops at the first clean major rather than taking two.)

The part the advisory doesn't tell you

Electron 42 dropped its postinstall. The binary now downloads on the first require('electron') instead of at install time, and three places assumed otherwise:

• The Docker image. Its node_modules volume is populated from the image layer, and the dev server asks electron-vite for the path — which reads path.txt and throws rather than fetching. That surfaced as Error: Electron uninstall and a container that exits on boot.
• The CI and release e2e jobs. require('electron') does trigger the download, but inside the first test, where it reads as a mystery timeout.

Each now fetches it explicitly after install. Verified from scratch: docker compose down -v, rebuild, binary present in the fresh volume, container healthy.

Verified on 42.9.0

• npm audit — 0 vulnerabilities
• npm run check — 3476 tests, coverage unchanged (95.39 / 88.33 / 95.89 / 96.48)
• Full e2e in the container — 512 passed, 3 skipped (macOS-gated)
• The macOS-gated quick-look-window-recovery specs run natively — window lifecycle is the riskiest surface for a major bump
• theme-sweep — 100 measurements across all 20 themes
• npm run build:mac — a complete .dmg
• The release's own install-warning ratchet — 4 warnings, all already acknowledged

allowScripts is re-pinned to electron@42.9.0, so the new version was re-reviewed rather than inheriting the old approval.

🤖 Generated with Claude Code