Bump electron from 35.7.5 to 39.8.5

[dependabot]

Bumps electron from 35.7.5 to 39.8.5.

Release notes

Sourced from electron's releases.

electron v39.8.5

Release Notes for v39.8.5

Fixes

• Fixed a crash in clipboard.readImage() when the clipboard contains malformed image data. #50493 (Also in 40, 41, 42)
• Fixed a crash when calling an offscreen shared texture's release() after the texture object was garbage collected. #50499 (Also in 40, 41, 42)

electron v39.8.4

Release Notes for v39.8.4

Fixes

• Fixed an issue where nodeIntegrationInWorker overrides in setWindowOpenHandler were not honored for child windows sharing a renderer process with their opener. #50468 (Also in 38, 40, 41)
• Fixed crash when handling JavaScript dialogs from windows opened with invalid or empty URLs. #50400 (Also in 40, 41, 42)
• Fixed improper focus tracking in BaseWindow on MacOS. #50338 (Also in 40, 41, 42)
• Fixed window freeze when failing to enter/exit fullscreen on macOS. #50341 (Also in 40, 41, 42)

Other Changes

• Added support for using a proxy during yarn install. #50349 (Also in 40, 41, 42)
• Backported fix for 485935305. #50440
• Backported fix for 489381399. #50443
• Backported fix for chromium:475877320. #50436
• Backported fixes for 484751092, 487117772. #50461

electron v39.8.3

Release Notes for v39.8.3

Fixes

• Added additional ASAR support to additional fs copy methods. #50284 (Also in 40, 41, 42)
• Fixed user resizing of transparent windows on win32 platform. #50300 (Also in 40, 41, 42)

electron v39.8.2

Release Notes for v39.8.2

Other Changes

• Backported fix for b/491421267. #50230

electron v39.8.1

Release Notes for v39.8.1

Fixes

• Added validation to protocol client methods to reject protocol names that do not conform to the RFC 3986 URI scheme grammar. #50156 (Also in 38, 40, 41)
• Fixed an issue on macOS where calling autoUpdater.quitAndInstall() could fail if checkForUpdates() was called again after an update was already downloaded. #50215 (Also in 40, 41)
• Fixed an issue where Chrome Devtools menus may not appear in certain embedded windows. #50136 (Also in 40, 41)
• Fixed an issue where additionalData passed to app.requestSingleInstanceLock on Windows could be truncated or fail to deserialize in the primary instance's second-instance event. #50174 (Also in 38, 40, 41)
• Fixed an issue where screen.getCursorScreenPoint() crashed on Wayland when it was called before a BrowserWindow had been created. #50106 (Also in 40, 41)

... (truncated)

Commits

• 9d2f8cb refactor: remove dead named-window lookup from guest-window-manager (#50498)
• 1173004 fix: crash calling OSR shared texture release() after texture GC'd (#50499)
• be37ade fix: crash in clipboard.readImage() on malformed image data (#50493)
• 7007907 chore: cherry-pick 3 changes from chromium (#50461)
• 2c8b6ee chore: cherry-pick fbfb27470bf6 from chromium (#50436)
• 4c64377 chore: cherry-pick 50b057660b4d from chromium (#50440)
• 0ef0561 fix: read nodeIntegrationInWorker from per-frame WebPreferences (#50122) (#50...
• 64373df chore: cherry-pick 074d472db745 from chromium (#50443)
• 13e4407 fix: don't re-parse URL unnecessarily when handling dialogs (#50400)
• 16a0385 ci: output build cache hit rate as GHA annotation (#50369)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[atlas-commons-bot]

Atlas Commons PR review

Requirement	Status
DCO sign-off	pass
Required checks	warn
Summary filled	fail
Checklist	pass
Linked issue	warn

Overall: fail

• All commits include DCO sign-off.
• Required checks skipped.
• Summary section is empty or still has placeholder text.
• All checklist items ticked or none present.
• No linked issue (advisory).

View PR #17 · Atlas-Commons/StreamBooru

[atlas-commons-bot]

Atlas Commons code review (LLM)

Summary

This PR bumps electron from ^35.7.5 to ^39.8.5 in package.json and package-lock.json only. That is a four-major-version jump (Chromium/Node upgrades, security backports). The app uses standard Electron APIs (BrowserWindow, ipcMain/contextBridge, session.webRequest, net.request, dialog, shell) with contextIsolation: true and sandbox: true in electron/main.js. There are no native Node addons in the Electron path, so the diff itself is low risk. CI (ci.github.yml) does not exercise Electron — only server/tag smoke tests — so compatibility will not be proven by the PR checks alone.

Potential issues

1. No automated Electron validation in CI. Required CI runs npm run test:server and npm run test:tags only; it never runs electron ., electron-builder --dir, or a packaged startup smoke test. A 35→39 bump can pass CI while desktop builds or runtime behavior regress.

2. Large major-version gap increases manual QA surface. Electron 39 ships a much newer Chromium/V8 stack than 35. Paths worth exercising before merge: feed fetch (booru:fetch), image proxy/hotlink headers (session.webRequest in electron/main.js), save/bulk download dialogs (dialog.showSaveDialogSync / showOpenDialogSync), Discord OAuth loopback (account:loginDiscord), and SSE sync (net.request in openEventStream).

3. Linux save-dialog defaultPath behavior. electron/main.js passes defaultPath to showSaveDialogSync. On Linux with xdg-desktop-portal backends below v4, Electron has documented limitations for defaultPath on portal file choosers (behavior change since v35). Worth confirming on a representative Linux desktop (GNOME/KDE, X11 and Wayland via ELECTRON_OZONE_PLATFORM_HINT in scripts/install.sh).

4. Packaged-app startup should be verified on Electron 39. A local electron-builder --dir build with 39.x produced a bundle that crashes at startup because electron/main.js requires ../server/src/refererFor, while electron-builder.yml does not include server/** in files. That looks pre-existing, not introduced by this PR, but it is exactly the kind of failure an upgrade smoke test should catch:

Error: Cannot find module '../server/src/refererFor'
Require stack:
- .../resources/app.asar/electron/main.js

5. Known video codec limitation may persist. CHANGELOG.md documents MP4/H.264 playback issues in Electron builds without proprietary codecs. Moving to 39.x may change bundled FFmpeg but is unlikely to fix this without extra packaging steps; lightbox video playback should still be spot-checked.

Suggestions

Add a lightweight CI step (or pre-release gate) such as npx electron-builder --dir followed by a headless/Xvfb launch of the unpacked binary, so Electron upgrades are not validated only at tag time in release.github.yml.

Before merging, run a short manual checklist on at least one Linux and one Windows build: app launch, browse a feed, open lightbox, download an image, and (if used) Discord login/link flow.

If packaged builds fail the refererFor import, fix packaging separately: either add server/src/refererFor.js to electron-builder.yml files, or change electron/main.js to require the already-bundled src/shared/refererFor.js (with appropriate CJS/ESM handling).

Consider a follow-up PR for electron-builder (still pinned at ^24.13.3 while release workflows reinstall electron-builder@^24). Not a blocker for this bump, but newer builder versions are exercised more heavily against current Electron releases.

Document the upgrade in CHANGELOG.md under Unreleased so the next release notes reflect the runtime/security impact for packagers (AUR, Flatpak, tarball installers).

Overall assessment

The dependency change is mechanically correct and aligns with Electron’s support policy (35.x is well behind current releases). Security and stability fixes in 36–39 are a strong reason to upgrade. The PR is reasonable to merge once Electron-specific validation is done — ideally a packaged --dir smoke test plus targeted manual QA on dialogs, networking, and OAuth — because CI alone will not catch desktop regressions. I would treat this as merge after validation, not a blind dependency-only merge.

---

Advisory review only — not a merge approval.

View PR #17 · Atlas-Commons/StreamBooru