build(deps-dev): bump electron from 42.3.3 to 42.10.0

[dependabot]

Bumps electron from 42.3.3 to 42.10.0.

Release notes

Sourced from electron's releases.

electron v42.10.0

Release Notes for v42.10.0

Features

• Fixed contentTracing module to capture Node.js trace categories. #52973

Fixes

• Fixed DevTools device metrics overrides persisting indefinitely when a remote debugging client disconnected without clearing them. #53133 (Also in 43, 44)
• Fixed DevTools popup and context menus not appearing when DevTools is hosted in a custom window via webContents.setDevToolsWebContents(). #52981 (Also in 43, 44)
• Fixed BrowserWindow.unmaximize() and restore() having no effect on Wayland when the window was maximized immediately after creation. #53126 (Also in 44)
• Fixed Uncaught illegal access errors and possible renderer crashes after closing a same-process child window or removing an iframe with nodeIntegrationInSubFrames enabled. #53042 (Also in 44)
• Fixed dialog.showOpenDialog/dialog.showSaveDialog opening at an unusable location on Linux when defaultPath is a bare filename without a directory. #52980 (Also in 43, 44)
• Fixed a crash on Linux when the D-Bus session bus disconnected while the app was running, such as at logout or when dbus is restarted. #53094 (Also in 43, 44)
• Fixed a crash on Windows when V8 posted a delayed worker task during shutdown. #53014 (Also in 43)
• Fixed a crash with app.setLoginItemSettings if a non-UTF8 service name is used. #52989 (Also in 43, 44)
• Fixed a possible crash (SIGABRT) during process exit when the process had loaded tls/https shortly before exiting, affecting app.exit() before ready and short-lived ELECTRON_RUN_AS_NODE / child_process.fork() scripts. #52992 (Also in 43, 44)
• Fixed a possible main process crash at quit when a session was created from JavaScript that runs during shutdown. #53132 (Also in 43, 44)
• Fixed a rare crash in the main process when DevTools were opened and a garbage collection ran before the DevTools frontend finished loading. #52994 (Also in 43, 44)
• Fixed a renderer crash when a page calls SpeechRecognition.available() or SpeechRecognition.install() with processLocally. #53016 (Also in 43, 44)
• Fixed an issue on Linux where the system theme color appeared at the top edge of frameless windows. #52978 (Also in 41, 43)
• Fixed an issue where some values passed into requestSingleInstanceLock could result in a crash. #52982 (Also in 43, 44)
• Fixed crash in sharedTexture module when GPU context becomes unavailable. #52983 (Also in 43, 44)
• Fixed document title updates when using back/forward navigation using the same document without utilizing browserWindow.setTitle(). #53099 (Also in 43, 44)
• Fixed the built-in PDF viewer not rendering documents in in-memory sessions (partitions without the persist: prefix). #52990 (Also in 43, 44)
• Fixed titleBarOverlay.color set to rgba(0,0,0,0) failing back to default frame color. #52976 (Also in 41, 43)
• Fixed utility process crashes at exit on Windows 11 24H2 and later. #53091 (Also in 43, 44)

Other Changes

• Backported fixes from upstream Chromium and V8. #53060
• Fixed a 1-in-200 chance per renderer process on Windows of scripts on the first page load being compiled without their V8 code cache. #52988 (Also in 43, 44)
• Fixed a Windows x64 renderer performance regression introduced in 42.8.1 that made style/layout work (and app startup) noticeably slower. #53064
• Fixed a stall of tens of milliseconds while creating the first BrowserWindow on Linux.
  • Improved the performance of file lookups inside ASAR archives and of large files served from them to the renderer.
  • Improved the performance of calls through contextBridge-exposed APIs.
  • Reduced the main-thread cost of sending large values through ipcRenderer, ipcMain handlers and webContents.send. #53019 (Also in 43, 44)
• Improved startup time of utilityProcess.fork(), child_process.fork() / ELECTRON_RUN_AS_NODE child processes and Node.js-enabled renderers. #53136 (Also in 43, 44)
• Linux arm64, Windows arm64 and macOS x64 builds now start the main process from the embedded Node.js startup snapshot like the other platforms, improving startup time. #52880 (Also in 43, 44)

electron v42.9.3

Release Notes for v42.9.3

Fixes

• Fixed a graphical glitch on Linux where thin borders appeared past the drop shadows on frameless windows when multiple windows were created. #52772 (Also in 43, 44)
• Fixed a memory leak when creating BrowserWindows. #52893 (Also in 43, 44)
• Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52900 (Also in 41, 43, 44)
• Fixed custom V8 snapshots (electron-mksnapshot, and the loadBrowserProcessSpecificV8Snapshot fuse) having no effect in the main process on macOS arm64, Linux x64 and Windows x64. #52876 (Also in 43, 44)

Other Changes

... (truncated)

Commits

• 9f01096 fix: window stuck maximized on Wayland after early maximize() (#53126)
• c411b7c perf: boot every Node.js-hosting process from the Node snapshot / code cache ...
• 5751bc5 fix: clear device metrics overrides when a DevTools client disconnects (#53133)
• 277efdf fix: crash in gin::PerIsolateData::NotifyDisposed when a session is created d...
• d054052 chore: iwyu commonly-included headers in shell/ (#52972)
• 1645b08 build: update PGO profiles (#53119)
• e4ea00f build: update PGO profiles (#53113)
• b5c236f fix: update document title on back or forward navigation (#53099)
• 569c64a build: skip linux-arm in PGO profile generation (#53111)
• d13ae9f fix: illegal access errors when a same-process child window or subframe close...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	electron@​42.3.3 ⏵ 42.10.0		+50	+1

View full report

[claude]

Looks good, straightforward devDependency version bump. Reviewed: package.json electron constraint bump (^42.3.3 to ^42.10.0), yarn.lock resolution to 42.10.0, and the incidental extract-zip -> @ electron-internal/extract-zip dependency shift inside electron's own metadata (upstream packaging change, not something this repo needs to react to).

Extended reasoning...

The diff only touches package.json and yarn.lock, bumping the electron devDependency from ^42.3.3 to ^42.10.0 and updating the lockfile's resolved version and transitive dependency entries accordingly. No application source code changed, and electron is a devDependency (Electron runtime for building/running the desktop app), not a security-sensitive runtime dependency like auth or crypto code. The lockfile change matches exactly what the PR description claims (extract-zip replaced by @ electron-internal/extract-zip inside electron's own dependency tree, an upstream packaging detail). This is a mechanical, low-risk dependabot version bump with no ambiguity, so high confidence a human does not need to review it.