Bumps electron from 42.10.0 to 42.11.3.

Release notes

Sourced from electron's releases.

electron v42.11.3

Release Notes for v42.11.3

Fixes

• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53695 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53736 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53497 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53511 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53585 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53541 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53674 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53727 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• 
  <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53719 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• 
  getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53710 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• 
  nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53713 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• 
  openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53697 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• 
  pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53702 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->

electron v42.11.2

Release Notes for v42.11.2

Fixes

• Fixed application crash after a large number of IPC messages from renderers. #53419 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53394 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53480
  


• Backported fixes from upstream Chromium, Dawn, Skia and V8. #53397
  


• Backported fixes from upstream Chromium, V8, ANGLE, Dawn, Skia, WebRTC and DevTools. #53367
  

electron v42.11.1

Release Notes for v42.11.1

Fixes

• Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get. #53355 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed a renderer crash when an array with a throwing property getter is passed across contextBridge, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps. #53329 <!-- raw HTML omitted -->(Also in 43, 44)<!-- raw HTML omitted -->

Other Changes

• Security: backported fixes for CVE-2026-15764, CVE-2026-15765, CVE-2026-15766, CVE-2026-15767, CVE-2026-15768, CVE-2026-15769, CVE-2026-15770, CVE-2026-15771, CVE-2026-15772, CVE-2026-15773, CVE-2026-15774, CVE-2026-15775, CVE-2026-15776, CVE-2026-15777, CVE-2026-15778. #53344
  

electron v42.11.0

Release Notes for v42.11.0

Fixes

• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53318 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->


• Fixed a crash when calling node:wasi functions in optimized code. #53267 <!-- raw HTML omitted -->(Also in 43, 44, 45)<!-- raw HTML omitted -->

<!-- raw HTML omitted -->

... (truncated)

Commits

• 
  22de0a3 fix: report the requesting frame for hid and usb permission checks (42-x-y) (...


• 
  16c4536 test: run the Squirrel.Mac updater specs off a signed template, split, and se...


• 
  65d777e fix: check the sending frame for internal guest, window and reply IPCs (42-x-...


• 
  a86ae42 fix: route modifier-click and OpenURLFromTab popups through the window-open p...


• 
  f8600c9 fix: require a registered source id for webContents capture via getUserMedia ...


• 
  900eabb fix: gate preload and worker Node integration on the creating frame (42-x-y) ...


• 
  3275df6 fix: scope File System Access grants to the requesting document (42-x-y) (#53...


• 
  004b4ab fix: attribute pointer lock, keyboard lock and paste checks to the requesting...


• 
  e0a20d5 fix: attribute openExternal permission requests to the navigation's initiator...


• 
  951b50f fix: resolve the capturing webContents in setDisplayMediaRequestHandler (#53674)


• Additional commits viewable in compare view
  

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/vscode/network/alerts).