socket-security[bot]
commented
1 year ago Socket Security Pull Request Report
Dependency issues detected: If you merge this pull request, you will not be alerted to the instances of these issues again.
📜 Install scripts
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
| Package | Script field | Source |
|---|---|---|
| electron@23.1.4 (upgraded) | postinstall |
package-lock.json, package.json via @electron/remote@2.0.9, spectron@19.0.0 |
Pull request report summary
| Issue | Status |
|---|---|
| Install scripts | ⚠️ 1 issue |
| Native code | ✅ 0 issues |
| Bin script shell injection | ✅ 0 issues |
| Unresolved require | ✅ 0 issues |
| Invalid package.json | ✅ 0 issues |
| HTTP dependency | ✅ 0 issues |
| Git dependency | ✅ 0 issues |
| Potential typo squat | ✅ 0 issues |
| Known Malware | ✅ 0 issues |
| Telemetry | ✅ 0 issues |
| Protestware/Troll package | ✅ 0 issues |
Bot Commands
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore electron@23.1.4
Powered by socket.dev
This PR contains the following updates:
15.5.7->23.1.4Release Notes
electron/electron
### [`v23.1.4`](https://togithub.com/electron/electron/releases/tag/v23.1.4): electron v23.1.4 [Compare Source](https://togithub.com/electron/electron/compare/v23.1.3...v23.1.4) ### Release Notes for v23.1.4 #### Fixes - Fixed an issue where unhandled rejections could cause duplicate logs in some cases. [#37501](https://togithub.com/electron/electron/pull/37501) (Also in [22](https://togithub.com/electron/electron/pull/37502), [24](https://togithub.com/electron/electron/pull/37500)) #### Other Changes - Updated Chromium to 110.0.5481.192. [#37533](https://togithub.com/electron/electron/pull/37533) ### [`v23.1.3`](https://togithub.com/electron/electron/releases/tag/v23.1.3): electron v23.1.3 [Compare Source](https://togithub.com/electron/electron/compare/v23.1.2...v23.1.3) ### Release Notes for v23.1.3 #### Fixes - Fixed WebUSB on ARM64 macs. [#37521](https://togithub.com/electron/electron/pull/37521) (Also in [24](https://togithub.com/electron/electron/pull/37522)) - Fixed a crash on capturing sources when using desktopCapturer API on Wayland. [#37526](https://togithub.com/electron/electron/pull/37526) #### Other Changes - Updated Chromium to 110.0.5481.179. [#37471](https://togithub.com/electron/electron/pull/37471) ### [`v23.1.2`](https://togithub.com/electron/electron/releases/tag/v23.1.2): electron v23.1.2 [Compare Source](https://togithub.com/electron/electron/compare/v23.1.1...v23.1.2) ### Release Notes for v23.1.2 #### Fixes - Fixed `destroyed` event not emitted on `close` for `BrowserView.webContents`. [#37451](https://togithub.com/electron/electron/pull/37451) (Also in [24](https://togithub.com/electron/electron/pull/37450)) - Fixed an incorrect result returned when using secure as a cookies filter. [#37248](https://togithub.com/electron/electron/pull/37248) (Also in [22](https://togithub.com/electron/electron/pull/37247), [24](https://togithub.com/electron/electron/pull/37246)) - Fixed an issue where `minWidth`/`minHeight` and `maxWidth`/`maxHeight` would not be enforced if the user set an `aspectRatio` on macOS. [#37457](https://togithub.com/electron/electron/pull/37457) (Also in [22](https://togithub.com/electron/electron/pull/37458), [24](https://togithub.com/electron/electron/pull/37456)) - Fixed an issue where passing both `hasReply` and `actions` to a main process Notification on macOS resulted in the first action being obscured and unavailable. [#37448](https://togithub.com/electron/electron/pull/37448) (Also in [22](https://togithub.com/electron/electron/pull/37447), [24](https://togithub.com/electron/electron/pull/37449)) - Fixed draggable regions not working in Mac App Store builds. [#37473](https://togithub.com/electron/electron/pull/37473) (Also in [24](https://togithub.com/electron/electron/pull/37474)) - Fixed right-click events not being delivered in frameless window draggable regions. [#37394](https://togithub.com/electron/electron/pull/37394) (Also in [24](https://togithub.com/electron/electron/pull/37395)) #### Other Changes - Improved error messages for `contents.takeHeapSnapshot`. [#37460](https://togithub.com/electron/electron/pull/37460) (Also in [22](https://togithub.com/electron/electron/pull/37459), [24](https://togithub.com/electron/electron/pull/37461)) - Updated Chromium to 110.0.5481.177. [#37389](https://togithub.com/electron/electron/pull/37389) ### [`v23.1.1`](https://togithub.com/electron/electron/releases/tag/v23.1.1): electron v23.1.1 [Compare Source](https://togithub.com/electron/electron/compare/v23.1.0...v23.1.1) ### Release Notes for v23.1.1 #### Fixes - Corrects an issue with HTML fullscreen when `BrowserWindow` fullscreening is disabled. [#37367](https://togithub.com/electron/electron/pull/37367) (Also in [24](https://togithub.com/electron/electron/pull/37368)) - Fixed potential private API usage for MAS builds on macOS. [#37363](https://togithub.com/electron/electron/pull/37363) (Also in [24](https://togithub.com/electron/electron/pull/37364)) - Fixed window could not go back to maximized state when restored on Linux. [#37359](https://togithub.com/electron/electron/pull/37359) (Also in [24](https://togithub.com/electron/electron/pull/37358)) #### Other Changes - Security: backported fix for chromium:1408392. [#37297](https://togithub.com/electron/electron/pull/37297) - Updated Chromium to 110.0.5481.104. [#37333](https://togithub.com/electron/electron/pull/37333) #### Documentation - Documentation changes: [#37290](https://togithub.com/electron/electron/pull/37290) ### [`v23.1.0`](https://togithub.com/electron/electron/releases/tag/v23.1.0): electron v23.1.0 [Compare Source](https://togithub.com/electron/electron/compare/v23.0.0...v23.1.0) ### Release Notes for v23.1.0 #### Features - Added several standard page size options to `webContents.print()`. [#37264](https://togithub.com/electron/electron/pull/37264) (Also in [22](https://togithub.com/electron/electron/pull/37263), [24](https://togithub.com/electron/electron/pull/37265)) #### Fixes - Changed HTML5 Notifications created with the `requireInteraction` option to not timeout on Linux and Windows. [#36502](https://togithub.com/electron/electron/pull/36502) (Also in [21](https://togithub.com/electron/electron/pull/36503), [22](https://togithub.com/electron/electron/pull/36501)) - Fixed a crash when `BrowserView`s are present and a user attempts to prevent `beforeunload` in the renderer process. [#37267](https://togithub.com/electron/electron/pull/37267) (Also in [22](https://togithub.com/electron/electron/pull/37266), [24](https://togithub.com/electron/electron/pull/37268)) - Fixed a potential crash in some types of Worklets. [#37081](https://togithub.com/electron/electron/pull/37081) #### Other Changes - Updated Chromium to 110.0.5481.100. [#37183](https://togithub.com/electron/electron/pull/37183) #### Documentation - Documentation changes: [#37108](https://togithub.com/electron/electron/pull/37108) ### [`v23.0.0`](https://togithub.com/electron/electron/releases/tag/v23.0.0): electron v23.0.0 [Compare Source](https://togithub.com/electron/electron/compare/v22.3.3...v23.0.0) ### Release Notes for v23.0.0 #### Stack Upgrades - Chromium 110.0.5481.77. - [New in 110](https://developer.chrome.com/blog/new-in-chrome-110/) - [New in 109](https://developer.chrome.com/blog/new-in-chrome-109/) - Node v18.12.1. - [v16.17.1 release notes](https://nodejs.org/en/blog/release/v18.12.1/) - V8 v11.0 #### Breaking Changes - Windows 7, Windows 8, and Windows 8.1 are not supported anymore, as Chromium 110 dropped support. [#36513](https://togithub.com/electron/electron/pull/36513) #### Features - Added `label` property to `Display` objects. [#36933](https://togithub.com/electron/electron/pull/36933) (Also in [21](https://togithub.com/electron/electron/pull/36931), [22](https://togithub.com/electron/electron/pull/36932)) - Added an `app.getPreferredSystemLanguages()` API to return the user's system languages. [#36035](https://togithub.com/electron/electron/pull/36035) (Also in [21](https://togithub.com/electron/electron/pull/36290), [22](https://togithub.com/electron/electron/pull/36291)) - Added new UtilityProcess API to launch chromium child process with node integration. [#34980](https://togithub.com/electron/electron/pull/34980) (Also in [22](https://togithub.com/electron/electron/pull/36089)) - Added support for WebUSB. [#36289](https://togithub.com/electron/electron/pull/36289) - Added support for `serialPort.forget()` as well as a new event `serial-port-revoked` emitted when a given origin is revoked. [#35310](https://togithub.com/electron/electron/pull/35310) (Also in [22](https://togithub.com/electron/electron/pull/36062)) - Adds new `setHiddenInMissionControl` API to allow developers to opt out of mission control on macOS. [#36092](https://togithub.com/electron/electron/pull/36092) (Also in [22](https://togithub.com/electron/electron/pull/36390)) #### Fixes - Basic accessibility support is now enabled when macOS Voice Control is activated to allow for full voice control of Electron applications. [#37145](https://togithub.com/electron/electron/pull/37145) - Fixed a printing crash caused by an uninitialized pref. [#37149](https://togithub.com/electron/electron/pull/37149) - Default margin has been added in the code. [#36060](https://togithub.com/electron/electron/pull/36060) (Also in [21](https://togithub.com/electron/electron/pull/36072), [22](https://togithub.com/electron/electron/pull/36073)) - Doing `require('electron/*')` where `*` is not one of `main`, `common` or `renderer` no longer resolves with the built-in `electron` module. [#35915](https://togithub.com/electron/electron/pull/35915) - Enable crashpad for ELECTRON_RUN_AS_NODE processes. [#36460](https://togithub.com/electron/electron/pull/36460) (Also in [22](https://togithub.com/electron/electron/pull/36483)) - Fixed `click` event and tooltip of `Tray` not working on Linux. [#36333](https://togithub.com/electron/electron/pull/36333) (Also in [22](https://togithub.com/electron/electron/pull/36472)) - Fixed a crash that could occur when running eval in inline scripts in unsandboxed renderer processes. [#36667](https://togithub.com/electron/electron/pull/36667) (Also in [22](https://togithub.com/electron/electron/pull/36668)) - Fixed a drag-and-drop issue on macOS where items would be incorrectly moved instead of copied in some contexts. [#35963](https://togithub.com/electron/electron/pull/35963) (Also in [20](https://togithub.com/electron/electron/pull/35978), [21](https://togithub.com/electron/electron/pull/35977), [22](https://togithub.com/electron/electron/pull/35976)) - Fixed a potential issue when calling `webContents.printToPDF()`. [#36046](https://togithub.com/electron/electron/pull/36046) (Also in [21](https://togithub.com/electron/electron/pull/36064), [22](https://togithub.com/electron/electron/pull/36065)) - Fixed a potential memory leak. [#35932](https://togithub.com/electron/electron/pull/35932) (Also in [21](https://togithub.com/electron/electron/pull/35965), [22](https://togithub.com/electron/electron/pull/35964)) - Fixed an RTL issue that could happen in some locales when calling `BrowserWindow.setTrafficLightPosition()` on macOS. [#36850](https://togithub.com/electron/electron/pull/36850) (Also in [21](https://togithub.com/electron/electron/pull/36852), [22](https://togithub.com/electron/electron/pull/36851)) - Fixed an error when fs.readdir gets null for options. [#36848](https://togithub.com/electron/electron/pull/36848) (Also in [21](https://togithub.com/electron/electron/pull/36846), [22](https://togithub.com/electron/electron/pull/36849)) - Fixed an issue on macOS when trying to switch processes with `Cmd+Tab` after exiting Kiosk Mode. [#36917](https://togithub.com/electron/electron/pull/36917) (Also in [21](https://togithub.com/electron/electron/pull/36919), [22](https://togithub.com/electron/electron/pull/36918)) - Fixed an issue where `