[coder]

Bumps electron from ^39.2.4 (locked 39.2.4) to ^45.2.1 to patch CVE-2026-111497 (Node2Shell / HTTP2Shell), a Brotli decoder RCE.

• Electron builds Node against Chromium's Brotli, so the fix arrives via Chromium 148+ (Electron 42+). Every 39.x is still vulnerable, so a patch bump within 39 isn't enough.
• Lockfile changes are limited to Electron's own dependency tree (@electron/get 2 -> 5, @types/node 22 -> 24 for electron).
• src/electron/main.ts only uses stable APIs (BrowserWindow, shell, Menu, dialog, nativeTheme), with sandbox/contextIsolation already on. I didn't find anything in the 40-45 breaking changes that touches it.

Validation

• bun run fmt:check, typecheck, lint, test pass (44/44).
• scripts/build-electron.ts + electron-builder --linux dir package with electron=45.2.1; the packaged binary contains the patched BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH decoder marker.
• Not smoke-tested with a GUI launch (headless workspace).

Follow-up: existing desktop installs stay vulnerable until a new v* tag is cut so release.yml publishes fresh builds and electron-updater pulls them.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pulldash	Ready	Preview	Nov 2, 2026 4:26pm UTC