Skip to main content
Version: 4.36.1

Electron 42 Upgrade & Security Dependency Patches

Version: 4.36.1 Date: 2026-06-15

Goal: Keep the desktop runtime on a supported Electron release with the latest Chromium 148 security patches, and clear transitive vulnerabilities without breaking enterprise proxy compatibility.

Solution: Upgrade Electron and its build/update tooling, then patch transitive CVEs via npm overrides instead of upgrading the frozen Google authentication stack.

Features:

  • Electron 41 → 42.4.0 (Chromium 148, Node 24.15)
  • electron-builder and electron-builder-squirrel-windows → 26.15.3
  • electron-updater → 6.8.9

Implementation Details:

  • npm override uuid@^11.1.1 patches CVE-2026-41907 (buffer bounds) while keeping google-auth-library@9.x untouched
  • npm override form-data@^4.0.6 fixes a CRLF injection vulnerability
  • google-auth-library stays pinned at 9.15.1 for ADEO corporate proxy compatibility (HTTP stack change in v10 breaks the proxy)
  • prop-types added as a devDependency to restore webpack resolution after the lockfile refresh
  • Minimum OS unchanged (macOS 12+); macOS notifications now require a signed app (Electron 42 UNNotification API)

Files Modified:

  • package.json - Electron stack bump, uuid/form-data overrides, prop-types
  • package-lock.json - Lockfile sync
  • readme.md - Update Notes for Electron 38–42