fix: intermittent certificate errors for concurrent requests with setCertificateVerifyProc (43-x-y) by MarshallOfSound · Pull Request #55047 · electron/electron

MarshallOfSound · 2026-10-16T08:09:12Z

Backport of #55028

See that PR for details. The network-service patch is regenerated against this branch's Chromium.

Notes: Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host.

…CertificateVerifyProc (#55028) With a verify proc installed, two requests to the same host issued together on a fresh session could disagree: one went through the proc while the other occasionally completed on Chromium's own verification result, e.g. failing with ERR_CERT_AUTHORITY_INVALID even though the proc accepts the certificate. RemoteCertVerifier only forwarded a verification to the proc from the upstream verifier's completion callback, which is not run when the upstream verifier answers synchronously (a cache hit in the inner CachingCertVerifier while an earlier verification of the same certificate is still waiting on the proc). Forward synchronous upstream results to the proc as well. (cherry picked from commit 33cce89)

release-clerk · 2026-10-16T19:28:30Z

Release Notes Persisted

Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host.

Electron 43.8.1 contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates. It also makes link-opened windows use the opener's session and webPreferences (electron/electron#55049), and setCertificateVerifyProc is no longer skipped for a request issued concurrently with the first request to a host (electron/electron#55047). 43.8.3, the newest 43.x release, adds electron/electron#55147: 64 upstream cherry-picks from ANGLE, Chromium, PDFium, Skia and V8, including use-after-free fixes and "[net] Validate server certificate before generating auth token". It embeds the same Node.js 24.22.0, so the modules ABI stays 148. Update every pin together so the release-input gates agree, as #191 did: - the package.json devDependency and allowScripts entry, and package-lock.json (npm install --save-exact electron@43.8.3); - electron.version in release/linux-inputs.json, release/macos-inputs.json and release/windows-inputs.json, and PINNED_ELECTRON_VERSION in scripts/windows-release-inputs.mjs; - the linux-inputs.json SHA-256 pinned by the AppImage (x64, arm64) and DEB contracts, and their tests; - the tests that compare with the real pins, and the release docs. Test placeholders that never compare with the real pin, and historical records, keep 43.8.0. How Electron's downloads are checked: the release build does not use the npm package's checksums.json. The three thin-app builders call packager() without a download or electronZipDir option, so @electron/get checks each zip only against the release's live SHASUMS256.txt. At bump time all 75 checksums.json entries matched the official v43.8.3 SHASUMS256.txt, and the five packaged zips also match GitHub's asset digests. Pinning the build to checksums.json is tracked in #363. The #135 fix now comes from Node.js itself: Electron dropped its electron/electron#53393 backport when 43.8.0 moved to Node.js 24.22.0 (electron/electron#55003), because 24.22.0 carries the cleanup-hook registry fix. 43.7.11 is the last release with the patches. docs/macos-release.md and the electron-sqlite-check abort message now say so. nodejs/node#65446 is still open, and the portable runtime keeps its 24.18.1 hold (#362). Every packaging job's allocation-driven SQLite check passed under Electron 43.8.3 with Node v24.22.0 (ABI 148): the Linux folders, AppImage and DEB on x64 and arm64, both macOS thin apps (native Intel included), and the Windows native folder and MSI folders. The Electron executable still needs glibc 2.25 on Linux x64 and arm64. Supersedes #355. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9e7ec7a7-8690-49e5-9d55-492fedc3027a

##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0) ### Release Notes for v44.9.0 #### Features - Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) (Also in [45](https://github.com/electron/electron/pull/55072)) #### Fixes - Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) (Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051)) - Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) (Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045)) ##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0) ### Release Notes for v44.8.0 #### Features - Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) (Also in [45](https://github.com/electron/electron/pull/54889)) #### Fixes - Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987) - Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) (Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910)) - Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) (Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956)) - Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) (Also in [45](https://github.com/electron/electron/pull/55008)) #### Other Changes - Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034) - Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928) - Updated Node.js to v24.22.0. [#55004](electron/electron#55004) ##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2) ### Release Notes for v44.7.2 #### Fixes - Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) (Also in [45](https://github.com/electron/electron/pull/54818)) - Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) (Also in [45](https://github.com/electron/electron/pull/54843)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898) #### Documentation - Documentation changes: [#54880](electron/electron#54880) ##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1) ### Release Notes for v44.7.1 #### Fixes - Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) (Also in [45](https://github.com/electron/electron/pull/54781)) - Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) (Also in [45](https://github.com/electron/electron/pull/54846)) - Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798) - Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) (Also in [45](https://github.com/electron/electron/pull/54848)) - Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) (Also in [45](https://github.com/electron/electron/pull/54864)) #### Other Changes - Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) (Also in [45](https://github.com/electron/electron/pull/54803)) - Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085) ##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0) ### Release Notes for v44.7.0 #### Features - The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204) #### Fixes - Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666) - Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657) ##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0) ### Release Notes for v44.6.0 #### Features - Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) (Also in [45](https://github.com/electron/electron/pull/54521)) #### Fixes - Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596) - Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) (Also in [45](https://github.com/electron/electron/pull/54615)) - Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) (Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585)) - Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623) #### Documentation - Documentation changes: [#54589](electron/electron#54589)

MarshallOfSound requested a review from a team as a code owner October 16, 2026 08:09

MarshallOfSound added backport This is a backport PR semver/patch backwards-compatible bug fixes 43-x-y labels Oct 16, 2026

trop Bot mentioned this pull request Oct 16, 2026

fix: intermittent certificate errors for concurrent requests with setCertificateVerifyProc #55028

Merged

5 tasks done

MarshallOfSound force-pushed the bp/43-x-y/cert-verify-proc-concurrent branch from 3da6f5e to fd84b79 Compare October 16, 2026 08:09

MarshallOfSound self-assigned this Oct 16, 2026

claude Bot mentioned this pull request Oct 16, 2026

ci: skip native builds when installing deps for type generation #55065

Merged

MarshallOfSound enabled auto-merge (squash) October 16, 2026 19:26

samuelmaddock approved these changes Oct 16, 2026

View reviewed changes

MarshallOfSound merged commit 0a3d279 into 43-x-y Oct 16, 2026
71 checks passed

MarshallOfSound deleted the bp/43-x-y/cert-verify-proc-concurrent branch October 16, 2026 19:28

kokbee mentioned this pull request Oct 23, 2026

fix(network): block compromised eMudhra CAs with patched Electron stablyai/orca#31383

Closed

8 of 9 tasks

shariqh mentioned this pull request Oct 24, 2026

Update Electron to 43.8.3 for the eMudhra certificate fix and upstream cherry-picks shariqh/agent-inbox#360

Merged

Navigation Menu

Repository navigation

fix: intermittent certificate errors for concurrent requests with setCertificateVerifyProc (43-x-y) - #55047

fix: intermittent certificate errors for concurrent requests with setCertificateVerifyProc (43-x-y)#55047
MarshallOfSound merged 1 commit into
43-x-yfrom
bp/43-x-y/cert-verify-proc-concurrent

MarshallOfSound commented Oct 16, 2026

Uh oh!

Uh oh!

release-clerk Bot commented Oct 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

MarshallOfSound commented Oct 16, 2026

Uh oh!

Uh oh!

release-clerk Bot commented Oct 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants