fix: use the opener's session and webPreferences for windows opened from links (43-x-y) - #55049

Electron 43.8.1 contains the fix for GHSA-jr5w-w6x2-84p9, the
mitigation for compromised eMudhra intermediate certificates. It also
makes link-opened windows use the opener's session and webPreferences
(electron/electron#55049), and setCertificateVerifyProc is no longer
skipped for a request issued concurrently with the first request to a
host (electron/electron#55047). 43.8.3, the newest 43.x release, adds
electron/electron#55147: 64 upstream cherry-picks from ANGLE,
Chromium, PDFium, Skia and V8, including use-after-free fixes and
"[net] Validate server certificate before generating auth token". It
embeds the same Node.js 24.22.0, so the modules ABI stays 148.

Update every pin together so the release-input gates agree, as #191
did:
- the package.json devDependency and allowScripts entry, and
  package-lock.json (npm install --save-exact electron@43.8.3);
- electron.version in release/linux-inputs.json,
  release/macos-inputs.json and release/windows-inputs.json, and
  PINNED_ELECTRON_VERSION in scripts/windows-release-inputs.mjs;
- the linux-inputs.json SHA-256 pinned by the AppImage (x64, arm64)
  and DEB contracts, and their tests;
- the tests that compare with the real pins, and the release docs.
Test placeholders that never compare with the real pin, and
historical records, keep 43.8.0.

How Electron's downloads are checked: the release build does not use
the npm package's checksums.json. The three thin-app builders call
packager() without a download or electronZipDir option, so
@electron/get checks each zip only against the release's live
SHASUMS256.txt. At bump time all 75 checksums.json entries matched
the official v43.8.3 SHASUMS256.txt, and the five packaged zips also
match GitHub's asset digests. Pinning the build to checksums.json is
tracked in #363.

The #135 fix now comes from Node.js itself: Electron dropped its
electron/electron#53393 backport when 43.8.0 moved to Node.js 24.22.0
(electron/electron#55003), because 24.22.0 carries the cleanup-hook
registry fix. 43.7.11 is the last release with the patches.
docs/macos-release.md and the electron-sqlite-check abort message now
say so. nodejs/node#65446 is still open, and the portable runtime
keeps its 24.18.1 hold (#362).

Every packaging job's allocation-driven SQLite check passed under
Electron 43.8.3 with Node v24.22.0 (ABI 148): the Linux folders,
AppImage and DEB on x64 and arm64, both macOS thin apps (native Intel
included), and the Windows native folder and MSI folders. The
Electron executable still needs glibc 2.25 on Linux x64 and arm64.

Supersedes #355.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 9e7ec7a7-8690-49e5-9d55-492fedc3027a

…tron/app (#9781)

Bumps [electron](https://github.com/electron/electron) from 41.10.6 to 42.11.16.
e notes</summary>
<p><em>Sourced from <a href="https://github.com/electron/electron/releases">electron's releases</a>.</em></p>
<blockquote>
<h2>electron v4Nblorelease cont"hories/GHSA-jr5w-.com/elecvisories/GHSA-jr5w-w6x2-84p9</a>, the mitMudhra intermediate certificates</p>
</bloul>
<li>Fixed link-opened windows not using the opener's sessces</code>. <a href="/?url=https%3A%2F%2Fron%2Felectron%2Fpull%2F55050">#55050</--//redirect.github.com/electron/electron/pull/55049">43</a>, <a href="https://redirect.github.com/electron/electron/pull/55048">44</a>, <a href="https://redirect.github.com/electron/electron/pull/55051">45</a>)<!-- raw HTML omitted --></li>
<li>Fixed <code>setCertificateVerifyProc</code> occasionally not being applied to a request issued concurrently with the first request to a host. <a href="https://redirect.github.com/electron/electron/pull/55054">#55054</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/55047">43</a>, <a href="https://redirect.github.com/electron/electron/pull/55046">44</a>, <a href="https://redirect.github.com/electron/electron/pull/55045">45</a>)<!-- raw HTML omitted --></li>
</ul>
<h2>electron v42.11.15</h2>
<h1>Release Notes for v42.11.15</h1>
<h2>Fixes</h2>
<ul>
<li>Fixed a crash on Linux at startup or on theme change with GTK modules loaded. <a href="https://redirect.github.com/electron/electron/pull/55015">#55015</a></li>
<li>Fixed an issue where clicks posted to a background app were dropped on macOS. <a href="https://redirect.github.com/electron/electron/pull/54906">#54906</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/54905">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54819">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54818">45</a>)<!-- raw HTML omitted --></li>
<li>Fixed <code>net.fetch</code> and <code>session.fetch</code> failing permanently with <code>net::ERR_FAILED</code> after the Network Service process restarts. <a href="https://redirect.github.com/electron/electron/pull/54925">#54925</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/54908">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54909">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54910">45</a>)<!-- raw HTML omitted --></li>
<li>Fixed <code>utilityProcess</code> dropping messages posted with <code>process.parentPort.postMessage()</code> right before the process exits. <a href="https://redirect.github.com/electron/electron/pull/55000">#55000</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/54962">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54956">45</a>)<!-- raw HTML omitted --></li>
</ul>
<h2>Other Changes</h2>
<ul>
<li>Backported fixes from upstream Chromium and V8. <a href="https://redirect.github.com/electron/electron/pull/55035">#55035</a></li>
</ul>
<h2>electron v42.11.14</h2>
<h1>Release Notes for v42.11.14</h1>
<h2>Other Changes</h2>
<ul>
<li>Backported fixes from upstream ANGLE, Chromium, PDFium and V8. <a href="https://redirect.github.com/electron/electron/pull/54900">#54900</a></li>
</ul>
<h2>electron v42.11.13</h2>
<h1>Release Notes for v42.11.13</h1>
<h2>Fixes</h2>
<ul>
<li>Fixed a crash when starting without an available display server on Linux. <a href="https://redirect.github.com/electron/electron/pull/54796">#54796</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/54781">45</a>)<!-- raw HTML omitted --></li>
</ul>
<h2>electron v42.11.12</h2>
<h1>Release Notes for v42.11.12</h1>
<h2>Fixes</h2>
<ul>
<li>Fixed a renderer crash when a <code>ResizeObserver</code> loop-limit error handler modified layout. <a href="https://redirect.github.com/electron/electron/pull/54610">#54610</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/54611">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54290">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54289">45</a>)<!-- raw HTML omitted --></li>
</ul>
<h2>Other Changes</h2>
<ul>
<li>Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. <a href="https://redirect.github.com/electron/electron/pull/54668">#54668</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc"><code>093583c</code></a> fix: apply the certificate SPKI blocklist to Node and add entries (42-x-y) (#...</li>
<li><a href="https://github.com/electron/electron/commit/d39162fb717dabb80ab3604dbc5f201fa444c2c0"><code>d39162f</code></a> docs: fix code block line highlighting after docs reformats (<a href="https://redirect.github.com/electron/electron/issues/55104">#55104</a>)</li>
<li><a href="https://github.com/electron/electron/commit/b3de3843f0fcb9c0ddc611cb4b06fcb914348e61"><code>b3de384</code></a> test: keep WebContentsView visibility specs' windows on top on Windows (42-x-...</li>
<li><a href="https://github.com/electron/electron/commit/7495684e2cc3288ff910da45b3adc5af3a9e39f2"><code>7495684</code></a> build: update PGO profiles (<a href="https://redirect.github.com/electron/electron/issues/55091">#55091</a>)</li>
<li><a href="https://github.com/electron/electron/commit/83a6c43dce46000f5991bcf09f7c449896f420fc"><code>83a6c43</code></a> ci: skip native builds when installing deps for type generation (<a href="https://redirect.github.com/electron/electron/issues/55064">#55064</a>)</li>
<li><a href="https://github.com/electron/electron/commit/716c0b28c73d000ca01291c03db8cb4b570c76e9"><code>716c0b2</code></a> fix: intermittent certificate errors for concurrent requests with setCertific...</li>
<li><a href="https://github.com/electron/electron/commit/a3336686ad942fcac6e6333b5973d6a1b0e14ec8"><code>a333668</code></a> ci: use Cloudflare DNS directly on macOS runners (<a href="https://redirect.github.com/electron/electron/issues/55069">#55069</a>)</li>
<li><a href="https://github.com/electron/electron/commit/ab438f1d7029aa57947d04b88679a1ee1d8d475f"><code>ab438f1</code></a> fix: use the opener's session and webPreferences for windows opened from link...</li>
<li><a href="https://github.com/electron/electron/commit/0d40700b5f17419983d0514a6f4e506bf13dcaea"><code>0d40700</code></a> chore: cherry-pick 10 changes from chromium and v8 (<a href="https://redirect.github.com/electron/electron/issues/55035">#55035</a>)</li>
<li><a href="https://github.com/electron/electron/commit/2276df806801d14c08738efad8841baf69d6f3ee"><code>2276df8</code></a> test: wait for service worker activation before stopping it (<a href="https://redirect.github.com/electron/electron/issues/55019">#55019</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/electron/electron/compare/v41.10.6...v42.11.16">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=electron&package-manager=npm_and_yarn&previous-version=41.10.6&new-version=42.11.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/X-oss-byte/Nextjs/network/alerts).

</details>

##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0)

### Release Notes for v44.9.0

#### Features

- Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) <sup>(Also in [45](https://github.com/electron/electron/pull/55072))</sup>

#### Fixes

- Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) <sup>(Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051))</sup>
- Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) <sup>(Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045))</sup>
##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0)

### Release Notes for v44.8.0

#### Features

- Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) <sup>(Also in [45](https://github.com/electron/electron/pull/54889))</sup>

#### Fixes

- Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987)
- Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) <sup>(Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910))</sup>
- Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) <sup>(Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956))</sup>
- Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) <sup>(Also in [45](https://github.com/electron/electron/pull/55008))</sup>

#### Other Changes

- Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034)
- Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928)
- Updated Node.js to v24.22.0. [#55004](electron/electron#55004)
##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2)

### Release Notes for v44.7.2

#### Fixes

- Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) <sup>(Also in [45](https://github.com/electron/electron/pull/54818))</sup>
- Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) <sup>(Also in [45](https://github.com/electron/electron/pull/54843))</sup>

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898)

#### Documentation

- Documentation changes: [#54880](electron/electron#54880)
##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1)

### Release Notes for v44.7.1

#### Fixes

- Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) <sup>(Also in [45](https://github.com/electron/electron/pull/54781))</sup>
- Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) <sup>(Also in [45](https://github.com/electron/electron/pull/54846))</sup>
- Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798)
- Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) <sup>(Also in [45](https://github.com/electron/electron/pull/54848))</sup>
- Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) <sup>(Also in [45](https://github.com/electron/electron/pull/54864))</sup>

#### Other Changes

- Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) <sup>(Also in [45](https://github.com/electron/electron/pull/54803))</sup>
- Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085)
##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0)

### Release Notes for v44.7.0

#### Features

- The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204)

#### Fixes

- Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672)

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666)
- Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657)
##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0)

### Release Notes for v44.6.0

#### Features

- Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) <sup>(Also in [45](https://github.com/electron/electron/pull/54521))</sup>

#### Fixes

- Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596)
- Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) <sup>(Also in [45](https://github.com/electron/electron/pull/54615))</sup>
- Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) <sup>(Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585))</sup>
- Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623)

#### Documentation

- Documentation changes: [#54589](electron/electron#54589)

##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0)

### Release Notes for v44.9.0

#### Features

- Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) <sup>(Also in [45](https://github.com/electron/electron/pull/55072))</sup>

#### Fixes

- Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) <sup>(Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051))</sup>
- Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) <sup>(Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045))</sup>
##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0)

### Release Notes for v44.8.0

#### Features

- Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) <sup>(Also in [45](https://github.com/electron/electron/pull/54889))</sup>

#### Fixes

- Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987)
- Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) <sup>(Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910))</sup>
- Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) <sup>(Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956))</sup>
- Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) <sup>(Also in [45](https://github.com/electron/electron/pull/55008))</sup>

#### Other Changes

- Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034)
- Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928)
- Updated Node.js to v24.22.0. [#55004](electron/electron#55004)
##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2)

### Release Notes for v44.7.2

#### Fixes

- Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) <sup>(Also in [45](https://github.com/electron/electron/pull/54818))</sup>
- Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) <sup>(Also in [45](https://github.com/electron/electron/pull/54843))</sup>

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898)

#### Documentation

- Documentation changes: [#54880](electron/electron#54880)
##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1)

### Release Notes for v44.7.1

#### Fixes

- Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) <sup>(Also in [45](https://github.com/electron/electron/pull/54781))</sup>
- Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) <sup>(Also in [45](https://github.com/electron/electron/pull/54846))</sup>
- Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798)
- Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) <sup>(Also in [45](https://github.com/electron/electron/pull/54848))</sup>
- Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) <sup>(Also in [45](https://github.com/electron/electron/pull/54864))</sup>

#### Other Changes

- Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) <sup>(Also in [45](https://github.com/electron/electron/pull/54803))</sup>
- Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085)
##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0)

### Release Notes for v44.7.0

#### Features

- The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204)

#### Fixes

- Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672)

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666)
- Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657)
##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0)

### Release Notes for v44.6.0

#### Features

- Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) <sup>(Also in [45](https://github.com/electron/electron/pull/54521))</sup>

#### Fixes

- Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596)
- Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) <sup>(Also in [45](https://github.com/electron/electron/pull/54615))</sup>
- Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) <sup>(Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585))</sup>
- Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623)

#### Documentation

- Documentation changes: [#54589](electron/electron#54589)