Repository navigation
fix(desktop): bump Electron to 44.9.1 to block compromised eMudhra CA keys - #22644
CanadaApollo6 wants to merge 1 commit into
Conversation
… keys Electron 44.9.1 adds the eight eMudhra (emSign) intermediates whose keys were found recoverable to its SPKI blocklist and applies it to Node TLS in the Electron process (electron/electron#55126). Moves the minimumReleaseAgeExclude entry with the pin and regenerates the lockfile. Fixes pingdotgg#22610 Co-Authored-By: Claude Opus 5.5 <[email protected]>
github-actions
Bot
added
vouch:unvouched
ApprovabilityVerdict: Needs Human Approval Macroscope's review found this PR requires human approval — This updates the shipped desktop Electron runtime to change TLS certificate handling and block compromised eMudhra CA keys. Although the diff is small and reproducible through the lockfile, its direct security impact warrants human review. You can add or adjust custom eligibility rules. Learn more. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Linked Issues check |  |
Issue #22610 requires Electron 44.9.1 or later, the matching minimumReleaseAgeExclude entry, and a regenerated lockfile. The reviewable summary confirms the Electron pin changed to 44.9.1 and the … |
Provide reviewable evidence for the required pnpm-lock.yaml updates, or remove its exclusion so the Electron and peer dependency entries can be verified. |
-
Check name Status Explanation Title check The title is concise, follows the conventional commit format, and clearly identifies the Electron security update. Description check The description includes all required sections. It explains the security problem, lists the version and lockfile changes, references issue #22610, documents verification results, and states unverified…Out of Scope Changes check The stated changes are limited to the Electron version pin, the matching workspace release-age exclusion, and the regenerated lockfile. These changes directly implement issue #22610. No unrelated appl…Full details: Description check
-
Explanation
The description includes all required sections. It explains the security problem, lists the version and lockfile changes, references issue
#22610, documents verification results, and states unverified scenarios.
Full details: Out of Scope Changes check
-
Explanation
The stated changes are limited to the Electron version pin, the matching workspace release-age exclusion, and the regenerated lockfile. These changes directly implement issue
#22610. No unrelated application code, dependency, or behavior change is identified in the available whole-PR summary.
-
Full details: Linked Issues check
-
Explanation
Issue
#22610requires Electron 44.9.1 or later, the matchingminimumReleaseAgeExcludeentry, and a regenerated lockfile. The reviewable summary confirms the Electron pin changed to44.9.1and the workspace entry changed to[email protected]. The PR description reports the required lockfile regeneration and Electron version verification. However,pnpm-lock.yamlis intentionally excluded from review, so the lockfile contents and dependency consistency cannot be independently established.Resolution
Provide reviewable evidence for the required
pnpm-lock.yamlupdates, or remove its exclusion so the Electron and peer dependency entries can be verified.
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
Note 🤖 Claude Opus 5.5 responding on behalf of Theo Thanks for this. Closing because #22645 already bumped Electron to 44.9.3, which is newer than this PR's 44.9.1 and blocks the same compromised CA keys. |
Problem
The desktop app ships Electron 44.4.5, which still trusts the eight eMudhra (emSign) intermediate CA certificates whose private keys were found to be recoverable. A TLS server presenting a certificate issued from one of those keys is accepted by the renderer and by Node
https/fetchin the Electron process. Reported in #22610.Change
apps/desktop/package.json:electron44.4.5 → 44.9.1, which adds those keys to Electron's SPKI blocklist and applies it to Node TLS (fix: apply the certificate SPKI blocklist to Node and add entries electron/electron#55126).pnpm-workspace.yaml: moves theminimumReleaseAgeExcludeentry to[email protected], since 44.9.x is newer than the minimum release age.pnpm-lock.yaml: regenerated withpnpm install --lockfile-only(pnpm 11.10.0). The only lockfile changes are the electron entry and@clerk/electron's peer reference to it.No other dependencies or code change.
Scope and approval
Fixes #22610. This is the fix suggested there: one version pin, the matching workspace exclusion, and the lockfile.
Verification
Electron/44.4.5in its binary, andmainpins"electron": "44.4.5".pnpm install --frozen-lockfile --filter @t3tools/desktop...succeeds, andELECTRON_RUN_AS_NODE=1 apps/desktop/node_modules/.bin/electron -p process.versionsreportselectron=44.9.1 chrome=152.0.7977.167 node=24.22.0.vp fmthook ran cleanly on the three files.Not checked: I didn't launch a packaged build or test the blocklist itself. That would need a certificate chain signed by one of the compromised keys. I also didn't run packaging on macOS or Windows.
Work done by Claude Opus 5.5 in Claude Code.
🤖 Generated with Claude Code