Repository navigation
fix(desktop): bump Electron to 44.9.1 to distrust eMudhra intermediates - #39
Conversation
Eight eMudhra intermediate CA private keys were recoverable from their certificates (Mozilla bug 2083449). Electron 44.9.1 ships the patched trust store that distrusts them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly identifies the Electron upgrade and its security purpose. It is concise, specific, and uses a conventional commit format. |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Description check | |
The description clearly explains the security problem, the Electron upgrade, the scope limitations, verification results, and the agent attribution. It does not use the required section headings and d… |
Full details: Description check
-
Explanation
The description clearly explains the security problem, the Electron upgrade, the scope limitations, verification results, and the agent attribution. It does not use the required section headings and does not provide explicit maintainer approval or explain why the external security references satisfy the scope requirement, but the core information is complete.
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
1 participant
The private keys of eight eMudhra intermediate CAs can be recovered from their certificates (we-have-a-problem.com, Mozilla bug 2083449). The desktop app ran Electron 44.4.5, which still trusts them, so anyone holding those keys could impersonate any HTTPS site the app connects to.
This bumps Electron to 44.9.1, the patched release on our major line, and moves its
minimumReleaseAgeExcludepin to match so the brand-new release installs. 44.9.1 blocks these keys in Chromium and, through electron/electron#55127, in Electron's embedded Node. That covers the server the desktop app hosts, which runs underELECTRON_RUN_AS_NODE.Not covered: the standalone server package running on the system's Node. Node merged the same blocklist in nodejs/node#66871 but has not released it yet, so those hosts need a Node upgrade once a release ships. Android uses the OS trust store.
Verified: the lockfile change touches only Electron, and the desktop typecheck passes.
Opus 5.5 via Claude Code in T3 Code.
🤖 Generated with Claude Code