#52742: build: fix dependabot alerts
Merged
Created: Aug 9, 2026, 3:34:49 PM
Merged: Aug 10, 2026, 6:30:30 PM
2 comments
Target: main
Fixes all open Dependabot alerts. Most packages were re-resolved in-range with yarn up -R, plus a semver-minor pdfjs-dist bump (4.2.67 -> 4.10.38) which drops native node-canvas and with it vulnerable tar@6. Three fixes needed more than a standard bump:
- js-yaml and markdown-it are pinned exactly (4.1.0 / 14.1.0) by markdownlint-cli2, so they're overridden to patched same-major versions via resolutions. markdownlint still runs clean; the overrides can be dropped once we're on markdownlint-cli2 >= 0.23.
- @actions/cache 4 -> 5 is a major, but v5 only dropped the legacy cache service client, which removes vulnerable uuid@8 and undici@5 from the tree. The restoreCache/saveCache signatures are unchanged and are the only APIs used (audit-branch-ci.yml).
- serialize-javascript 6 -> 7 is forced via resolution because mocha (its only dependent) still declares ^6 even on latest. v7's only breaking change is requiring Node 20+, and mocha's single call site works, verified in --parallel mode which is the only path that loads it.
Notes: none
Backports
No Backports Requested
This pull request doesn't have any backports requested or created for older release branches.
What are backports?
Backports are copies of changes made to the main branch that are applied to older release branches. They ensure that bug fixes and important changes are available in maintained older versions of Electron.
Semver Impact
Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron