#2927

chore(desktop, factory): move to Electron 45 so both apps stay on a supported release

OpenDanielButler1wants to merge intofrom

Electron 42 went out of support when Electron 45 shipped on 2026-10-21 (Electron supports the latest three major versions). After this change the desktop app and Factory both run on a supported Electron version. The upgrade surfaced three Electron 45 behaviour changes, and each is fixed here.

What changed

  • apps/desktop and apps/factory: electron 42.11.18 → 45.0.0. The lockfile only changes the Electron entries; 45.0.0 has the same dependencies as 42.
  • Browser screenshots to the clipboard (browserHost.ts): Electron 44 removed clipboard.writeImage, so on 45 every browser-panel screenshot would throw. It now uses clipboard.write([new ClipboardItem({ "image/png": … })]).
  • Phone and tablet browser sizes (browserHost.ts): on 45, enableDeviceEmulation({ screenPosition: "mobile" }) ignores the page's viewport tag, so a width=device-width page laid out 980px wide instead of 390px. The device size is now set with the DevTools protocol's Emulation.setDeviceMetricsOverride, which gives the same result on 42 and 45. enableDeviceEmulation remains the fallback if the page's debugger is taken. The debugger now stays attached while a device size is set, including with the System colour scheme.
  • Smoke scripts: on 45, executeJavaScript rejects results it can't clone, such as React-managed elements ("An object could not be cloned"); 42 returned {} for them. The run helpers in the review-threads, chat-reference, prompt-commands, history and chat-shell smokes now map that rejection to true. The chat-shell capture retry also accepts UnknownVizError, 45's name for a surface that isn't ready yet.
  • Patch changeset for both apps.

Why 45.0.0

45.1.0 is two days old and blocked by minimumReleaseAge. No advisories affect 45.0.0.

Other breaking changes checked (43–45)

ChangeEffect on our apps
Sandboxed preloads lose Buffer / setImmediate / Node shimsNone: both preloads use only contextBridge and ipcRenderer
Screen capture reported as display-captureNone: browser-panel pages were already denied screen capture, and the app window has no permission handler
getUserMedia desktop source rejects WebContents idsNone: recording uses chromeMediaSource: "tab"
Sync safeStorage deprecated (removed in 46)Desktop already uses the async API. Factory still uses the sync calls, which still work on 45. Must move before Electron 46.
ia32 / armv7l builds removedNone: Forge targets the host architecture

Verification

  • Desktop and factory typecheck and lint are clean against the Electron 45 types. Factory vitest: 124/124.
  • Clipboard: a real Electron 45 round trip (capturePage → clipboard.write → clipboard.read()) returns image/png with a valid PNG signature. It also confirmed clipboard.writeImage is undefined on 45.
  • Viewport: a minimal script reproduced 980×2121 on 45 and 390×844 on 42. With the change, test:browser-viewport passes all 96 cases on 45 (it was failing 48).
  • I ran every non-packaged step of the desktop Windows workflow locally on 45:
    • Review threads, chat reference, prompt commands, history, chat shell and native browser, and native browser permissions all pass after the fixes.
    • Harness update fails locally on main with Electron 42 as well, so it's a local environment issue.
    • smoke.mjs stops locally at database is locked, also on main with 42. CI's Windows job passes it.
  • Not run: electron-forge make, which CI doesn't run either. The next desktop release build should be checked.

Proved with real Electron 45 runs of the clipboard and viewport changes, plus the desktop workflow's smoke steps.

Created with Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

Activity

15
vercel[bot]1d ago

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated
phaseo ReadyPreviewOct 29, 2026 6:25pm UTC

coderabbitai[bot]1d ago

WARNING

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: ce94fa41-901d-4200-9e38-99e07d89476b
Commits

Reviewing files that changed from the base of the PR and between 4fdeee593807f612528a2d8981fe95ff12ae6cae and 5d25e7c868a6bdbcfb9032e4b10263a125331936.

Files ignored due to path filters: 1
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
Files selected for processing: 9
  • .changeset/electron-45-upgrade.md
  • apps/desktop/package.json
  • apps/desktop/scripts/chat-reference-smoke.mjs
  • apps/desktop/scripts/chat-shell-smoke.mjs
  • apps/desktop/scripts/history-smoke.mjs
  • apps/desktop/scripts/prompt-commands-smoke.mjs
  • apps/desktop/scripts/review-threads-smoke.mjs
  • apps/desktop/src/main/browserHost.ts
  • apps/factory/package.json
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

chatgpt-codex-connector[bot]1d ago

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

ReviewStatusCommitReview trigger
📝 Code Review✅ Completed 2026-10-29T15:58:36.457240Zba748eaPR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions[bot]1d ago

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/electron 45.0.0:green_circle: 6.9
Details
CheckScoreReason
Dependency-Update-Tool:green_circle: 10update tool detected
Security-Policy:green_circle: 10security policy file detected
Code-Review:green_circle: 10all changesets reviewed
Maintained:green_circle: 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Packaging:warning: -1packaging workflow not detected
License:green_circle: 10license file detected
Token-Permissions:green_circle: 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts:green_circle: 10no binaries found in the repo
CII-Best-Practices:green_circle: 5badge detected: Passing
Pinned-Dependencies:green_circle: 10all dependencies are pinned
Vulnerabilities:warning: 049 existing vulnerabilities detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: 0Project has not signed or included provenance with any releases.
Branch-Protection:green_circle: 4branch protection is not maximal on development and all release branches
CI-Tests:green_circle: 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors:green_circle: 10project has 89 contributing companies or organizations
npm/electron 45.0.0:green_circle: 6.9
Details
CheckScoreReason
Dependency-Update-Tool:green_circle: 10update tool detected
Security-Policy:green_circle: 10security policy file detected
Code-Review:green_circle: 10all changesets reviewed
Maintained:green_circle: 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Packaging:warning: -1packaging workflow not detected
License:green_circle: 10license file detected
Token-Permissions:green_circle: 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts:green_circle: 10no binaries found in the repo
CII-Best-Practices:green_circle: 5badge detected: Passing
Pinned-Dependencies:green_circle: 10all dependencies are pinned
Vulnerabilities:warning: 049 existing vulnerabilities detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: 0Project has not signed or included provenance with any releases.
Branch-Protection:green_circle: 4branch protection is not maximal on development and all release branches
CI-Tests:green_circle: 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors:green_circle: 10project has 89 contributing companies or organizations
npm/electron 45.0.0:green_circle: 6.9
Details
CheckScoreReason
Dependency-Update-Tool:green_circle: 10update tool detected
Security-Policy:green_circle: 10security policy file detected
Code-Review:green_circle: 10all changesets reviewed
Maintained:green_circle: 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Packaging:warning: -1packaging workflow not detected
License:green_circle: 10license file detected
Token-Permissions:green_circle: 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts:green_circle: 10no binaries found in the repo
CII-Best-Practices:green_circle: 5badge detected: Passing
Pinned-Dependencies:green_circle: 10all dependencies are pinned
Vulnerabilities:warning: 049 existing vulnerabilities detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: 0Project has not signed or included provenance with any releases.
Branch-Protection:green_circle: 4branch protection is not maximal on development and all release branches
CI-Tests:green_circle: 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors:green_circle: 10project has 89 contributing companies or organizations

Scanned Files

  • apps/desktop/package.json
  • apps/factory/package.json
  • pnpm-lock.yaml
socket-security[bot]1d ago

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
npm/​electron@​42.11.18 ⏵ 45.0.0 +1

View full report

github-advanced-security[bot]reviewed1d ago
github-advanced-security[bot]reviewed1d ago
github-advanced-security[bot]reviewed1d ago
github-advanced-security[bot]reviewed1d ago
github-advanced-security[bot]reviewed1d ago
linear-code[bot]15h ago