[dependabot]

Bumps the npm_and_yarn group with 1 update in the /electron directory: electron.

Updates electron from 33.4.11 to 40.6.1

Release notes

Sourced from electron's releases.

electron v40.6.1

Release Notes for v40.6.1

Fixes

• Fixed globalShortcut not working on Wayland with GlobalShortcutsPortal feature enabled. #49870 (Also in 41)
• Fixed an issue where making a window fullscreen on Windows, minimizing it and then restoring it broke previous fullscreen state. #49892 (Also in 41)
• Fixed an issue where menu item enabled state wasn't updated during key equivalent dispatch when the menu was closed on macOS. #49889 (Also in 39, 41)
• Fixed an issue where pressing AltGr could activate or focus the menu bar. #49915 (Also in 39, 41)
• Fixed an issue where setting zoomFactor in setWindowOpenHandler's overrideBrowserWindowOptions had no effect on windows opened via window.open(). #49909 (Also in 41)
• Fixed draggable regions not updating position when DevTools is docked to the left or right in a frameless window. #49847 (Also in 39, 41)
• Fixed memory leak when setting icons on Linux/GTK. #49898 (Also in 38, 39, 41)
• Fixed startup crash when V8 sandbox is disabled. #49884 (Also in 41)

Other Changes

• Fixed crash in platform_util::Beep() on Linux. #49864 (Also in 41)
• Updated Chromium to 144.0.7559.220. #49869

electron v40.6.0

Release Notes for v40.6.0

Features

• Added the ability to disable auto-focusing of WebContents on navigation using webPreferences.focusOnNavigation. #49512 (Also in 41)

Fixes

• Fixed an issue where frameless windows had resize issues in Mac App Store builds. #49856

electron v40.5.0

Release Notes for v40.5.0

Features

• Added support for long-animation-frame script attribution (via --enable-features=AlwaysLogLOAFURL). #49772 (Also in 41)
• Extended actions support for Windows notifications to include buttons, select dropdowns, and replies. #49786 (Also in 41)

Fixes

• Addressed upstream Chromium shift to enable CoreAudio Tap API for audio capture used in electron's desktopCapturer (🍏 macOS). #49741 (Also in 39, 41)
• Made pointer lock work on Wayland. #49283

Other Changes

• Updated Chromium to 144.0.7559.177. #49800
• Updated Node.js to v24.13.1. #49742

electron v40.4.1

Release Notes for v40.4.1

Other Changes

• Backported fix for 483569511. #49790

... (truncated)

Commits

• 477fe85 ci: fix checking latest release for website docs update (#49921)
• a9837ed fix: updated Alt detection to explicitly exclude AltGraph/AltGr (#49915)
• 1f7269f fix: apply zoomFactor from setWindowOpenHandler to window.open() window...
• 2813b89 fix: prevent GBytes leak in GdkPixbufFromSkBitmap on Linux/GTK (#49898)
• a4560db fix: refresh menu item state on key equivalent dispatch (#49889)
• adfc062 fix: fullscreen restoration on Windows (#49892)
• 8dc34b4 fix: update DBus signal signature for XDG GlobalShortcuts portal (#49870)
• 6cc5ad7 fix: avoid startup crash when V8 sandbox is disabled (#49884)
• 4c5637c ci: log mocha retries in spec runner (#49877)
• 0d71ed0 chore: bump chromium to 144.0.7559.220 (40-x-y) (#49869)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Diff Analysis

The PR contains a single change in electron/package.json:

• Line 20: Updated electron dependency from ^33.0.0 to ^40.6.1

Code Reviewed

• electron/package.json - Dependency version update
• electron/main.js - Uses stable Electron APIs (app, BrowserWindow, ipcMain, Tray, Menu, nativeImage, shell, session)
• electron/preload.js - Uses stable contextBridge and ipcRenderer APIs with channel validation

Compatibility Assessment

The code uses well-established Electron APIs that have remained stable across major versions:

• app.requestSingleInstanceLock() - stable
• BrowserWindow with webPreferences - stable
• ipcMain.handle/invoke pattern - stable
• Tray, Menu, nativeImage - stable
• contextBridge.exposeInMainWorld - stable
• session.setting for CSP - stable

The electron-builder version ^25.1.8 is compatible with Electron 40.x.

Testing Recommendation

While the change appears compatible, as with any major Electron version upgrade:

1. Test the desktop app builds successfully after merging
2. Run the app on all target platforms (Windows, macOS, Linux)
3. Verify all features (window controls, tray, external links, CSP) work correctly

Files Reviewed (1 file in diff)

• electron/package.json - 1 change (line 20)

---

Independent review confirmed - no new issues identified.

[KooshaPari]

Gentle ping — this PR (koosha/combos-pr-ready) is a follow-up to the LAN allowlist fix that landed as #4877. It addresses the remaining race in the combos pipeline that #4877 didn't cover.