[AviPeltz]

Summary

• Resolves Dependabot alert chore: add Neon MCP server configuration #273: GHSA-9f4c-93c8-jc8g / CVE-2026-70608 (high severity) — sandboxed iframes could bypass the allow-popups restriction via Electron's OpenURL navigation path in setWindowOpenHandler.
• Bumps electron 40.9.3 → 41.10.3 in apps/desktop — Electron does not backport security patches to the 40.x line; 41.10.3 is the first patched release.
• Bumps better-sqlite3 12.6.2 → 12.11.1 in apps/desktop, packages/host-service, and packages/chat-runtime, since its native bindings called a V8 PropertyCallbackInfo::This() API that Electron 41's newer bundled V8 removed (fixed upstream in better-sqlite3@12.8.0 via HolderV2()).
• Confirmed the app's own setWindowOpenHandler implementations (apps/desktop/src/lib/electron-app/factories/windows/create.ts, apps/desktop/src/main/lib/browser/browser-manager.ts) already unconditionally deny window creation — the pattern the advisory calls out as unaffected even pre-patch — so this is a supply-chain version fix, not a behavioral gap.

Test plan

• bun install — native modules (better-sqlite3, node-pty, @parcel/watcher, etc.) rebuild cleanly against Electron 41.10.3
• bun run typecheck (apps/desktop) — passes with 0 errors
• bun run lint:fix — clean, no fixes needed
• bun test (apps/desktop) — 2532 pass, 0 fail

https://claude.ai/code/session_019C4QXK3fZBBKtxJud6mNkB

---

Summary by cubic

Update electron to 41.10.3 to patch CVE-2026-70608 (GHSA-9f4c-93c8-jc8g) that allowed sandboxed iframes to bypass allow-popups via the OpenURL path. Our setWindowOpenHandler already denies new windows, but this ensures we ship the patched runtime.

• Dependencies
  • electron: 40.9.3 → 41.10.3 in apps/desktop
  • better-sqlite3: 12.6.2 → 12.11.1 in apps/desktop, packages/host-service, packages/chat-runtime (required for Electron 41’s V8 changes)

^{Written for commit f69535d. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Updated the desktop app’s underlying runtime and database components.
  • Improved compatibility and stability through routine platform component updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3cf2fb9d-615b-4f02-8f1f-b413584f8b27

📥 Commits

Reviewing files that changed from the base of the PR and between df3f175 and f69535d.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• apps/desktop/package.json
• packages/chat-runtime/package.json
• packages/host-service/package.json

---

📝 Walkthrough

Walkthrough

The pull request updates better-sqlite3 to 12.11.1 in three packages and updates the desktop Electron development dependency to 41.10.3.

Changes

Dependency version alignment

Layer / File(s)	Summary
Package dependency updates apps/desktop/package.json, packages/chat-runtime/package.json, packages/host-service/package.json	The manifests update better-sqlite3 from 12.6.2 to 12.11.1. The desktop manifest updates Electron from 40.9.3 to 41.10.3.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• superset-sh/superset#6200: Updates the Electron dependency in apps/desktop/package.json.

Suggested reviewers: saddlepaddle

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Electron security update and uses conventional commit format.
Description check	✅ Passed	The description explains the security fix, dependency changes, and validation results, although it uses equivalent headings instead of the template headings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-electron-popup-bypass

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR upgrades Electron to the first patched 41.x release for CVE-2026-70608 and updates better-sqlite3 across all direct consumers for compatibility with Electron 41's V8 runtime.

• Pins Electron 41.10.3 in the desktop application.
• Pins better-sqlite3 12.11.1 in desktop, host-service, and chat-runtime.
• Regenerates the Bun lockfile with the corresponding direct and transitive dependency resolutions.

Confidence Score: 5/5

The PR appears safe to merge, with the dependency manifests and lockfile consistently aligned to the patched Electron release.

The changes are limited to coordinated dependency upgrades, and no concrete build, runtime, packaging, or security regression is present in the accepted findings.

Important Files Changed

Filename	Overview
apps/desktop/package.json	Updates Electron to the patched release and aligns better-sqlite3 with Electron 41's newer V8 runtime.
packages/host-service/package.json	Keeps the host-service's direct better-sqlite3 version aligned with the desktop runtime.
packages/chat-runtime/package.json	Keeps the chat runtime's direct better-sqlite3 version aligned with the other SQLite consumers.
bun.lock	Consistently resolves the requested Electron and better-sqlite3 upgrades and their changed transitive dependencies.

_{Reviews (1): Last reviewed commit: "fix(security): update Electron to patche..." | Re-trigger Greptile}

[github-actions]

🚀 Preview Deployment

🔗 Preview Links

Service	Status	Link
Database (Neon)	✅	View Branch
API (Vercel)	✅	Open Preview
Web (Vercel)	✅	Open Preview
Marketing (Vercel)	✅	Open Preview
Admin (Vercel)	✅	Open Preview
Docs (Vercel)	✅	Open Preview

---

Preview updates automatically with new commits