Electron security hardening, upgrade to 43.4.1, Linux arm64 /Raspberry Pi GUI, Emscripten preview

[danoli3]

Security

• CWE-78: Fix shell command injection in PG invocation (exec -> execFile/spawn with argv arrays), stream PG output live to the console instead of buffering

Electron Security

• Enable contextIsolation, drop nodeIntegration, wire up preload.js contextBridge properly

• Upgrade Electron 35 -> 43.4.1, electron-builder/@electron/packager

• drop unsupported linux armv7l/ia32 targets

• npm audit fix

• Linux: native arm64 GUI - for Raspberry Pi and Linux arm64

• Linux GUI (previous CI shipped an x64 commandLine binary inside the arm64/armv7l GUI tarballs) - why it didn't run!

Improvements

• Add OF path status bar, addon-from-git quick add
• Add Emscripten build & local preview window (Build & Preview button -> make Debug/Release -> serves bin/ over loopback http -> opens in a new BrowserWindow)

[danoli3]

Electron 35.0.1 → 43.4.1 — CVEs fixed

CVE	GHSA	Severity	Summary
CVE-2025-55305	GHSA-vmqv-hx8q-j7mg	Medium	ASAR integrity bypass via resource modification
CVE-2026-70601	GHSA-h7rp-cf8h-j98x	High	Context isolation bypass via Function.prototype.bind hijack
CVE-2026-70608	GHSA-9f4c-93c8-jc8g	High	Sandboxed iframe bypasses allow-popups via OpenURL navigation
CVE-2026-70604	GHSA-v3j7-r9gq-3gjw	High	Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
CVE-2026-34769	GHSA-9wfr-w7mm-pc7f	High	Renderer command-line switch injection via undocumented commandLineSwitch
CVE-2026-34770	GHSA-jjp3-mq3x-295m	High	Use-after-free in PowerMonitor (Windows/macOS)
CVE-2026-34771	GHSA-8337-3p73-46f4	High	Use-after-free in WebContents fullscreen/pointer-lock/keyboard-lock
CVE-2026-34774	GHSA-532v-xpq5-8h95	High	Use-after-free in offscreen child-window paint callback
CVE-2026-34775	GHSA-xwr5-m59h-vwqr	Medium	nodeIntegrationInWorker not correctly scoped in shared renderer processes
CVE-2026-70597	GHSA-jm7p-cc5g-qwxx	Medium	Parent process code-sign check is spoofable
CVE-2026-70599	GHSA-9pf5-hg6p-4pwp	Medium	Permission check handler receives main-frame origin instead of requesting frame's
CVE-2026-70602	GHSA-m55f-7gqj-fr98	Medium	Extension tab APIs operate across session boundaries
CVE-2026-70603	GHSA-5c9j-mhmv-5xgx	Medium	shell.openPath path-validation bypass via embedded null byte
CVE-2026-70607	GHSA-v93f-fgjr-hjrj	Medium	window.open features string controls privilege
CVE-2026-70609	GHSA-4f78-qhmw-8j8m	Medium	DevTools JS injection viaunsanitized dock-state pa
CVE-2026-70610	GHSA-ff2p-hmqr-hxm4	Medium	contextBridge object copy honors prototype setters
CVE-2026-70611	GHSA-f2r8-jv7c-xqmp	Medium	DevTools embedder handlerexecutes arbitrary files
CVE-2026-70612	GHSA-p2rr-rvmm-c5fp	Medium	Sandboxed iframes can lauexternal protocol handler
CVE-2026-34767	GHSA-4p4r-m79c-wq3v	Medium	HTTP response header injection in custom protocol handlers/webRequest
CVE-2026-34776	GHSA-3c8v-cfp5-9885	Medium	Out-of-bounds read in second-instance IPC (macOS/Linux)
CVE-2026-34766	GHSA-9899-m83m-qhpj	Low	USB device selection not validated against filtere
CVE-2026-34768	GHSA-jfqx-fxh3-c62j	Low	Unquoted executable path in `app.setLoginItemSettings
CVE-2026-70598	GHSA-pfmc-3mgc-p6fp	Low	Off-screen rendering trusts GPU-supplied geometry ove
CVE-2026-70600	GHSA-x8rc-wpg4-grpf	Low	Cross-origin iframe can position native autofill

33 CVEs total (7 High, 24 Medium, 8 Low — includes the headline CVE-2025-55305 ASAR bypass).