Repository navigation
chore: bump chromium to 156.0.8078.80 (45-x-y) - #55512
Conversation
There was a problem hiding this comment.
I re-reviewed after the new commits and found no bugs. The refresh now changes Electron's exposed copy of the File System Access blocklist, which controls permissions, so a human look at that patch is still worthwhile.
What was reviewed:
- The regenerated
refactor_expose_file_system_access_blocklist.patch. The list added to the header matches the upstream list removed from the.ccentry for entry, including ~/.config on all platforms, the shell startup files, the.git/configand.git/moduleswrite blocks,/devon macOS, and the new Linux paths. - The
.patcheslists for chromium, dawn, skia and v8 against the patch files on disk. Every deleted cherry-pick is gone from its list, and nothing is left dangling. - This is a standalone clone, so I couldn't check whether the hunks apply against the upstream sources at 156.0.8078.80. CI does that check.
Extended reasoning...
This is a Chromium roll on the 45-x-y branch. It bumps DEPS, drops 17 upstreamed cherry-picks from the chromium, dawn, skia and v8 patch lists, and refreshes two Chromium patches. The security-sensitive part is the regenerated FSA blocklist patch, which decides which local paths web content can reach through the File System Access API. Its exposed copy matches the removed upstream list. Commits pushed after the earlier human approval changed this patch, and it touches permission enforcement, so I deferred instead of approving.
Upstream added new entries to the kBlockPaths array that this patch moves into the header, so mirror those additions in the copy in chrome_file_system_access_permission_context.h. The cherry-pick of this CL is now upstream, so drop it. Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8674098 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8645890 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8662618 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8664359 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8666139 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8664042 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8667639 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8661158 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8669078 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8667303 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8666225 Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8669675 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/8668382 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/8667328 Ref: https://dawn-review.googlesource.com/c/dawn/+/353916 Ref: https://skia-review.googlesource.com/c/skia/+/1407318 Ref: https://skia-review.googlesource.com/c/skia/+/1407558 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
65d4ca1 to
962daef
Compare
There was a problem hiding this comment.
I reviewed the commits pushed since the earlier approval and didn't find any bugs. They change Electron's exposed copy of the File System Access blocklist, which is permission-sensitive, so a human should look at them again.
What was reviewed (standalone clone, so I couldn't see the upstream Chromium file):
- The blocklist copy in
refactor_expose_file_system_access_blocklist.patch: it adds the shell startup files, the.git/configand.git/moduleswrite blocks, macOS/dev, and Linux.local/share,.fonts.conf,.fonts.conf.dand.pki.~/.confignow sits in the all-platforms section and was removed from the Linux one, so it isn't listed twice. The platform#ifsections are intact. - The hunk sizes match: both the
.ccremoval hunk and the.haddition hunk grow by 46 lines, the same number of lines the new entries add. - Every deleted cherry-pick patch (13 Chromium, 1 dawn, 2 skia, 2 v8) was also taken out of its
.patcheslist, and no list still names a missing file.
Extended reasoning...
This is a Chromium roll from 156.0.8078.75 to 156.0.8078.80. It removes 18 cherry-pick patches that are now upstream and re-exports two patches. One of them, refactor_expose_file_system_access_blocklist.patch, changes the File System Access blocklist that Electron exposes, adding the new sensitive home-directory, git and device paths. That blocklist is part of a permission surface. The existing human approval came before these re-export commits, and from a standalone clone I can't confirm the copy matches upstream exactly.
…estroyed
Remove cherry-pick-439f2a316156.patch. It landed on 45-x-y after this
roll was opened and is already included in Chromium 156.0.8078.80
(refs/branch-heads/8078@{#1644}), so it no longer applies.
Ref: https://chromium-review.googlesource.com/c/chromium/src/+/8642609
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KX1hkPGMSsxVTxoXuEToJc
962daef to
3acb81d
Compare
|
Release Notes Persisted
|
…1556) Hronaut 3.14.8 runs Electron 45.2.1 with Chromium 156.0.8078.75. Chrome 156.0.8078.79 (Chrome Releases, 2026-10-29) shipped 21 more security fixes: the critical CVE-2026-76024 (MediaStream), 19 rated high such as CVE-2026-119262 (V8), and one medium. Electron 45.2.2 (on npm since 2026-11-03 21:43Z) updates Chromium to 156.0.8078.80 (electron/electron#55512) and Node.js to 24.22.2 (#55474), and fixes a Wayland crash with a hidden parent window (#55571) and removeInsertedCSS() for user stylesheets (#55538), which Hronaut does not call. Its typings are the same as 45.2.1's and its dependencies are unchanged. The lockfile entry was edited by hand with the registry's integrity, so npm ci leaves it as is. Electron fuses stay as electron-builder.yml sets them, with cookie encryption off. Tests run: typecheck, fresh-cache eslint . --max-warnings 0, lint:styles, release-notes, release-quality-gates, electron-fuses, dependency-manifest, native-packages and docker-playwright-version (66 passed); host Electron specs under Xvfb (8 specs, 145 passed). CodeQL green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uZZPTKuVkg1dDahASaegB
Updating Chromium to 156.0.8078.80.
See all changes in 156.0.8078.75..156.0.8078.80
Notes: Updated Chromium to 156.0.8078.80.