[PM-34331] Update electron to 41

[dani-garcia]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-34331

📔 Objective

Update electron to version 41 and the rest of the electron updates to their latest patch, which should solve compilation issues with the latest Visual Studio.

I've also had to enable a new fuse from electron 41, but I just set it to the default value so everything should work the same: https://github.com/electron/fuses/blob/bbf079259e66af30858578a1e070575f11c01915/README.md?plain=1#L29

Note that this will cause the desktop app to start using the bundled node 24, the rest of the clients except CLI are updated as part of #20400

I can't get renovate to create the PR right now so I've created it myself instead.

📸 Screenshots

[github-actions]

Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR bumps Electron from 39.8.5 to 41.3.0 (skipping 40) along with the related toolchain (electron-builder 26.8.2 → 26.9.0, electron-updater 6.6.4 → 6.8.3, @electron/notarize 3.0.1 → 3.1.1, @electron/rebuild 4.0.3 → 4.0.4) and package-lock.json. Both electron-builder.json and electron-builder.beta.json now pin electronVersion to 41.3.0, resolving the prior beta-config drift. A new WasmTrapHandlers fuse required by Electron 41 (under strictlyRequireAllFuses: true) is added in apps/desktop/scripts/after-pack.js at its documented default value. A window.main.ts change adds a concurrency guard so overlapping reload-process IPC events from LockService no longer race the crash + reload sequence, plus a one-tick setImmediate yield as a workaround for electron/electron#48661.

Code Review Details

No new findings. The previously raised IMPORTANT finding on apps/desktop/electron-builder.beta.json is resolved, and the additional window.main.ts reload-process fix is well-scoped (try/finally lock, explicit comment on the Electron upstream issue, and enableRendererProcessForceCrashReload path preserved).

Dependency Changes

Package	Change	Ecosystem
electron	39.8.5 → 41.3.0 (major)	npm
electron-builder	26.8.2 → 26.9.0	npm
electron-updater	6.6.4 → 6.8.3	npm
@electron/notarize	3.0.1 → 3.1.1	npm
@electron/rebuild	4.0.3 → 4.0.4	npm

[codecov]

Codecov Report

❌ Patch coverage is 0% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.41%. Comparing base (672a54f) to head (e411f19).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
apps/desktop/src/main/window.main.ts	0.00%	17 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #20448      +/-   ##
==========================================
- Coverage   47.41%   47.41%   -0.01%     
==========================================
  Files        3994     3994              
  Lines      122774   122782       +8     
  Branches    18881    18882       +1     
==========================================
  Hits        58212    58212              
- Misses      60153    60161       +8     
  Partials     4409     4409              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[djsmith85]

Changes are looking great, but we should get #20400 merged first. Since everyone needs to update their node-version for development.

[dani-garcia]

The last commit is fixing a process reload bug reported in https://bitwarden.atlassian.net/browse/PM-36851
The fix is at: 6e5f549?w=1

The bug appeared in electron 41 and caused process reload to crash the renderer, but then not reload the page, leaving the window empy and stuck. This issue is caused by two conditions:

• The process-reload event gets fired multiple times in close sequence, causing a race between the crash+reload. I fixed this by adding some logic to skip any duplicate events while we're in the middle of a reload.
• Calling reload immediately after crashing the process does not execute the reload correctly a lot of times. This is a reported electron bug: Calling reload() immediately after forcefullyCrashRenderer() does not consistently force the reload to occur in a new process electron/electron#48661. Just putting an await setImmetiate between crash and reload is enough to fix it for me consistently over dozens of tries.

[SuperSandro2000]

Electron 39 went EOL 2 weeks ago and we want to switch to 40 or 41 in nixpkgs. Will this land with the next desktop release?

[dani-garcia]

Hey @SuperSandro2000, I believe today is the RC cut for the desktop release next week, so I don't think this will make it on time for next update. We had some QA issues on Linux when using electron 41, which is the cause for the delay.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud