mirror of https://github.com/toeverything/AFFiNE.git synced 2026-08-08 12:45:55 +08:00

T

renovate[bot] 42322d13fe chore: bump up electron version to v39.8.10 [SECURITY] (#15441 )

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [electron](https://redirect.github.com/electron/electron) | [`39.8.6`
→ `39.8.10`](https://renovatebot.com/diffs/npm/electron/39.8.6/39.8.10)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/electron/39.8.10?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/electron/39.8.6/39.8.10?slim=true)
|

---

### Electron: Parent process code-sign check is spoofable
[CVE-2026-70597](https://nvd.nist.gov/vuln/detail/CVE-2026-70597) /
[GHSA-jm7p-cc5g-qwxx](https://redirect.github.com/advisories/GHSA-jm7p-cc5g-qwxx)

<details>
<summary>More information</summary>

#### Details
##### Impact
On macOS, the check Electron uses to confirm it was launched by a
same-signed parent process could be bypassed by a local process. Apps
that enable the fuse-based hardening restricting `ELECTRON_RUN_AS_NODE`
and `NODE_OPTIONS` to same-signed parents rely on this check; a local
attacker could bypass it and run their own code inside the signed app,
inheriting its TCC permissions and keychain access.

Apps are only affected if they enable those macOS fuse-based
restrictions. Apps that do not enable them are not affected.

##### Workarounds
There are no app side workarounds, you must update to a patched version
of Electron.

##### Fixed Versions
* `42.0.0-beta.3`
* `41.2.1`
* `40.9.0`
* `39.8.8`

##### For more information
If you have any questions or comments about this advisory, email us at
[security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx](https://redirect.github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx)
-
[https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35](https://redirect.github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35)
-
[https://github.com/advisories/GHSA-jm7p-cc5g-qwxx](https://redirect.github.com/advisories/GHSA-jm7p-cc5g-qwxx)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-jm7p-cc5g-qwxx)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: Off-screen rendering trusts GPU-supplied geometry over
shared-memory size
[CVE-2026-70598](https://nvd.nist.gov/vuln/detail/CVE-2026-70598) /
[GHSA-pfmc-3mgc-p6fp](https://redirect.github.com/advisories/GHSA-pfmc-3mgc-p6fp)

<details>
<summary>More information</summary>

#### Details
##### Impact
In offscreen rendering mode, frame data received from the GPU process
was not fully validated by the main process. A compromised GPU process
could cause the main process to read out-of-bounds memory while
producing `paint` event images, disclosing memory or crashing the app.

Apps are only affected if they use offscreen rendering
(`webPreferences.offscreen`) and an attacker has separately gained code
execution in the GPU process. Apps that do not use offscreen rendering
are not affected.

##### Workarounds
There are no app side workarounds, you must update to a patched version
of Electron.

##### Fixed Versions
* `42.0.0-beta.3`
* `41.2.1`
* `40.9.0`
* `39.8.10`

##### For more information
If you have any questions or comments about this advisory, email us at
[security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 3.9 / 10 (Low)
- Vector String: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp](https://redirect.github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp)
-
[https://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb](https://redirect.github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb)
-
[https://github.com/advisories/GHSA-pfmc-3mgc-p6fp](https://redirect.github.com/advisories/GHSA-pfmc-3mgc-p6fp)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-pfmc-3mgc-p6fp)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: Permission Check Handler Receives Main Frame Origin
Instead of Requesting Iframe Origin
[CVE-2026-70599](https://nvd.nist.gov/vuln/detail/CVE-2026-70599) /
[GHSA-9pf5-hg6p-4pwp](https://redirect.github.com/advisories/GHSA-9pf5-hg6p-4pwp)

<details>
<summary>More information</summary>

#### Details
##### Impact
For serial-port and media (camera / microphone) permission checks made
from an iframe, the `requestingOrigin` passed to
`session.setPermissionCheckHandler` was the top-level frame's origin
rather than the requesting frame's. Origin-based handler logic could
therefore grant a cross-origin iframe device access intended only for
the top-level origin.

Apps are only affected if they use `setPermissionCheckHandler` with
origin-based logic and embed cross-origin iframes with delegated device
permissions. Apps that base the decision on `details.securityOrigin`, or
that do not embed such iframes, are not affected.

##### Workarounds
Check `details.securityOrigin` instead of `requestingOrigin` for these
permissions, or do not delegate device permissions to untrusted iframes.

##### Fixed Versions
* `42.0.0-beta.1`
* `41.2.0`
* `40.9.0`
* `39.8.7`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 5.9 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp](https://redirect.github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp)
-
[https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c](https://redirect.github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c)
-
[https://github.com/advisories/GHSA-9pf5-hg6p-4pwp](https://redirect.github.com/advisories/GHSA-9pf5-hg6p-4pwp)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-9pf5-hg6p-4pwp)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: Cross-origin iframe can position native autofill popup
[CVE-2026-70600](https://nvd.nist.gov/vuln/detail/CVE-2026-70600) /
[GHSA-x8rc-wpg4-grpf](https://redirect.github.com/advisories/GHSA-x8rc-wpg4-grpf)

<details>
<summary>More information</summary>

#### Details
##### Impact
The native autofill popup could be positioned by a cross-origin iframe
outside that iframe's bounds, over the embedding page's UI, enabling
clickjacking or spoofing of trusted UI.

Apps are only affected if they embed untrusted content in iframes within
windows that also display trusted UI. Apps that do not embed untrusted
third-party content are not affected.

##### Workarounds
Do not embed untrusted content in iframes inside windows that display
trusted UI.

##### Fixed Versions
* `42.0.0-beta.3`
* `41.2.1`
* `40.9.0`
* `39.8.8`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 3.1 / 10 (Low)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf](https://redirect.github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf)
-
[https://github.com/advisories/GHSA-x8rc-wpg4-grpf](https://redirect.github.com/advisories/GHSA-x8rc-wpg4-grpf)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-x8rc-wpg4-grpf)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: Context isolation bypass via Function.prototype.bind
hijack
[CVE-2026-70601](https://nvd.nist.gov/vuln/detail/CVE-2026-70601) /
[GHSA-h7rp-cf8h-j98x](https://redirect.github.com/advisories/GHSA-h7rp-cf8h-j98x)

<details>
<summary>More information</summary>

#### Details
##### Impact
Apps that expose Promise-returning functions to web content via
`contextBridge` may be vulnerable to a context isolation bypass.
Untrusted web content could obtain access to the isolated preload world
and, through it, every capability the preload script has. In renderers
without a sandbox, or with `nodeIntegration` enabled, this may escalate
to Node.js access.

Apps are affected if they expose Promise-returning functions via
`contextBridge` — the standard pattern for wrapping `ipcRenderer.invoke`
— in windows that load untrusted content. Apps that never load untrusted
content in those windows are not affected.

##### Workarounds
There are no app side workarounds, you must update to a patched version
of Electron.

##### Fixed Versions
* `42.0.0-beta.5`
* `41.2.2`
* `40.9.2`
* `39.8.9`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x](https://redirect.github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x)
-
[https://github.com/advisories/GHSA-h7rp-cf8h-j98x](https://redirect.github.com/advisories/GHSA-h7rp-cf8h-j98x)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-h7rp-cf8h-j98x)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: Extension tab APIs operate across session boundaries
[CVE-2026-70602](https://nvd.nist.gov/vuln/detail/CVE-2026-70602) /
[GHSA-m55f-7gqj-fr98](https://redirect.github.com/advisories/GHSA-m55f-7gqj-fr98)

<details>
<summary>More information</summary>

#### Details
##### Impact
Extension tab and scripting APIs were not scoped to the extension's own
`session`. A malicious or compromised extension loaded into one session
could navigate, script, and read from windows belonging to a different
session.

Apps are only affected if they load Chrome extensions via
`session.loadExtension` and rely on separate sessions to isolate that
extension from other content. Apps that do not load extensions, or that
use a single session, are not affected.

##### Workarounds
Only load extensions from sources you trust; do not rely on session
separation alone to contain an extension.

##### Fixed Versions
* `42.0.0-beta.3`
* `41.2.1`
* `40.9.0`
* `39.8.8`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 6.6 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98](https://redirect.github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98)
-
[https://github.com/advisories/GHSA-m55f-7gqj-fr98](https://redirect.github.com/advisories/GHSA-m55f-7gqj-fr98)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-m55f-7gqj-fr98)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: Custom protocol with supportFetchAPI but not corsEnabled
allows cross-origin reads
[CVE-2026-70604](https://nvd.nist.gov/vuln/detail/CVE-2026-70604) /
[GHSA-v3j7-r9gq-3gjw](https://redirect.github.com/advisories/GHSA-v3j7-r9gq-3gjw)

<details>
<summary>More information</summary>

#### Details
##### Impact
A custom scheme registered with `supportFetchAPI: true` but without
`corsEnabled: true` was not subject to CORS enforcement. A page loaded
from a remote origin could therefore `fetch()` or `XMLHttpRequest` that
scheme cross-origin and read the full response body, rather than the
read being blocked.

Apps that serve sensitive data from such a scheme and load remote or
untrusted content in a renderer are affected. Apps that set
`corsEnabled: true`, or that do not load untrusted content, are not
affected.

##### Workarounds
Set `corsEnabled: true` on schemes that must enforce CORS, and validate
the request `Origin` in your protocol handler before returning sensitive
data.

##### Fixed Versions
* `42.0.0`
* `41.4.0`
* `40.9.3`
* `39.8.10`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 7.4 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw](https://redirect.github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw)
-
[https://github.com/advisories/GHSA-v3j7-r9gq-3gjw](https://redirect.github.com/advisories/GHSA-v3j7-r9gq-3gjw)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-v3j7-r9gq-3gjw)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: HTTP redirect followed into local file loader
[CVE-2026-70605](https://nvd.nist.gov/vuln/detail/CVE-2026-70605) /
[GHSA-v64r-4m7r-3mvq](https://redirect.github.com/advisories/GHSA-v64r-4m7r-3mvq)

<details>
<summary>More information</summary>

#### Details
##### Impact
When following HTTP redirects, `net.fetch()` and `net.request()` did not
restrict which schemes a redirect could target. A remote server could
redirect a request to a local resource, and if the app returns or
forwards the response body, local file contents could be disclosed.

Apps are only affected if they make `net` requests to
attacker-influenced URLs with redirects followed (the default) and
expose the response body. Apps that only request fixed, trusted URLs are
not affected.

##### Workarounds
Set `redirect: 'error'` or `redirect: 'manual'` on requests to untrusted
URLs and validate any redirect target before following it.

##### Fixed Versions
* `42.0.0-beta.3`
* `41.2.1`
* `40.9.0`
* `39.8.8`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 5.9 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq](https://redirect.github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq)
-
[https://github.com/advisories/GHSA-v64r-4m7r-3mvq](https://redirect.github.com/advisories/GHSA-v64r-4m7r-3mvq)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-v64r-4m7r-3mvq)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: window.open features string controls some window options
considered privileged
[CVE-2026-70607](https://nvd.nist.gov/vuln/detail/CVE-2026-70607) /
[GHSA-v93f-fgjr-hjrj](https://redirect.github.com/advisories/GHSA-v93f-fgjr-hjrj)

<details>
<summary>More information</summary>

#### Details
##### Impact
Some window options supplied by web content in the `window.open()`
features string were applied to the new `BrowserWindow` without an
allowlist. Untrusted content could set window options it should not
control, including options that cause the main process to access
attacker-chosen file or network paths.

Apps are only affected if untrusted content can call `window.open()` and
the app does not override child window options via
`setWindowOpenHandler`. Apps that deny `window.open()` for untrusted
content, or set `overrideBrowserWindowOptions` explicitly, are not
affected.

##### Workarounds
Return `{ action: 'deny' }` from `setWindowOpenHandler` for untrusted
content, or supply `overrideBrowserWindowOptions` so every window option
is set explicitly.

##### Fixed Versions
* `42.0.0-beta.3`
* `41.2.1`
* `40.9.0`
* `39.8.8`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj](https://redirect.github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj)
-
[https://github.com/electron/electron/pull/50946](https://redirect.github.com/electron/electron/pull/50946)
-
[https://github.com/electron/electron/pull/50947](https://redirect.github.com/electron/electron/pull/50947)
-
[https://github.com/electron/electron/pull/50948](https://redirect.github.com/electron/electron/pull/50948)
-
[https://github.com/electron/electron/pull/50949](https://redirect.github.com/electron/electron/pull/50949)
-
[https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a](https://redirect.github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a)
-
[https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7](https://redirect.github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7)
-
[https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b](https://redirect.github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b)
-
[https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55](https://redirect.github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55)
-
[https://github.com/electron/electron/releases/tag/v39.8.8](https://redirect.github.com/electron/electron/releases/tag/v39.8.8)
-
[https://github.com/electron/electron/releases/tag/v40.9.0](https://redirect.github.com/electron/electron/releases/tag/v40.9.0)
-
[https://github.com/electron/electron/releases/tag/v41.2.1](https://redirect.github.com/electron/electron/releases/tag/v41.2.1)
-
[https://github.com/electron/electron/releases/tag/v42.0.0-beta.3](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.3)
-
[https://github.com/advisories/GHSA-v93f-fgjr-hjrj](https://redirect.github.com/advisories/GHSA-v93f-fgjr-hjrj)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-v93f-fgjr-hjrj)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: DevTools JavaScript Injection via Unsanitized Dock State
Parameter
[CVE-2026-70609](https://nvd.nist.gov/vuln/detail/CVE-2026-70609) /
[GHSA-4f78-qhmw-8j8m](https://redirect.github.com/advisories/GHSA-4f78-qhmw-8j8m)

<details>
<summary>More information</summary>

#### Details
##### Impact
The `mode` option of `webContents.openDevTools()` was not sanitized
before use by the DevTools frontend. If an attacker can influence this
value, script under their control may run in the DevTools context, which
in unsandboxed configurations has access to Node.js.

Apps are only affected if untrusted input can reach the `mode` argument
of `openDevTools()`, or if untrusted content can call `openDevTools()`
on a `<webview>` it embeds. Apps that only ever pass a fixed dock mode
are not affected.

##### Workarounds
Only pass fixed, allowlisted values (`right`, `bottom`, `undocked`,
`detach`) as the DevTools `mode`, and do not expose `openDevTools` to
untrusted content.

##### Fixed Versions
* `42.0.0-beta.1`
* `41.2.0`
* `40.9.0`
* `39.8.7`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 5.7 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m](https://redirect.github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m)
-
[https://github.com/electron/electron/pull/50665](https://redirect.github.com/electron/electron/pull/50665)
-
[https://github.com/electron/electron/pull/50666](https://redirect.github.com/electron/electron/pull/50666)
-
[https://github.com/electron/electron/pull/50667](https://redirect.github.com/electron/electron/pull/50667)
-
[https://github.com/electron/electron/pull/50668](https://redirect.github.com/electron/electron/pull/50668)
-
[https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1](https://redirect.github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1)
-
[https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b](https://redirect.github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b)
-
[https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce](https://redirect.github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce)
-
[https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba](https://redirect.github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba)
-
[https://github.com/electron/electron/releases/tag/v39.8.7](https://redirect.github.com/electron/electron/releases/tag/v39.8.7)
-
[https://github.com/electron/electron/releases/tag/v40.9.0](https://redirect.github.com/electron/electron/releases/tag/v40.9.0)
-
[https://github.com/electron/electron/releases/tag/v41.2.0](https://redirect.github.com/electron/electron/releases/tag/v41.2.0)
-
[https://github.com/electron/electron/releases/tag/v42.0.0-beta.1](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.1)
-
[https://github.com/advisories/GHSA-4f78-qhmw-8j8m](https://redirect.github.com/advisories/GHSA-4f78-qhmw-8j8m)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-4f78-qhmw-8j8m)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: Sandboxed iframe can bypass the allow-popups restriction
via the OpenURL navigation path
[CVE-2026-70608](https://nvd.nist.gov/vuln/detail/CVE-2026-70608) /
[GHSA-9f4c-93c8-jc8g](https://redirect.github.com/advisories/GHSA-9f4c-93c8-jc8g)

<details>
<summary>More information</summary>

#### Details
##### Impact
A sandboxed iframe without the `allow-popups` keyword could still open a
new window (or trigger `setWindowOpenHandler`) with no user interaction,
because new-window navigations taking the OpenURL path did not apply the
iframe sandbox popup restriction.

Apps that embed untrusted content in sandboxed iframes and rely on the
absence of `allow-popups` to prevent window creation are affected. Apps
that deny window creation in `setWindowOpenHandler`, or that do not
embed untrusted content in sandboxed iframes, are not affected.

##### Workarounds
Return `{ action: 'deny' }` from `setWindowOpenHandler` for any content
you do not trust, rather than relying on the iframe sandbox alone.

##### Fixed Versions
* `42.0.1`
* `41.10.3`
* `39.8.10`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 7.2 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g](https://redirect.github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g)
-
[https://github.com/electron/electron/pull/51437](https://redirect.github.com/electron/electron/pull/51437)
-
[https://github.com/electron/electron/pull/51438](https://redirect.github.com/electron/electron/pull/51438)
-
[https://github.com/electron/electron/pull/51439](https://redirect.github.com/electron/electron/pull/51439)
-
[https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57](https://redirect.github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57)
-
[https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3](https://redirect.github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3)
-
[https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f](https://redirect.github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f)
-
[https://github.com/electron/electron/releases/tag/v39.8.10](https://redirect.github.com/electron/electron/releases/tag/v39.8.10)
-
[https://github.com/electron/electron/releases/tag/v41.10.3](https://redirect.github.com/electron/electron/releases/tag/v41.10.3)
-
[https://github.com/electron/electron/releases/tag/v42.0.1](https://redirect.github.com/electron/electron/releases/tag/v42.0.1)
-
[https://github.com/advisories/GHSA-9f4c-93c8-jc8g](https://redirect.github.com/advisories/GHSA-9f4c-93c8-jc8g)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-9f4c-93c8-jc8g)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: contextBridge object copy honors prototype setters
[CVE-2026-70610](https://nvd.nist.gov/vuln/detail/CVE-2026-70610) /
[GHSA-ff2p-hmqr-hxm4](https://redirect.github.com/advisories/GHSA-ff2p-hmqr-hxm4)

<details>
<summary>More information</summary>

#### Details
##### Impact
Objects copied across the `contextBridge` boundary from untrusted
content could carry an attacker-influenced prototype, enabling
prototype-pollution-style attacks against preload code despite context
isolation being enabled.

Apps are only affected if their preload code accepts object arguments
from untrusted content and reads properties from them without
own-property checks. Apps that only accept primitive arguments, or that
validate object arguments, are not affected.

##### Workarounds
Validate objects received from untrusted content with own-property
checks (`Object.hasOwn`), or copy them onto a null-prototype object
before use.

##### Fixed Versions
* `42.0.0-beta.4`
* `41.2.2`
* `40.9.2`
* `39.8.9`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 5.4 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4](https://redirect.github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4)
-
[https://github.com/electron/electron/pull/51083](https://redirect.github.com/electron/electron/pull/51083)
-
[https://github.com/electron/electron/pull/51084](https://redirect.github.com/electron/electron/pull/51084)
-
[https://github.com/electron/electron/pull/51085](https://redirect.github.com/electron/electron/pull/51085)
-
[https://github.com/electron/electron/pull/51086](https://redirect.github.com/electron/electron/pull/51086)
-
[https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713](https://redirect.github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713)
-
[https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd](https://redirect.github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd)
-
[https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55](https://redirect.github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55)
-
[https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737](https://redirect.github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737)
-
[https://github.com/electron/electron/releases/tag/v39.8.9](https://redirect.github.com/electron/electron/releases/tag/v39.8.9)
-
[https://github.com/electron/electron/releases/tag/v40.9.2](https://redirect.github.com/electron/electron/releases/tag/v40.9.2)
-
[https://github.com/electron/electron/releases/tag/v41.2.2](https://redirect.github.com/electron/electron/releases/tag/v41.2.2)
-
[https://github.com/electron/electron/releases/tag/v42.0.0-beta.4](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.4)
-
[https://github.com/advisories/GHSA-ff2p-hmqr-hxm4](https://redirect.github.com/advisories/GHSA-ff2p-hmqr-hxm4)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-ff2p-hmqr-hxm4)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: DevTools embedder handler executes arbitrary files via
shell open
[CVE-2026-70611](https://nvd.nist.gov/vuln/detail/CVE-2026-70611) /
[GHSA-f2r8-jv7c-xqmp](https://redirect.github.com/advisories/GHSA-f2r8-jv7c-xqmp)

<details>
<summary>More information</summary>

#### Details
##### Impact
The DevTools "reveal in file manager" action could launch the target
file rather than reveal it. An attacker with a separate means of running
script inside the DevTools frontend (such as a malicious DevTools
extension) could use this to execute native code outside the sandbox.

Apps are only affected if DevTools is opened for windows exposed to
untrusted content or untrusted DevTools extensions. Apps that do not
open DevTools in that context are not affected.

##### Workarounds
Do not open DevTools for windows that load untrusted content, and do not
load untrusted DevTools extensions.

##### Fixed Versions
* `42.0.0-beta.3`
* `41.2.1`
* `40.9.2`
* `39.8.9`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 6.9 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp](https://redirect.github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp)
-
[https://github.com/electron/electron/pull/50937](https://redirect.github.com/electron/electron/pull/50937)
-
[https://github.com/electron/electron/pull/50938](https://redirect.github.com/electron/electron/pull/50938)
-
[https://github.com/electron/electron/pull/51114](https://redirect.github.com/electron/electron/pull/51114)
-
[https://github.com/electron/electron/pull/51115](https://redirect.github.com/electron/electron/pull/51115)
-
[https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322](https://redirect.github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322)
-
[https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44](https://redirect.github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44)
-
[https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de](https://redirect.github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de)
-
[https://github.com/electron/electron/releases/tag/v39.8.9](https://redirect.github.com/electron/electron/releases/tag/v39.8.9)
-
[https://github.com/electron/electron/releases/tag/v40.9.2](https://redirect.github.com/electron/electron/releases/tag/v40.9.2)
-
[https://github.com/electron/electron/releases/tag/v41.2.1](https://redirect.github.com/electron/electron/releases/tag/v41.2.1)
-
[https://github.com/electron/electron/releases/tag/v42.0.0-beta.3](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.3)
-
[https://github.com/advisories/GHSA-f2r8-jv7c-xqmp](https://redirect.github.com/advisories/GHSA-f2r8-jv7c-xqmp)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-f2r8-jv7c-xqmp)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Electron: Sandboxed iframes can launch external protocol handlers
[CVE-2026-70612](https://nvd.nist.gov/vuln/detail/CVE-2026-70612) /
[GHSA-p2rr-rvmm-c5fp](https://redirect.github.com/advisories/GHSA-p2rr-rvmm-c5fp)

<details>
<summary>More information</summary>

#### Details
##### Impact
Requests to open external protocol URLs from web content did not take
iframe sandbox restrictions into account, so a sandboxed iframe could
cause an OS-registered external application to be launched. The frame's
sandbox state was also not made available to the app's permission
handlers.

Apps are only affected if they render untrusted content in sandboxed
iframes and grant the `openExternal` permission (granted by default when
no `setPermissionRequestHandler` is installed). Apps whose permission
handler denies `openExternal` for untrusted content are not affected.

##### Workarounds
Install a `setPermissionRequestHandler` that denies the `openExternal`
permission for untrusted content.

##### Fixed Versions
* `42.0.0-beta.3`
* `41.2.1`
* `40.9.0`
* `39.8.8`

##### For more information
If you have any questions or comments about this advisory, email
Electron at [security@electronjs.org](mailto:security@electronjs.org)

#### Severity
- CVSS Score: 5.4 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N`

#### References
-
[https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp](https://redirect.github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp)
-
[https://github.com/electron/electron/pull/50961](https://redirect.github.com/electron/electron/pull/50961)
-
[https://github.com/electron/electron/pull/50962](https://redirect.github.com/electron/electron/pull/50962)
-
[https://github.com/electron/electron/pull/50963](https://redirect.github.com/electron/electron/pull/50963)
-
[https://github.com/electron/electron/pull/50964](https://redirect.github.com/electron/electron/pull/50964)
-
[https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5](https://redirect.github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5)
-
[https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a](https://redirect.github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a)
-
[https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39](https://redirect.github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39)
-
[https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3](https://redirect.github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3)
-
[https://github.com/electron/electron/releases/tag/v39.8.8](https://redirect.github.com/electron/electron/releases/tag/v39.8.8)
-
[https://github.com/electron/electron/releases/tag/v40.9.0](https://redirect.github.com/electron/electron/releases/tag/v40.9.0)
-
[https://github.com/electron/electron/releases/tag/v41.2.1](https://redirect.github.com/electron/electron/releases/tag/v41.2.1)
-
[https://github.com/electron/electron/releases/tag/v42.0.0-beta.3](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.3)
-
[https://github.com/advisories/GHSA-p2rr-rvmm-c5fp](https://redirect.github.com/advisories/GHSA-p2rr-rvmm-c5fp)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-p2rr-rvmm-c5fp)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>electron/electron (electron)</summary>

###
[`v39.8.10`](https://redirect.github.com/electron/electron/releases/tag/v39.8.10):
electron v39.8.10

[Compare
Source](https://redirect.github.com/electron/electron/compare/v39.8.9...v39.8.10)

### Release Notes for v39.8.10

> \[!WARNING]
> Electron 39.x.y has reached end-of-support as per the project's
[support
policy](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#version-support-policy).
Developers and applications are encouraged to upgrade to a newer version
of Electron.

#### Fixes

- Ensured cross-origin `fetch()` and XHR are blocked for custom
protocols registered with `supportFetchAPI: true` unless `corsEnabled:
true` is also set; cross-origin `mode: 'no-cors'` requests now receive
an opaque response.
[#&#8203;51272](https://redirect.github.com/electron/electron/pull/51272)
<sup>(Also in
[40](https://redirect.github.com/electron/electron/pull/51271),
[41](https://redirect.github.com/electron/electron/pull/51270),
[42](https://redirect.github.com/electron/electron/pull/51269))</sup>
- Fixed an issue where the Squirrel.Mac installer could resolve the
target bundle path to different locations at different stages of an
install.
[#&#8203;50766](https://redirect.github.com/electron/electron/pull/50766)
<sup>(Also in
[42](https://redirect.github.com/electron/electron/pull/50765))</sup>

#### Other Changes

- Backported a fix for route\_id validation in the GPU command buffer.
[#&#8203;51327](https://redirect.github.com/electron/electron/pull/51327)
- Backported security fixes for
[`4933194`](https://redirect.github.com/electron/electron/commit/493319454),
[`4941583`](https://redirect.github.com/electron/electron/commit/494158331),
[`4932347`](https://redirect.github.com/electron/electron/commit/493234757),
[`4927361`](https://redirect.github.com/electron/electron/commit/492736100),
[`4934134`](https://redirect.github.com/electron/electron/commit/493413432),
[`4926688`](https://redirect.github.com/electron/electron/commit/492668885),
[`4962818`](https://redirect.github.com/electron/electron/commit/496281816).
[#&#8203;51257](https://redirect.github.com/electron/electron/pull/51257)
- Backported several fixes in Skia, ANGLE, and WebRTC from upstream.
[#&#8203;51266](https://redirect.github.com/electron/electron/pull/51266)

###
[`v39.8.9`](https://redirect.github.com/electron/electron/releases/tag/v39.8.9):
electron v39.8.9

[Compare
Source](https://redirect.github.com/electron/electron/compare/v39.8.8...v39.8.9)

### Release Notes for v39.8.9

#### Other Changes

- Fixed `gn gen` failing to resolve `electron_version` when building
from a `git worktree` checkout.
[#&#8203;51163](https://redirect.github.com/electron/electron/pull/51163)
<sup>(Also in
[40](https://redirect.github.com/electron/electron/pull/51164),
[41](https://redirect.github.com/electron/electron/pull/51165),
[42](https://redirect.github.com/electron/electron/pull/51166))</sup>
- Security: backported fixes for CVE-2026-6296, CVE-2026-6297,
CVE-2026-6298, CVE-2026-6299, CVE-2026-6300, CVE-2026-6301,
CVE-2026-6302, CVE-2026-6303, CVE-2026-6304, CVE-2026-6305,
CVE-2026-6306, CVE-2026-6307, CVE-2026-6308, CVE-2026-6309,
CVE-2026-6311, CVE-2026-6312, CVE-2026-6313, CVE-2026-6314,
CVE-2026-6316, CVE-2026-6318, CVE-2026-6358, CVE-2026-6359,
CVE-2026-6360, CVE-2026-6361, CVE-2026-6362, CVE-2026-6363,
CVE-2026-6364.
[#&#8203;51141](https://redirect.github.com/electron/electron/pull/51141)

###
[`v39.8.8`](https://redirect.github.com/electron/electron/releases/tag/v39.8.8):
electron v39.8.8

[Compare
Source](https://redirect.github.com/electron/electron/compare/v39.8.7...v39.8.8)

### Release Notes for v39.8.8

#### Fixes

- Fixed an issue where DevTools would re-attach to the window when
opened after previously being detached.
[#&#8203;50818](https://redirect.github.com/electron/electron/pull/50818)
<sup>(Also in
[40](https://redirect.github.com/electron/electron/pull/50817),
[41](https://redirect.github.com/electron/electron/pull/50816),
[42](https://redirect.github.com/electron/electron/pull/50815))</sup>

#### Other Changes

- Backported fix for
[chromium:74266014](https://issues.chromium.org/issues/474266014).
[#&#8203;50175](https://redirect.github.com/electron/electron/pull/50175)
- Backported upstream v8 fixes for several maglev, inspector, and arm64
code-generation edge cases.
[#&#8203;50993](https://redirect.github.com/electron/electron/pull/50993)

###
[`v39.8.7`](https://redirect.github.com/electron/electron/releases/tag/v39.8.7):
electron v39.8.7

[Compare
Source](https://redirect.github.com/electron/electron/compare/v39.8.6...v39.8.7)

### Release Notes for v39.8.7

#### Other Changes

- Backported fix for
[`4897116`](https://redirect.github.com/electron/electron/commit/489711638).
[#&#8203;50624](https://redirect.github.com/electron/electron/pull/50624)
- Backported fix for
[`4939526`](https://redirect.github.com/electron/electron/commit/493952652).
[#&#8203;50620](https://redirect.github.com/electron/electron/pull/50620)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/toeverything/AFFiNE).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6ImNhbmFyeSIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

2026-08-08 02:57:35 +08:00

.cargo

feat(server): migrate copilot to native (#14620 )

2026-03-11 13:55:35 +08:00

.codesandbox

refactor!: remove next.js (#3267 )

2023-07-18 16:53:10 +00:00

.devcontainer

feat(server): impl native reader for server (#14100 )

2025-12-14 00:28:43 +08:00

.docker

feat(server): converge legacy compatibility (#15426 )

2026-08-05 00:40:13 +08:00

.github

chore: bump up actions/setup-python action to v7 (#15416 )

2026-08-02 22:59:24 +08:00

.husky

chore: upgrade husky to latest (#5719 )

2024-01-26 06:37:39 +00:00

.vscode

chore: bump oxlint & enable more supported rules (#14769 )

2026-04-03 03:36:52 +08:00

.yarn

chore: bump deps (#14810 )

2026-04-09 12:41:38 +08:00

blocksuite

chore: bump up @atlaskit/pragmatic-drag-and-drop-auto-scroll version to v3 (#15396 )

2026-08-05 19:26:53 +08:00

docs

chore: bump deps (#15151 )

2026-06-24 23:55:19 +08:00

packages

fix(editor): allow selection of earlier dates(#15436 )

2026-08-07 19:29:34 +08:00

scripts

feat: improve ci (#15194 )

2026-07-04 03:41:23 +08:00

tests

feat(core): improve byok editing (#15427 )

2026-08-05 19:26:19 +08:00

tools

chore: bump up @slack/web-api version to v8 (#15405 )

2026-08-01 17:28:05 +08:00

.dockerignore

chore: cleanup images (#14380 )

2026-02-06 19:49:02 +08:00

.editorconfig

feat(native): sync yocto codes (#14243 )

2026-01-11 06:08:33 +08:00

.gitattributes

milestone: publish alpha version (#637 )

2022-12-30 21:40:15 +08:00

.gitignore

fix(editor): edgeless can't slider with finger (#15091 )

2026-06-16 21:19:31 +08:00

.npmrc

chore: restrict node version (#3120 )

2023-07-10 06:19:59 +00:00

.nvmrc

chore: bump up Node.js to v22.23.2 (#15384 )

2026-07-31 13:51:32 +08:00

.oxlintrc.json

fix(core): desktop e2e (#15062 )

2026-06-01 23:54:41 +08:00

.prettierignore

fix(core): desktop e2e (#15062 )

2026-06-01 23:54:41 +08:00

.prettierrc

chore: add lint cache (#1917 )

2023-04-13 20:30:18 +00:00

.taplo.toml

feat(core): import progress & perf (#15197 )

2026-07-06 01:29:24 +08:00

.yarnrc.yml

chore: bump deps (#14690 )

2026-03-20 05:23:03 +08:00

Cargo.lock

feat(core): improve byok editing (#15427 )

2026-08-05 19:26:19 +08:00

Cargo.toml

feat(server): converge legacy compatibility (#15426 )

2026-08-05 00:40:13 +08:00

CHANGELOG.md

milestone: publish alpha version (#637 )

2022-12-30 21:40:15 +08:00

codecov.yml

chore: add codecov.yml

2023-05-03 00:47:43 -05:00

deny.toml

feat(editor): migrate typst mermaid to native (#14499 )

2026-03-20 04:04:40 +08:00

eslint.config.mjs

chore: bump oxlint & enable more supported rules (#14769 )

2026-04-03 03:36:52 +08:00

LICENSE

docs: update docs

2025-12-29 19:08:49 +08:00

LICENSE-MIT

docs: update licenses (#4180 )

2023-09-15 07:50:00 +00:00

nyc.config.js

chore: bump oxlint & enable more supported rules (#14769 )

2026-04-03 03:36:52 +08:00

package.json

chore: bump up oxlint version to v1.76.0 (#15387 )

2026-07-31 17:08:39 +08:00

README.md

docs: cleanup outdated infos

2026-02-23 21:03:13 +08:00

rust-toolchain.toml

chore: bump up Rust to v1.97.1 (#15389 )

2026-07-31 17:08:23 +08:00

rustfmt.toml

feat(native): sync yocto codes (#14243 )

2026-01-11 06:08:33 +08:00

SECURITY.md

chore: update docs

2026-07-15 13:25:57 +08:00

tsconfig.eslint.json

feat(docs): migrate bs docs

2026-04-29 17:23:23 +08:00

tsconfig.json

feat(server): support refresh token (#15218 )

2026-07-12 02:39:42 +08:00

tsconfig.node.json

chore: standardize tsconfig (#9568 )

2025-01-08 04:07:56 +00:00

tsconfig.web.json

feat: cleanup webpack deps (#14530 )

2026-02-28 00:24:08 +08:00

typedoc.base.json

docs: initial api reference docs (#5352 )

2024-01-02 12:46:27 +00:00

typedoc.json

refactor(infra): migrate to new infra (#5565 )

2024-01-30 07:16:39 +00:00

vitest.config.ts

test: migrate test & utils (#14569 )

2026-03-07 04:12:27 +08:00

yarn.lock

chore: bump up electron version to v39.8.10 [SECURITY] (#15441 )

2026-08-08 02:57:35 +08:00

README.md

AFFiNE.Pro
Write, Draw and Plan All at Once

A privacy-focused, local-first, open-source, and ready-to-use alternative for Notion & Miro.
One hyper-fused platform for wildly creative minds.

Home Page | Discord | Live Demo | Blog | Documentation

Docs, canvas and tables are hyper-merged with AFFiNE - just like the word affine (əˈfʌɪn | a-fine).

Getting started & staying tuned with us.

Star us, and you will receive all release notifications from GitHub without any delay!

What is AFFiNE

AFFiNE is an open-source, all-in-one workspace and an operating system for all the building blocks that assemble your knowledge base and much more -- wiki, knowledge management, presentation and digital assets. It's a better alternative to Notion and Miro.

Features

A true canvas for blocks in any form. Docs and whiteboard are now fully merged.

Many editor apps claim to be a canvas for productivity, but AFFiNE is one of the very few which allows you to put any building block on an edgeless canvas -- rich text, sticky notes, any embedded web pages, multi-view databases, linked pages, shapes and even slides. We have it all.

Multimodal AI partner ready to kick in any work

Write up professional work report? Turn an outline into expressive and presentable slides? Summary an article into a well-structured mindmap? Sorting your job plan and backlog for tasks? Or... draw and code prototype apps and web pages directly all with one prompt? With you, AFFiNE AI pushes your creativity to the edge of your imagination, just like Canvas AI to generate mind map for brainstorming.

Local-first & Real-time collaborative

We love the idea of local-first that you always own your data on your disk, in spite of the cloud. Furthermore, AFFiNE supports real-time sync and collaborations on web and cross-platform clients.

Self-host & Shape your own AFFiNE

You have the freedom to manage, self-host, fork and build your own AFFiNE. Plugin community and third-party blocks are coming soon. More tractions on Blocksuite. Check there to learn how to self-host AFFiNE.

Acknowledgement

“We shape our tools and thereafter our tools shape us”. A lot of pioneers have inspired us along the way, e.g.:

Quip & Notion with their great concept of “everything is a block”
Trello with their Kanban
Airtable & Miro with their no-code programmable datasheets
Miro & Whimiscal with their edgeless visual whiteboard
Remote & Capacities with their object-based tag system

There is a large overlap of their atomic “building blocks” between these apps. They are not open source, nor do they have a plugin system like Vscode for contributors to customize. We want to have something that contains all the features we love and also goes one step even further.

Thanks for checking us out, we appreciate your interest and sincerely hope that AFFiNE resonates with you! 🎵 Checking https://affine.pro/ for more details ions.

Contributing

Bug Reports	Feature Requests	Questions/Discussions	AFFiNE Community
Create a bug report	Submit a feature request	Check GitHub Discussion	Visit the AFFiNE's Discord
Something isn't working as expected	An idea for a new feature, or improvements	Discuss and ask questions	A place to ask, learn and engage with others

Calling all developers, testers, tech writers and more! Contributions of all types are more than welcome, you can read more in docs/types-of-contributions.md. If you are interested in contributing code, read our docs/CONTRIBUTING.md and feel free to check out our GitHub issues to get stuck in to show us what you’re made of.

Before you start contributing, please make sure you have read and accepted our Contributor License Agreement. To indicate your agreement, simply edit this file and submit a pull request.

For bug reports, feature requests and other suggestions you can also create a new issue and choose the most appropriate template for your feedback.

For translation and language support you can visit our Discord.

If you have questions, you are welcome to contact us. One of the best places to get more info and learn more is in the Discord where you can engage with other like-minded individuals.

Templates

AFFiNE now provides pre-built templates from our team. Following are the Top 10 most popular templates among AFFiNE users,if you want to contribute, you can contribute your own template so other people can use it too.

Blog

Welcome to the AFFiNE blog section! Here, you’ll find the latest insights, tips, and guides on how to maximize your experience with AFFiNE and AFFiNE AI, the leading Canvas AI tool for flexible note-taking and creative organization.

Ecosystem

Name
@affine/component	AFFiNE Component Resources
@toeverything/theme	AFFiNE theme

Upstreams

We would also like to give thanks to open-source projects that make AFFiNE possible:

Blocksuite - 💠 BlockSuite is the open-source collaborative editor project behind AFFiNE.
y-octo - 🐙 y-octo is a native, high-performance, thread-safe YJS CRDT implementation, serving as the core engine enabling the AFFiNE Client/Server to achieve "local-first" functionality.
OctoBase - 🐙 OctoBase is the open-source database behind AFFiNE, local-first, yet collaborative. A light-weight, scalable, data engine written in Rust.
yjs - Fundamental support of CRDTs for our implementation on state management and data sync on web.
electron - Build cross-platform desktop apps with JavaScript, HTML, and CSS.
React - The library for web and native user interfaces.
napi-rs - A framework for building compiled Node.js add-ons in Rust via Node-API.
Jotai - Primitive and flexible state management for React.
async-call-rpc - A lightweight JSON RPC client & server.
Vite - Next generation frontend tooling.
Other upstream dependencies.

Thanks a lot to the community for providing such powerful and simple libraries, so that we can focus more on the implementation of the product logic, and we hope that in the future our projects will also provide a more easy-to-use knowledge base for everyone.

Contributors

We would like to express our gratitude to all the individuals who have already contributed to AFFiNE! If you have any AFFiNE-related project, documentation, tool or template, please feel free to contribute it by submitting a pull request to our curated list on GitHub: awesome-affine.

Self-Host

Begin with Docker to deploy your own feature-rich, unrestricted version of AFFiNE. Our team is diligently updating to the latest version. For more information on how to self-host AFFiNE, please refer to our documentation.

Feature Request

For feature requests, please see discussions.

Building

Codespaces

From the GitHub repo main page, click the green "Code" button and select "Create codespace on master". This will open a new Codespace with the (supposedly auto-forked AFFiNE repo cloned, built, and ready to go).

Local

See BUILDING.md for instructions on how to build AFFiNE from source code.

Contributing

We welcome contributions from everyone. See docs/contributing/tutorial.md for details.

License

Editions

AFFiNE Community Edition (CE) is the current available version, it's free for self-host under the MIT license.
AFFiNE Enterprise Edition (EE) is yet to be published, it will have more advanced features and enterprise-oriented offerings, including but not exclusive to rebranding and SSO, advanced admin and audit, etc., you may refer to https://affine.pro/pricing for more information

See LICENSE for details.

Languages

TypeScript 88.9%

Rust 4.5%

Swift 4.4%

Kotlin 1.1%

JavaScript 0.4%

Other 0.5%

README.md Unescape Escape

AFFiNE.Pro Write, Draw and Plan All at Once

Getting started & staying tuned with us.

What is AFFiNE

Features

Acknowledgement

Contributing

Templates

Blog

Ecosystem

Upstreams

Contributors

Self-Host

Feature Request

Building

Codespaces

Local

Contributing

License

Editions

README.md

AFFiNE.Pro
Write, Draw and Plan All at Once