Electron 44 security update: safe Brotli decoding and a hardened app

Improved

• Updated the app engine to Electron 44 with the latest Chromium security fixes — 1DevTool moves off an engine that no longer received security updates onto Electron 44 (Chromium 152), so every window, the built-in browser and previews get current Chromium fixes; the new engine needs macOS 13 Ventura or later, so Macs on macOS 11 or 12 are not offered this update and stay on 1.82.0

• Brotli-compressed responses are decoded safely — the HTTP client, its request MCP tool and the other places 1DevTool reads data from a server now unpack Brotli (Content-Encoding: br) with a memory-safe decoder instead of the built-in one, which has a known flaw a malicious server could exploit

• Requests no longer ask servers for Brotli unless you set an Accept-Encoding header yourself; gzip and deflate responses look exactly as before

• A Brotli body that is corrupt, or larger than 128 MB once unpacked, shows a short note in the response body explaining why instead of the data

• Hardened app integrity — the installed app now verifies that its own files have not been altered and ignores Node.js startup options and debugger flags passed to it from outside, and on macOS it no longer holds permission to debug other apps

• The Remote server refuses Brotli uploads — the server behind the Web UI and the phone app answers a Brotli-compressed request with an error instead of unpacking it

• Updated bundled components with the latest security fixes — the libraries behind the HTTP client, MySQL and Cassandra connections, the MCP server, the Remote server and phone connections, the Web UI and app updates now include their current security fixes