chore(deps): bump electron from 41.5.0 to 41.10.3 in /apps/desktop

[dependabot]

Bumps electron from 41.5.0 to 41.10.3.

Release notes

Sourced from electron's releases.

electron v41.10.3

Release Notes for v41.10.3

Fixes

• Fixed app.disableHardwareAcceleration() not fully disabling GPU hardware usage on Windows starting from Electron 38. #52368 (Also in 42, 43, 44)
• Fixed unnecessary autofill popup creation for fields without datalist suggestions, which could cause input latency on macOS. #52320 (Also in 42, 43, 44)

Other Changes

• Backported fixes from upstream Chromium and V8. #52396

electron v41.10.2

Release Notes for v41.10.2

Fixes

• Fixed a renderer crash when calling WebAssembly.compileStreaming() or WebAssembly.instantiateStreaming() with nodeIntegration enabled. #52240 (Also in 42, 43)

Other Changes

• Backported fixes from upstream Chromium. #52304

electron v41.10.1

Release Notes for v41.10.1

Fixes

• Fixed crash triggered by replacing an open application menu. #52278 (Also in 42, 43, 44)

electron v41.10.0

Release Notes for v41.10.0

Other Changes

• Backported fixes from upstream Chromium, ANGLE, Dawn, Skia, and V8. #52231
• Updated Node.js to v24.18.0. #52104

electron v41.9.2

Release Notes for v41.9.2

Fixes

• Fixed an issue where clicking the maximize button could progressively shrink the window in some Wayland environments. #52074 (Also in 42, 43)

electron v41.9.1

Release Notes for v41.9.1

Fixes

• Fixed ProtocolResponse.url requests being made through the default session instead of the session the protocol handler was registered on when ProtocolResponse.session was not set. #52134 (Also in 40, 42, 43)
• Made "reload" menu items work with BaseWindow. #52118 (Also in 42, 43)

... (truncated)

Commits

• 991a977 chore: cherry-pick 6 changes from chromium and v8 (#52396)
• 3991da0 fix: append --disable-gpu switch in app.disableHardwareAcceleration() (#52368)
• 68cf8b7 fix: respect iframe sandbox flags on the OpenURL navigation path (#51438)
• 0dd1486 build: fail gha-done when required or checkout jobs fail (#52252)
• 4c3df5b fix: don't show empty autofill popup (#52320)
• 0d93097 fix: only set Node's WASM streaming callback when fetch is enabled (#… (#52240)
• 35874b0 chore: cherry-pick 8 changes from chromium (#52304)
• 23e9688 fix: restore SelfKeepAlive in Menu (#52278)
• 015e7a6 chore: bump node to v24.18.0 (41-x-y) (#52104)
• 9dbb737 chore: update angle patches after #52231 (#52241)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[radroid]

Taking this one — it is the only Dependabot PR here that fixes a reachable vulnerability, and the sync will not deliver it: upstream is still on electron@41.5.0, so this stays a fork-owned pin.

It covers two advisories against the desktop app the fork actually ships:

alert	severity	fixed in
pingdotgg#94 sandboxed iframe bypasses the allow-popups restriction via the OpenURL navigation path	high	41.10.3
pingdotgg#92 ProtocolResponse.url reuses the default session cache instead of the registering session	medium	41.9.1

Why it was red. Dependabot bumped apps/desktop/package.json and nothing else, so vp install died in 40s on a frozen lockfile — [ERR_PNPM_OUTDATED_LOCKFILE] ... electron (lockfile: 41.5.0, manifest: 41.10.3). It never reached typecheck.

What I pushed (force-push: the branch was also 2 commits stale, so it is rebased onto current main):

1. pnpm install --lockfile-only. The diff is confined to the electron tree — @electron/get 2.0.3 + 3.1.0 collapse into 5.1.0, extract-zip gives way to @electron-internal/extract-zip, and the two @clerk/electron peer entries re-resolve. Net -37 lines. No non-electron package moved.
2. .github/dependabot.yml, and the seam-ledger rows this change owes.

Checked, not assumed: apps/desktop/scripts/ensure-electron-runtime.mjs reads the version out of electron/package.json rather than hardcoding it, so it needs no edit. The three surviving 41.5.0 string literals in the tree are inline test fixtures — a resolveDesktopRuntimeDependencies input in scripts/build-desktop-artifact.test.ts and two getUserAgent mocks — none of which assert against the installed runtime. @electron/get@5.1.0 wants node >=22.12.0; the repo pins ^24.13.1.