fix(security): upgrade Electron to patch CVE-2024-7971

[cursor]

Summary

Patches CVE-2024-7971 (critical V8 type confusion → remote code execution in Chromium renderer) by raising the minimum Electron version from ^35.0.0 to ^35.7.5.

Vulnerability

• CVE: CVE-2024-7971
• Severity: Critical (CVSS 9.6)
• Component: V8 JavaScript engine (bundled with Electron/Chromium)
• Impact: A crafted HTML page can trigger heap corruption in the renderer, potentially leading to remote code execution. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog and has been exploited in the wild.

Analysis

cursorcats is an Electron desktop app. Renderer windows load local HTML and render agent conversation content (including markdown via marked and innerHTML). While existing hardening (contextIsolation: true, nodeIntegration: false, CSP headers) reduces blast radius, the underlying V8 bug must be patched at the Chromium level.

The previous dependency range ^35.0.0 allowed npm to resolve to Electron 35.0.0. Electron 35.7.5 ships Chromium 134.0.6998.205, which is well past the patched Chromium 128.0.6613.84 required to fix CVE-2024-7971.

Fix

File	Change
package.json	electron: ^35.0.0 → ^35.7.5
package-lock.json	Updated root dependency constraint to match

This is a targeted, minimal change: same Electron major line (35.x), no application code changes.

Verification

• npm install — succeeds
• npm run build — succeeds (main, preload, and renderer bundles build cleanly)

Risk / compatibility

• Breaking changes: None expected within the 35.x line for this app's usage.
• Scope: Dependency constraint only; no unrelated security fixes bundled intentionally beyond what 35.7.5 includes.