Pin Electron to 41.4.0 to fix macOS Keychain prompt regression

[wojtekn]

Related issues

• Related to fix: lazily initialize safeStorage async encryptor electron/electron#50419

How AI was used in this PR

Used Claude Code to research the regression, identify the offending commit, and apply the fix.

Proposed Changes

• Pins electron from ^42.1.0 to exact 41.4.0 in apps/studio/package.json
• Updates package-lock.json accordingly

Testing Instructions

1. Build and launch Studio on macOS
2. Confirm the macOS Keychain prompt no longer appears on startup
3. Verify normal site operations (create/start/stop sites) still work

Context

Electron 42 introduced a regression (electron/electron#50419) where ESM named imports from 'electron' touch the OS keychain on app.ready even when safeStorage is never called by app code. This causes a macOS Keychain permission dialog ("Electron wants to use your confidential information stored in 'Studio Safe Storage'") to appear on every launch.

The fix is merged into Electron's main branch (targeting Electron 43). Since no 42.x backport exists, we pin to 41.4.0 until Electron 43 ships.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[wpmobilebot]

📊 Performance Test Results

Comparing 063a5a0 vs trunk

app-size

Metric	trunk	063a5a0	Diff	Change
App Size (Mac)	1339.07 MB	1334.91 MB	4.15 MB	🟢 -0.3%

site-editor

Metric	trunk	063a5a0	Diff	Change
load	1775 ms	1760 ms	15 ms	⚪ 0.0%

site-startup

Metric	trunk	063a5a0	Diff	Change
siteCreation	9592 ms	9599 ms	+7 ms	⚪ 0.0%
siteStartup	4924 ms	4919 ms	5 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

[fredrikekelund]

Installs cleanly. The app starts fine, and E2E tests are passing. LGTM 👍

I removed the devDependencies entry from the root package.json file, as that appeared to have been unintentional

[wojtekn]

I removed the devDependencies entry from the root package.json file, as that appeared to have been unintentional

Thanks. I added it as I couldn't start Electron after the downgrade without that - maybe I should just remove node_modules instead. 🤔