electron-updater@7.0.0-alpha.5

Major Changes

• Feat(updater): default disableWebInstaller to true #9979 7a0abca @mmaietta

  BREAKING CHANGE: AppUpdater.disableWebInstaller now defaults to true. NSIS web-installer packages are no longer loaded unless you opt in, because their payload is fetched from a manifest-supplied URL that may not undergo signature verification.

  v27 ships a one-major-version grace period so existing deployments are not broken without warning:

  • If you never set disableWebInstaller (the default) and a web-installer update is received, the updater logs a deprecation warning and still downloads it. In v28 this becomes an error and the download is blocked (ERR_UPDATER_WEB_INSTALLER_DISABLED).
  • If you explicitly set disableWebInstaller = true, the download throws ERR_UPDATER_WEB_INSTALLER_DISABLED immediately.

  If you intentionally publish and rely on an NSIS web installer, opt back in before v28 by setting autoUpdater.disableWebInstaller = false in your main process.

• Feat(updater)!: install-on-next-launch mode, OS session-end guard, object-form quitAndInstall, and autoInstallEvent enum #10011 1798f6b @claude

  BREAKING: quitAndInstall now takes a single destructured options object instead of positional booleans, so v27 migrators discover the new deferred-install flag and can never swap arguments silently. Defaults are unchanged; there is no backward-compat shim.

  // Before (v26)
  autoUpdater.quitAndInstall(true, false)
  
  // After (v27)
  autoUpdater.quitAndInstall({ isSilent: true, isForceRunAfter: false })

  BREAKING: the autoInstallOnAppQuit boolean is replaced by an autoInstallEvent: "manual" | "onQuit" | "onNextLaunch" enum (default "onQuit", which preserves prior behavior). There is no compat alias — a single boolean cannot express the three states.

  // Before (v26)
  autoUpdater.autoInstallOnAppQuit = false
  
  // After (v27)
  autoUpdater.autoInstallEvent = "manual"

  Installing an update while the app quits spawns a detached installer process; when the quit is caused by the OS session ending (shutdown/reboot/log off on Windows), the OS can kill that installer mid-install and leave the app uninstalled but not re-installed (#7807). Two mitigations, both implemented in BaseUpdater so NSIS, AppImage, deb, rpm and pacman targets all inherit them:

  • Session-end guard (always on): when the OS session is ending, the on-quit install is skipped with a warning and the downloaded update stays cached for the next quit. Detection is best-effort: powerMonitor shutdown on macOS/Linux, BrowserWindow session-end on Windows (windowless apps cannot be covered on Windows).
  • autoInstallEvent: "onNextLaunch" (opt-in; default is "onQuit"): any app quit persists the downloaded update as pending instead of spawning the installer. On the next launch the updater re-validates the cached installer against freshly fetched update info (checksum, code signature on Windows, and an installable-change version check — newer, or a downgrade when allowDowngrade is set — as a loop guard) and installs it silently, restarting the app. A single quit can be deferred via the new quitAndInstall({ waitUntilNextLaunch: true }) option.

  The automatic install at startup is restricted to targets that install without an elevation prompt: NSIS (per-user installs) and AppImage only. deb/rpm/pacman always elevate via pkexec/sudo to install — an authentication dialog at app launch is not acceptable — so they keep the pending update and log why; per-machine NSIS installs (UAC) are skipped the same way. For those targets, call the new installPendingUpdateIfAvailable() explicitly at a moment the app controls.

  autoInstallEvent: "onNextLaunch" is opt-in in v27 and is planned to become the DEFAULT in v28 to resolve this class of session-end corruption once and for all. macOS is unaffected: Squirrel.Mac natively stages downloaded updates and applies them on relaunch (there "onQuit" and "onNextLaunch" behave identically).

Minor Changes

• Feat: add Cloudflare R2 publish provider #9773 a086ef3 @kyletaylored

• Feat(nsis): self-identify install method via resources/package-type so nsis-web installs default disableWebInstaller to false #9979 7a0abca @mmaietta

  NSIS installers now write a resources/package-type marker (nsis or nsis-web) at install time, mirroring the existing Linux package-type mechanism. electron-updater's NsisUpdater reads this marker and, for nsis-web installs, pre-seeds disableWebInstaller = false so web-installer auto-updates keep working without the app wiring the flag by hand.

  This is a default only: an explicit autoUpdater.disableWebInstaller = … set by the app still wins, and a plain nsis marker leaves the secure ?? true default (and the v27 grace-period warning) untouched. The marker is written by the installer script — the only build artifact that differs between nsis and nsis-web (the app payload is byte-identical, since both targets share one app archive). Only go-forward installs carry the marker; existing deployments are unaffected.

• Feat(updater): add allowUnverifiedLinuxPackages to optionally enforce Linux package signature verification #9990 65f0403 @mmaietta

  Adds AppUpdater.allowUnverifiedLinuxPackages. Because electron-builder does not sign Linux packages, this defaults to true, preserving the existing behavior: .deb/.rpm auto-updates install with the package manager's signature/GPG checks bypassed where a bypass flag exists (--allow-unauthenticated for the apt fallback, --allow-unsigned-rpm for zypper, --nogpgcheck for dnf/yum).

  If you sign your Linux packages through your own pipeline and the target systems trust your keys, set autoUpdater.allowUnverifiedLinuxPackages = false. What this enforces depends on the package manager used on the target system:

  • dpkg (the default for .deb): no effect — dpkg performs no signature verification (a warning is logged); enforcing .deb signatures requires a debsig-verify/debsigs policy on the target system.
  • apt (.deb fallback): --allow-unauthenticated is omitted.
  • zypper: enforced — unsigned/untrusted packages fail to install.
  • dnf/yum: enforced via --setopt=localpkg_gpgcheck=1 (local package files are not GPG-checked by default).
  • bare rpm (fallback): cannot be enforced via the CLI (a warning is logged) — rpm verifies signatures when present but by default does not fail the install on unsigned/untrusted packages; the rpm -Uvh ... --nodeps fallback command is unchanged (--nodeps is a dependency-resolution bypass, not a signature bypass).

  The new allowUnverified parameter on DebUpdater.installWithCommandRunner / RpmUpdater.installWithCommandRunner is a trailing optional argument (default true), so existing callers remain source- and runtime-compatible.

Patch Changes

• Fix: Reject the differential download promise instead of crashing with an uncaughtException when the multipart range response emits a network error #10021 5eed26b @claude

• Fix(updater): make GitHubProvider pick the newest available release if allowPrerelease=true but current version is stable #9895 1f681e1 @AbdulrhmanGoni

  • allowPrerelease=true with no explicit channel and a stable current version now selects the newest valid semver release in the Atom feed (skipping unrelated non-semver tags such as other packages in a monorepo) instead of blindly taking the first feed entry (#9894).
  • When every published release is older than the installed version, the updater now reports "update not available" gracefully (and honors allowDowngrade) instead of throwing.
  • allowPrerelease=false no longer throws ERR_UPDATER_NO_PUBLISHED_VERSIONS when the latest release tag (from /releases/latest) is absent from GitHub's truncated Atom feed; it proceeds with the resolved tag.
  • Harden the release download path against path traversal: a tag containing ./.. path segments is rejected with ERR_UPDATER_INVALID_TAG.

• Fix(updater): detect legacy hex sha512 manifest values strictly and deprecate them for removal in v28 _#9990 65f0403 [@mmaietta...

electron-builder@27.0.0-alpha.6

What's Changed

• chore(deps): override @babel/plugin-transform-modules-systemjs to >=7.29.4 by @mmaietta in #9959
• chore(deps): override fast-xml-builder to >=1.1.7 by @mmaietta in #9960
• chore(deps): override @xmldom/xmldom to >=0.8.13 by @mmaietta in #9961
• fix(mac): keep CFBundleName and helper app bundle names consistent by @mmaietta in #9962
• chore(deps): pin vite to >=6.4.2 by @mmaietta in #9965
• chore(test): reactivate mac blackbox updater test by @mmaietta in #9928
• chore(deps): override lodash to >=4.18.0 by @mmaietta in #9966
• feat(win): add MSIX target (beta) by @mmaietta in #9808
• fix: ship snapcraft type declarations so SnapOptions.d.ts resolves for consumers by @mmaietta in #9971
• feat(dmg): default DMG filesystem to APFS (BREAKING) by @mmaietta in #9978
• chore(deps): update docker/login-action action to v3.7.0 by @renovate[bot] in #9984
• chore(deps): update actions/stale action to v10.3.0 - autoclosed by @renovate[bot] in #9982
• chore(deps): update actions/cache action to v5.0.5 by @renovate[bot] in #9981
• chore: Updating pnpm to latest 11.9.0 by @mmaietta in #9986
• chore(deps): update guibranco/github-status-action-v2 action to v1.2.4 by @renovate[bot] in #9985
• fix(nsis): reliably install the main executable and native binaries on x64 and arm64 by @mmaietta in #9988
• chore(docs): remove dead link by @skmedix in #9987
• fix(updater): make GitHubProvider pick the newest available release if allowPrerelease=true but current version is stable by @AbdulrhmanGoni in #9895
• feat(updater): harden NSIS web-installer auto-updates: secure-by-default disableWebInstaller, a v27 grace period, and target self-identification by @mmaietta in #9979
• fix: extract .tar.7z snap template archives correctly by @claude[bot] in #10003
• fix: don't empty locales dir when electronLanguages uses bare language codes by @claude[bot] in #10007
• feat(updater): fix manifest sha512 hash-encoding sniffing, add opt-in Linux package-signature verification by @mmaietta in #9990
• fix(test): enforce snapshot mismatches in Linux docker test shards by @claude[bot] in #10012
• feat(app-builder-lib): exclude default production deps from node_modules instead of erroring (BREAKING) by @liamcmitchell in #9994
• feat(updater): gate legacy top-level manifest path/sha512 behind electronUpdaterCompatibility (BREAKING) by @mmaietta in #9992
• feat(dmg): support ULMO (lzma) disk image format by @yyq1025 in #10018
• fix(electron-updater): reject instead of crashing on multipart range response error by @claude[bot] in #10021
• ci: run generated AppImage blackbox update suites in the e2e appimage job by @claude[bot] in #10025
• fix: prevent duplicate GitHub draft releases from concurrent artifact uploads by @claude[bot] in #10028
• feat(publish): support Bitbucket Cloud access tokens (Bearer auth) by @mmaietta in #10023
• fix(mac): don't warn about disable-library-validation when the effective entitlements already grant it by @claude[bot] in #10029
• feat: fail fast on Windows ia32 / Linux armv7l with Electron 44+, expand arch "all" to x64+arm64 (BREAKING) by @claude[bot] in #10032
• feat(electron-publish): add Cloudflare R2 publish provider by @kyletaylored in #9773
• feat(updater): opt-in install-on-next-launch mode and OS session-end guard (BREAKING) by @claude[bot] in #10011
• chore(deploy): Release (next) (alpha) by @electron-builder-release-bot[bot] in #9964

New Contributors

• @yyq1025 made their first contribution in #10018
• @kyletaylored made their first contribution in #9773

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@27.0.0-alpha.5...electron-builder@27.0.0-alpha.6

electron-builder@26.15.7

What's Changed

• fix: extract .tar.7z snap template archives correctly (v26 backport of #10003) by @claude[bot] in #10004
• fix: don't empty locales dir when electronLanguages uses bare language codes (v26 backport of #10007) by @claude[bot] in #10008
• chore(deploy): Release (v26) by @electron-builder-release-bot[bot] in #10005

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.6...electron-builder@26.15.7

electron-builder@26.15.6

What's Changed

• fix: bundle a workspace sub-package's production dependencies into app.asar when the package manager resolves to the workspace root by @mmaietta in #9950
• fix(nsis): reliably install the main executable and native binaries on x64 and arm64 by @mmaietta in #9989
• chore(deploy): Release (v26) by @electron-builder-release-bot[bot] in #9952

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.5...electron-builder@26.15.6

electron-updater@7.0.0-alpha.4

Patch Changes

• Chore(refactor): reducing duplicate code and extracting helper functions #9947 8f3d9fa @mmaietta

Updated 1 dependency

8f3d9fa

• builder-util-runtime@10.0.0-alpha.4

electron-builder@27.0.0-alpha.5

What's Changed

• feat: Promote and adopt "latest" as the canonical "null"-state for every Toolset (BREAKING) by @mmaietta in #9939
• feat(snap): support multi-arch remote-build via buildFor: string[] — one Launchpad job now produces and registers multiple snap artifacts by @mmaietta in #9841
• feat: promote Azure Trusted Signing and Snap Core24 out of Beta; update documentation by @mmaietta in #9949
• chore(refactor): Duplicated-Logic Extraction & Migration by @mmaietta in #9947
• chore(tests): improve smart-cache reset, implement per-run test summary, output combined report + opt-in test coverage by @mmaietta in #9948
• fix: bundle a workspace sub-package's production dependencies into app.asar when the package manager resolves to the workspace root by @mmaietta in #9951
• fix(nsis): Change the ProgID to a more correct, more unique format by @sabonerune in #9241
• chore: resolve all zizmor GitHub Actions security findings by @mmaietta in #9890
• fix(squirrel): flaky appOutDir mutation created elevate.exe race condition in concurrent builds by @mmaietta in #9852
• chore(CI): untap brew taps to remove constant warnings from default macos runners by @mmaietta in #9953
• docs: extract v27 breaking changes into a dedicated, prominent page (IA restructure) by @mmaietta in #9955
• chore(test): de-duplicate the skipped-test count in the CI run summary by @mmaietta in #9957
• feat(toolsets)!: remove USE_SYSTEM_FPM env override; require an explicit custom toolset on Windows (BREAKING) by @mmaietta in #9958
• fix(migrate-schema): stop stripping vPrefixedTagName from GitLab publish entries by @mmaietta in #9956
• feat: Allow including default-excluded files via files globs; remove disableDefaultIgnoredFiles (BREAKING) by @mmaietta in #9954
• chore(deploy): Release (next) (alpha) by @electron-builder-release-bot[bot] in #9946

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@27.0.0-alpha.4...electron-builder@27.0.0-alpha.5

electron-builder@26.15.5

What's Changed

• fix: resolve merge-smart-cache CI step failures on branch names with / by @mmaietta in #9931
• fix(snap): core24 now runs the app through a generated launcher script by @mmaietta in #9937
• fix: updating icons toolset to latest 1.2.1 for broader icns asset generation by @mmaietta in #9943
• chore(deploy): Release (v26) by @electron-builder-release-bot[bot] in #9938

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.4...electron-builder@26.15.5

electron-updater@7.0.0-alpha.3

Patch Changes

Updated 1 dependency

deafee9

• builder-util-runtime@10.0.0-alpha.3

electron-builder@27.0.0-alpha.4

What's Changed

• chore(deps): override shell-quote to >=1.8.4 by @mmaietta in #9909
• chore: migrate mkdtemp usages to TmpDir (unify temp-directory usage) by @mmaietta in #9907
• fix(win): serialize concurrent signtool invocations with lockfile by @mmaietta in #9920
• chore(deps): override esbuild to >=0.28.1 by @mmaietta in #9910
• chore(test): runtime-gated test files inflate cross-platform shard duration estimates by @mmaietta in #9904
• chore(deps): override tmp to >=0.2.6 by @mmaietta in #9911
• chore(deps): override serialize-javascript to >=7.0.5 by @mmaietta in #9912
• feat: Remove linux.syncDesktopName — always sync the installed .desktop filename (BREAKING) by @mmaietta in #9908
• chore(deploy): mark .changeset/config.json as skip-worktree for publishing by @mmaietta in #9925
• feat(linux): unified executableArgs entrypoint by @mmaietta in #9922
• fix: resolve merge-smart-cache CI job failing to upload vitest smart cache by @mmaietta in #9932
• chore(test): de-sequentialize temp-dir tests via per-test TmpDir context by @mmaietta in #9916
• fix(test): stabilize corepack warmup during CI setup via retry mechanism by @mmaietta in #9933
• fix(win): retry the spurious "The batch file cannot be found." cmd.exe race condition by @mmaietta in #9929
• fix(nsis): preserve $(...) LangString references in escaped NSIS define values (e.g. shortcutName: "$(customSN)") by @mmaietta in #9934
• fix: test noise and stability (icon conv toolset lock, corepack noise, signtool failure) by @mmaietta in #9935
• feat: programmatic v26->v27 schema migrator by @mmaietta in #9941
• feat: escape xml for appxmanifest; consolidate usage to builder-util by @regnete in #9853
• fix(mac): resolve universal build failure with platform-specific single-arch dependencies by @mmaietta in #9942
• chore(test): resolve flakiness in snap core24 unit test by @mmaietta in #9944
• feat(nsis): add Hebrew (he) translations and bundle he_IL for installer messages by @kdroidFilter in #9927
• chore(deploy): Release (next) (alpha) by @electron-builder-release-bot[bot] in #9913

New Contributors

• @kdroidFilter made their first contribution in #9927

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@27.0.0-alpha.3...electron-builder@27.0.0-alpha.4

electron-builder@26.15.4

What's Changed

• chore: set up release/v26 branch release CD by @mmaietta in #9864
• fix(nsis): preserve $(...) LangString references in escaped NSIS define values by @mmaietta in #9917
• fix(linux): write executableArgs verbatim into the .desktop Exec by @mmaietta in #9918
• chore: backport fixes from master to v26 by @mmaietta in #9921
• chore(deploy): Release (v26) by @electron-builder-release-bot[bot] in #9919
• chore(deploy): remove runtime-generated test suite from pnpm compile for publish pipeline by @mmaietta in #9923
• chore(deploy): Mark .changeset/config.json as skip-worktree by @mmaietta in #9924
• chore(deploy): add --publish-branch ${GITHUB_REF_NAME:-master} by @mmaietta in #9926

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.3...electron-builder@26.15.4