electron-builder@26.16.1

What's Changed

• fix(squirrel): backport elevate.exe appOutDir race fix to v26 (#9852) by @claude[bot] in #10157
• fix(mac): use keychain password for set-key-partition-list (v26 backport of #10101) by @claude[bot] in #10172
• fix(win): only log "signing with signtool.exe" when signing actually runs by @claude[bot] in #10171
• chore(CI): auto-label PRs targeting backports to release/v26 (#10158) by @mmaietta in #10166
• fix(mac): Retain Electron and Chromium license files on macOS (v26 backport of #10174) by @claude[bot] in #10177
• fix: prevent infinite recursion in node module collection when a package depends on itself (backport #10070 to v26) by @claude[bot] in #10180
• chore(deploy): Release (v26) by @electron-builder-release-bot[bot] in #10165

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.0...electron-builder@26.16.1

electron-builder@26.16.0

What's Changed

• feat(v26): offline checksum validation via locally seeded SHASUMS256.txt for air-gapped builds by @claude[bot] in #10047
• fix(nsis): accept base64 SHA-512 checksums for custom NSIS toolset downloads by @claude[bot] in #10041
• fix: v26 backport of #10050 by @claude[bot] in #10052
• feat: add allowMissingDependencies to fail builds on missing production deps (v26, warn-only default) by @claude[bot] in #10074
• fix(nsis): run PowerShell with -NoProfile -NonInteractive in allowOnlyOneInstallerInstance checks (v26 backport of #10051) by @claude[bot] in #10053
• fix(mac): bump icons toolset to 1.2.3 so small ICNS sizes are written as ic04/ic05 ARGB (v26) by @claude[bot] in #10088
• fix(linux): bump linux-tools-mac toolset to 1.0.1 so its binaries run on macOS 15+ (v26) by @claude[bot] in #10102
• fix: emit afterSign hook for mas/mas-dev builds (v26) by @claude[bot] in #10072
• docs(website): env-driven baseUrl + version dropdown; stop v26 releases from prod-deploying electron.build by @claude[bot] in #10090
• fix: pin @noble/hashes to v1 so blockmap generation works on Node < 20.19 by @claude[bot] in #10108
• feat: backport escape xml for appxmanifest by @regnete in #10099
• chore(deploy): Release (v26) by @electron-builder-release-bot[bot] in #10059

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.7...electron-builder@26.16.0

electron-updater@7.0.0-alpha.7

Patch Changes

• Docs: fix broken electron.build documentation links in readmes, TSDoc comments, and error messages — point auto-update, code-signing, and multi-platform-build references at their new /docs/features/ locations, repair the electron.build./ domain typo, and replace anchors that no longer exist (#10107) #10111 cf39086 @claude

Updated 1 dependency

cf39086

• builder-util-runtime@10.0.0-alpha.7

electron-builder@27.0.0-alpha.8

What's Changed

• fix(nsis): run PowerShell with -NoProfile -NonInteractive in allowOnlyOneInstallerInstance checks by @claude[bot] in #10051
• fix(nsis): detect running app in previous install locations when checking/closing processes by @claude[bot] in #10024
• fix: emit afterSign hook for mas/mas-dev builds by @claude[bot] in #10071
• fix(mac): bump linux-tools-mac toolset to 1.0.1 (macOS 15+) and stop mangling custom toolset URLs by @claude[bot] in #10100
• fix: Only logs that we've signed a file if we actually did by @DiefBell in #10082
• fix(nsis): default the uninstall-failure dialog in silent installs so auto-update cannot hang by @claude[bot] in #10034
• chore(deps): update dependency electron to v39.8.10 [security] by @renovate[bot] in #10069
• fix: exclude slnx files by @redwyre in #9969
• fix: retry Electron/binaries downloads on transient errors; cache Windows toolset and self-heal the Electron zip cache by @claude[bot] in #10105
• fix(mac): pass the keychain password to security set-key-partition-list by @amwyygyuge in #10101
• fix(app-builder-lib): return sign result instead of boolean from windows signing chain by @claude[bot] in #10104
• fix: update 7zip toolset to 1.0.1 with correct per-arch Windows binaries by @claude[bot] in #10103
• fix: preserve Yarn Berry registry credentials by @atirna in #10079
• docs(website): self-contained multi-version site build — one container composes / and /v26/ via RELEASE_TAGS by @claude[bot] in #10089
• test: internalize updater test suite (localhost fixtures, offline provider tests, no token gates) by @claude[bot] in #10110
• docs: fix broken documentation links by @claude[bot] in #10111
• fix(app-builder-lib): expand lower channels when channel name has a suffix by @ylkhayat in #9998
• chore(deps): update dotenv and dotenv-expand by @mmaietta in #9968
• fix(publish): report the repository detected for app-update.yml at build time by @maximilliangrand in #10081
• fix(linux): remove http-parser from default pacman depends; support "default" keyword in depends by @claude[bot] in #10109
• docs: update CONTRIBUTING.md by @mmaietta in #10156
• chore(CI): auto-label PRs targeting backports to release/v26 by @mmaietta in #10158
• chore(deploy): Release (next) (alpha) by @electron-builder-release-bot[bot] in #10096

New Contributors

• @DiefBell made their first contribution in #10082
• @redwyre made their first contribution in #9969
• @amwyygyuge made their first contribution in #10101
• @atirna made their first contribution in #10079
• @ylkhayat made their first contribution in #9998
• @maximilliangrand made their first contribution in #10081

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@27.0.0-alpha.7...electron-builder@27.0.0-alpha.8

electron-updater@7.0.0-alpha.6

Minor Changes

• Feat: warn on silently skipped update signature verification and validate publisherName against the signing certificate at build time #10056 331afdd @claude

  Two guards around Windows update signature verification:

  • electron-updater: when app-update.yml exists but contains no publisherName, the updater used to skip signature verification (including custom verifyUpdateCodeSignature hooks) completely silently. It now logs a warning explaining that verification was skipped, how to fix it (sign the build so publisherName is derived automatically, or set win.publisherName explicitly), and that this fail-open behavior is deprecated: electron-builder v28 will treat a missing publisherName as a verification failure (fail-closed). The no-app-update.yml path (unpackaged/dev mode) stays silent.
  • app-builder-lib: when publisherName is explicitly configured and the subject of the local code signing certificate is known, the build now fails with a clear error if none of the configured names match the certificate (same DN-subset/CN matching semantics as the updater's verifier; any one of multiple configured names matching passes, so certificate-rotation setups keep working). This catches signing with the wrong certificate at build time instead of at update time. The check is skipped whenever the actual signing certificate's subject is not genuinely known (custom sign hooks, Azure Trusted Signing, PKCS#11 without an extractable certificate, x509 files without a CN), and publisherName: null remains a pure opt-out.

Patch Changes

• Fix: expose ./package.json in the exports map so tooling (including electron-builder's installed-version check) can resolve the installed version via require.resolve("electron-updater/package.json") #10019 0fdb4cb @claude
• Security hardening and a migrate-schema fix: #10036 b87a0b7 @mmaietta
  • builder-util removePassword: redact single-letter/URI secret flags (security … -k <password>, osslsigncode -key <pkcs11-uri?pin-value=…>) and whitespace-containing secrets in debug logs, and make the /b … /c block-redaction regex ReDoS-safe.
  • builder-util-runtime httpExecutor: fix the non-functional maxRedirects guard (the redirect counter was never advanced), so a redirect loop from a malicious feed/mirror no longer hangs the updater.
  • electron-updater GitLabProvider: only forward the GitLab token to the channel-file request when its URL is same-origin as the API host, so an off-host/http:// direct_asset_url in the release JSON cannot exfiltrate the token.
  • app-builder-lib: defense-in-depth hardening — validate executableName before interpolating it into the generated Flatpak launcher, contain custom-toolset extraction within the cache dir, and XML-escape MSI file-association ext/description.
  • electron-builder migrate-schema: auto-remove the removed linux.syncDesktopName flag.

Updated 1 dependency

b87a0b7

• builder-util-runtime@10.0.0-alpha.6

electron-builder@27.0.0-alpha.7

What's Changed

• chore(release): exit alpha release state and resolve discrepancies in migration docs by @mmaietta in #10036
• chore(docs): v27 website documentation audit by @mmaietta in #10037
• feat: offline checksum validation via locally seeded SHASUMS256.txt for air-gapped builds by @claude[bot] in #10046
• build: trust renovate[bot] in Faraday config by @claude[bot] in #10030
• fix(app-builder-lib): don't mutate shared UpdateInfo.files when applying GitHub safeArtifactName by @claude[bot] in #10013
• fix: allow parentheses in AppImage product/executable names by @claude[bot] in #10050
• test: update generic/github/r2 snapshot for safeArtifactName fix by @claude[bot] in #10063
• fix: skip electron-updater version validation for pnpm catalog:/workspace: specifiers by @claude[bot] in #10019
• fix: prevent infinite recursion in node module collection when a package depends on itself by @claude[bot] in #10070
• feat: warn on skipped update signature verification and validate publisherName against signing certificate by @claude[bot] in #10056
• fix: don't bundle workspace node_modules when app has no production dependencies by @claude[bot] in #10035
• feat(app-builder-lib): fail the build when extraFiles/extraResources to escapes the package by @claude[bot] in #10062
• feat: fail builds on missing production dependencies by default (allowMissingDependencies) by @claude[bot] in #10073
• feat(app-builder-lib): restore mac.sign.type for explicit development/distribution signing by @claude[bot] in #10065
• test: provide metadata in allowMissingDependencies wiring-test mock by @claude[bot] in #10086
• fix: don't apply default plugs or layout to classic-confinement core24 snaps by @claude[bot] in #10060
• fix(mac): bump icons toolset to 1.2.3 so small ICNS sizes are written as ic04/ic05 ARGB (fixes corrupt 16/32px Finder/DMG icons) by @claude[bot] in #10087
• fix(deb): multithread the data.tar xz compression by @xpolb01 in #10049
• chore(deploy): Release (next) (alpha) by @electron-builder-release-bot[bot] in #10038

New Contributors

• @xpolb01 made their first contribution in #10049

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@27.0.0-alpha.6...electron-builder@27.0.0-alpha.7

electron-updater@7.0.0-alpha.5

Major Changes

• Feat(updater): default disableWebInstaller to true #9979 7a0abca @mmaietta

  BREAKING CHANGE: AppUpdater.disableWebInstaller now defaults to true. NSIS web-installer packages are no longer loaded unless you opt in, because their payload is fetched from a manifest-supplied URL that may not undergo signature verification.

  v27 ships a one-major-version grace period so existing deployments are not broken without warning:

  • If you never set disableWebInstaller (the default) and a web-installer update is received, the updater logs a deprecation warning and still downloads it. In v28 this becomes an error and the download is blocked (ERR_UPDATER_WEB_INSTALLER_DISABLED).
  • If you explicitly set disableWebInstaller = true, the download throws ERR_UPDATER_WEB_INSTALLER_DISABLED immediately.

  If you intentionally publish and rely on an NSIS web installer, opt back in before v28 by setting autoUpdater.disableWebInstaller = false in your main process.

• Feat(updater)!: install-on-next-launch mode, OS session-end guard, object-form quitAndInstall, and autoInstallEvent enum #10011 1798f6b @claude

  BREAKING: quitAndInstall now takes a single destructured options object instead of positional booleans, so v27 migrators discover the new deferred-install flag and can never swap arguments silently. Defaults are unchanged; there is no backward-compat shim.

  // Before (v26)
  autoUpdater.quitAndInstall(true, false)
  
  // After (v27)
  autoUpdater.quitAndInstall({ isSilent: true, isForceRunAfter: false })

  BREAKING: the autoInstallOnAppQuit boolean is replaced by an autoInstallEvent: "manual" | "onQuit" | "onNextLaunch" enum (default "onQuit", which preserves prior behavior). There is no compat alias — a single boolean cannot express the three states.

  // Before (v26)
  autoUpdater.autoInstallOnAppQuit = false
  
  // After (v27)
  autoUpdater.autoInstallEvent = "manual"

  Installing an update while the app quits spawns a detached installer process; when the quit is caused by the OS session ending (shutdown/reboot/log off on Windows), the OS can kill that installer mid-install and leave the app uninstalled but not re-installed (#7807). Two mitigations, both implemented in BaseUpdater so NSIS, AppImage, deb, rpm and pacman targets all inherit them:

  • Session-end guard (always on): when the OS session is ending, the on-quit install is skipped with a warning and the downloaded update stays cached for the next quit. Detection is best-effort: powerMonitor shutdown on macOS/Linux, BrowserWindow session-end on Windows (windowless apps cannot be covered on Windows).
  • autoInstallEvent: "onNextLaunch" (opt-in; default is "onQuit"): any app quit persists the downloaded update as pending instead of spawning the installer. On the next launch the updater re-validates the cached installer against freshly fetched update info (checksum, code signature on Windows, and an installable-change version check — newer, or a downgrade when allowDowngrade is set — as a loop guard) and installs it silently, restarting the app. A single quit can be deferred via the new quitAndInstall({ waitUntilNextLaunch: true }) option.

  The automatic install at startup is restricted to targets that install without an elevation prompt: NSIS (per-user installs) and AppImage only. deb/rpm/pacman always elevate via pkexec/sudo to install — an authentication dialog at app launch is not acceptable — so they keep the pending update and log why; per-machine NSIS installs (UAC) are skipped the same way. For those targets, call the new installPendingUpdateIfAvailable() explicitly at a moment the app controls.

  autoInstallEvent: "onNextLaunch" is opt-in in v27 and is planned to become the DEFAULT in v28 to resolve this class of session-end corruption once and for all. macOS is unaffected: Squirrel.Mac natively stages downloaded updates and applies them on relaunch (there "onQuit" and "onNextLaunch" behave identically).

Minor Changes

• Feat: add Cloudflare R2 publish provider #9773 a086ef3 @kyletaylored

• Feat(nsis): self-identify install method via resources/package-type so nsis-web installs default disableWebInstaller to false #9979 7a0abca @mmaietta

  NSIS installers now write a resources/package-type marker (nsis or nsis-web) at install time, mirroring the existing Linux package-type mechanism. electron-updater's NsisUpdater reads this marker and, for nsis-web installs, pre-seeds disableWebInstaller = false so web-installer auto-updates keep working without the app wiring the flag by hand.

  This is a default only: an explicit autoUpdater.disableWebInstaller = … set by the app still wins, and a plain nsis marker leaves the secure ?? true default (and the v27 grace-period warning) untouched. The marker is written by the installer script — the only build artifact that differs between nsis and nsis-web (the app payload is byte-identical, since both targets share one app archive). Only go-forward installs carry the marker; existing deployments are unaffected.

• Feat(updater): add allowUnverifiedLinuxPackages to optionally enforce Linux package signature verification #9990 65f0403 @mmaietta

  Adds AppUpdater.allowUnverifiedLinuxPackages. Because electron-builder does not sign Linux packages, this defaults to true, preserving the existing behavior: .deb/.rpm auto-updates install with the package manager's signature/GPG checks bypassed where a bypass flag exists (--allow-unauthenticated for the apt fallback, --allow-unsigned-rpm for zypper, --nogpgcheck for dnf/yum).

  If you sign your Linux packages through your own pipeline and the target systems trust your keys, set autoUpdater.allowUnverifiedLinuxPackages = false. What this enforces depends on the package manager used on the target system:

  • dpkg (the default for .deb): no effect — dpkg performs no signature verification (a warning is logged); enforcing .deb signatures requires a debsig-verify/debsigs policy on the target system.
  • apt (.deb fallback): --allow-unauthenticated is omitted.
  • zypper: enforced — unsigned/untrusted packages fail to install.
  • dnf/yum: enforced via --setopt=localpkg_gpgcheck=1 (local package files are not GPG-checked by default).
  • bare rpm (fallback): cannot be enforced via the CLI (a warning is logged) — rpm verifies signatures when present but by default does not fail the install on unsigned/untrusted packages; the rpm -Uvh ... --nodeps fallback command is unchanged (--nodeps is a dependency-resolution bypass, not a signature bypass).

  The new allowUnverified parameter on DebUpdater.installWithCommandRunner / RpmUpdater.installWithCommandRunner is a trailing optional argument (default true), so existing callers remain source- and runtime-compatible.

Patch Changes

• Fix: Reject the differential download promise instead of crashing with an uncaughtException when the multipart range response emits a network error #10021 5eed26b @claude

• Fix(updater): make GitHubProvider pick the newest available release if allowPrerelease=true but current version is stable #9895 1f681e1 @AbdulrhmanGoni

  • allowPrerelease=true with no explicit channel and a stable current version now selects the newest valid semver release in the Atom feed (skipping unrelated non-semver tags such as other packages in a monorepo) instead of blindly taking the first feed entry (#9894).
  • When every published release is older than the installed version, the updater now reports "update not available" gracefully (and honors allowDowngrade) instead of throwing.
  • allowPrerelease=false no longer throws ERR_UPDATER_NO_PUBLISHED_VERSIONS when the latest release tag (from /releases/latest) is absent from GitHub's truncated Atom feed; it proceeds with the resolved tag.
  • Harden the release download path against path traversal: a tag containing ./.. path segments is rejected with ERR_UPDATER_INVALID_TAG.

• Fix(updater): detect legacy hex sha512 manifest values strictly and deprecate them for removal in v28 _#9990 65f0403 [@mmaietta...

electron-builder@27.0.0-alpha.6

What's Changed

• chore(deps): override @babel/plugin-transform-modules-systemjs to >=7.29.4 by @mmaietta in #9959
• chore(deps): override fast-xml-builder to >=1.1.7 by @mmaietta in #9960
• chore(deps): override @xmldom/xmldom to >=0.8.13 by @mmaietta in #9961
• fix(mac): keep CFBundleName and helper app bundle names consistent by @mmaietta in #9962
• chore(deps): pin vite to >=6.4.2 by @mmaietta in #9965
• chore(test): reactivate mac blackbox updater test by @mmaietta in #9928
• chore(deps): override lodash to >=4.18.0 by @mmaietta in #9966
• feat(win): add MSIX target (beta) by @mmaietta in #9808
• fix: ship snapcraft type declarations so SnapOptions.d.ts resolves for consumers by @mmaietta in #9971
• feat(dmg): default DMG filesystem to APFS (BREAKING) by @mmaietta in #9978
• chore(deps): update docker/login-action action to v3.7.0 by @renovate[bot] in #9984
• chore(deps): update actions/stale action to v10.3.0 - autoclosed by @renovate[bot] in #9982
• chore(deps): update actions/cache action to v5.0.5 by @renovate[bot] in #9981
• chore: Updating pnpm to latest 11.9.0 by @mmaietta in #9986
• chore(deps): update guibranco/github-status-action-v2 action to v1.2.4 by @renovate[bot] in #9985
• fix(nsis): reliably install the main executable and native binaries on x64 and arm64 by @mmaietta in #9988
• chore(docs): remove dead link by @skmedix in #9987
• fix(updater): make GitHubProvider pick the newest available release if allowPrerelease=true but current version is stable by @AbdulrhmanGoni in #9895
• feat(updater): harden NSIS web-installer auto-updates: secure-by-default disableWebInstaller, a v27 grace period, and target self-identification by @mmaietta in #9979
• fix: extract .tar.7z snap template archives correctly by @claude[bot] in #10003
• fix: don't empty locales dir when electronLanguages uses bare language codes by @claude[bot] in #10007
• feat(updater): fix manifest sha512 hash-encoding sniffing, add opt-in Linux package-signature verification by @mmaietta in #9990
• fix(test): enforce snapshot mismatches in Linux docker test shards by @claude[bot] in #10012
• feat(app-builder-lib): exclude default production deps from node_modules instead of erroring (BREAKING) by @liamcmitchell in #9994
• feat(updater): gate legacy top-level manifest path/sha512 behind electronUpdaterCompatibility (BREAKING) by @mmaietta in #9992
• feat(dmg): support ULMO (lzma) disk image format by @yyq1025 in #10018
• fix(electron-updater): reject instead of crashing on multipart range response error by @claude[bot] in #10021
• ci: run generated AppImage blackbox update suites in the e2e appimage job by @claude[bot] in #10025
• fix: prevent duplicate GitHub draft releases from concurrent artifact uploads by @claude[bot] in #10028
• feat(publish): support Bitbucket Cloud access tokens (Bearer auth) by @mmaietta in #10023
• fix(mac): don't warn about disable-library-validation when the effective entitlements already grant it by @claude[bot] in #10029
• feat: fail fast on Windows ia32 / Linux armv7l with Electron 44+, expand arch "all" to x64+arm64 (BREAKING) by @claude[bot] in #10032
• feat(electron-publish): add Cloudflare R2 publish provider by @kyletaylored in #9773
• feat(updater): opt-in install-on-next-launch mode and OS session-end guard (BREAKING) by @claude[bot] in #10011
• chore(deploy): Release (next) (alpha) by @electron-builder-release-bot[bot] in #9964

New Contributors

• @yyq1025 made their first contribution in #10018
• @kyletaylored made their first contribution in #9773

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@27.0.0-alpha.5...electron-builder@27.0.0-alpha.6

electron-builder@26.15.7

What's Changed

• fix: extract .tar.7z snap template archives correctly (v26 backport of #10003) by @claude[bot] in #10004
• fix: don't empty locales dir when electronLanguages uses bare language codes (v26 backport of #10007) by @claude[bot] in #10008
• chore(deploy): Release (v26) by @electron-builder-release-bot[bot] in #10005

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.6...electron-builder@26.15.7

electron-builder@26.15.6

What's Changed

• fix: bundle a workspace sub-package's production dependencies into app.asar when the package manager resolves to the workspace root by @mmaietta in #9950
• fix(nsis): reliably install the main executable and native binaries on x64 and arm64 by @mmaietta in #9989
• chore(deploy): Release (v26) by @electron-builder-release-bot[bot] in #9952

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.5...electron-builder@26.15.6