chore(deploy): Release (next) (alpha)

[electron-builder-release-bot]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to master, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

master is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on master.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

app-builder-lib@27.0.0-alpha.7

Minor Changes

• Feat: warn on silently skipped update signature verification and validate publisherName against the signing certificate at build time #10056 331afdd @claude

  Two guards around Windows update signature verification:

  • electron-updater: when app-update.yml exists but contains no publisherName, the updater used to skip signature verification (including custom verifyUpdateCodeSignature hooks) completely silently. It now logs a warning explaining that verification was skipped, how to fix it (sign the build so publisherName is derived automatically, or set win.publisherName explicitly), and that this fail-open behavior is deprecated: electron-builder v28 will treat a missing publisherName as a verification failure (fail-closed). The no-app-update.yml path (unpackaged/dev mode) stays silent.
  • app-builder-lib: when publisherName is explicitly configured and the subject of the local code signing certificate is known, the build now fails with a clear error if none of the configured names match the certificate (same DN-subset/CN matching semantics as the updater's verifier; any one of multiple configured names matching passes, so certificate-rotation setups keep working). This catches signing with the wrong certificate at build time instead of at update time. The check is skipped whenever the actual signing certificate's subject is not genuinely known (custom sign hooks, Azure Trusted Signing, PKCS#11 without an extractable certificate, x509 files without a CN), and publisherName: null remains a pure opt-out.

• Feat: validate to destinations in extraFiles/extraResources file sets. An absolute to path (POSIX, Windows drive-letter, or UNC) or a relative to that escapes the build output directory now fails the build with a clear InvalidConfigurationError instead of silently copying files outside the package onto the build machine. Relative hops that stay inside the build output directory (e.g. to: "../Frameworks" from Contents/Resources on macOS) keep working. The error suggests the fpm file-mapping syntax ("deb": { "fpm": ["src=/abs/dest"] }) for users who want absolute in-package paths on deb/rpm. #10062 c0b8235 @claude

Patch Changes

• Feat: support fully offline (air-gapped) Electron downloads by picking up a locally seeded SHASUMS256.txt-<version> at the Electron cache root and passing it to @electron/get as inline checksums, suppressing the mandatory network fetch of SHASUMS256.txt that failed air-gapped builds even with a fully seeded cache (Electron builder failing when in air-gapped environment despite having all tools (regression from at least 26.0.20) #10039) #10046 362a01f @claude

• Fix: allow parentheses in AppImage executable, product, and license file names. Before, product names like Zoo Design Studio (Staging) failed AppImage builds with "productFilename contains characters that cannot be safely used in file paths" — a regression from the Go pipeline, which accepted them. After, names containing ( and ) build again; parentheses are legal in Linux filenames and inert inside the double-quoted bash strings of the generated AppRun launcher, while genuinely dangerous characters ($, backticks, quotes, slashes) remain rejected. #10050 f39edbb @claude

• Fix: validate the resolved installed electron-updater version instead of the declared specifier, fixing false "At least electron-updater 4.0.0" errors for pnpm catalog:/workspace: specifiers #10019 0fdb4cb @claude

• Fix: don't mutate shared UpdateInfo.files when applying GitHub safeArtifactName, which leaked the GitHub-safe file name into other publish providers' update metadata #10013 951e177 @claude

• Fix: prevent infinite recursion in node module collection when a package depends on itself (e.g. libsql@0.3.19 via @prisma/adapter-libsql -> @libsql/client), which caused npm-based builds to hang at searching for node modules and eventually crash with a JavaScript heap out-of-memory error (npm node-module collector: heap OOM at 'searching for node modules' on self-referencing dependency (libsql@0.3.19 via @prisma/adapter-libsql) #10068) #10070 075efcf @claude

• Security hardening and a migrate-schema fix: #10036 b87a0b7 @mmaietta

  • builder-util removePassword: redact single-letter/URI secret flags (security … -k <password>, osslsigncode -key <pkcs11-uri?pin-value=…>) and whitespace-containing secrets in debug logs, and make the /b … /c block-redaction regex ReDoS-safe.
  • builder-util-runtime httpExecutor: fix the non-functional maxRedirects guard (the redirect counter was never advanced), so a redirect loop from a malicious feed/mirror no longer hangs the updater.
  • electron-updater GitLabProvider: only forward the GitLab token to the channel-file request when its URL is same-origin as the API host, so an off-host/http:// direct_asset_url in the release JSON cannot exfiltrate the token.
  • app-builder-lib: defense-in-depth hardening — validate executableName before interpolating it into the generated Flatpak launcher, contain custom-toolset extraction within the cache dir, and XML-escape MSI file-association ext/description.
  • electron-builder migrate-schema: auto-remove the removed linux.syncDesktopName flag.

• Fix: don't bundle workspace node_modules when the app has no production dependencies _#10035 f5babad @claude_

  Before: packaging an app that declares zero production dependencies (e.g. everything is bundled by a JS bundler) from inside a monorepo skipped the app's own empty node_modules, climbed to the workspace root, and copied the entire hoisted workspace node_modules into app.asar.

  After: an app with no production dependencies (neither in its package.json nor added via extraMetadata) bundles no node_modules at all — the collection step is skipped with an informational log message.

Updated 5 dependencies

b87a0b7

• builder-util@27.0.0-alpha.7
• builder-util-runtime@10.0.0-alpha.6
• dmg-builder@27.0.0-alpha.7
• electron-builder-squirrel-windows@27.0.0-alpha.7
• electron-publish@27.0.0-alpha.7

electron-updater@7.0.0-alpha.6

Minor Changes

• Feat: warn on silently skipped update signature verification and validate publisherName against the signing certificate at build time #10056 331afdd @claude

  Two guards around Windows update signature verification:

  • electron-updater: when app-update.yml exists but contains no publisherName, the updater used to skip signature verification (including custom verifyUpdateCodeSignature hooks) completely silently. It now logs a warning explaining that verification was skipped, how to fix it (sign the build so publisherName is derived automatically, or set win.publisherName explicitly), and that this fail-open behavior is deprecated: electron-builder v28 will treat a missing publisherName as a verification failure (fail-closed). The no-app-update.yml path (unpackaged/dev mode) stays silent.
  • app-builder-lib: when publisherName is explicitly configured and the subject of the local code signing certificate is known, the build now fails with a clear error if none of the configured names match the certificate (same DN-subset/CN matching semantics as the updater's verifier; any one of multiple configured names matching passes, so certificate-rotation setups keep working). This catches signing with the wrong certificate at build time instead of at update time. The check is skipped whenever the actual signing certificate's subject is not genuinely known (custom sign hooks, Azure Trusted Signing, PKCS#11 without an extractable certificate, x509 files without a CN), and publisherName: null remains a pure opt-out.

Patch Changes

• Fix: expose ./package.json in the exports map so tooling (including electron-builder's installed-version check) can resolve the installed version via require.resolve("electron-updater/package.json") #10019 0fdb4cb @claude
• Security hardening and a migrate-schema fix: #10036 b87a0b7 @mmaietta
  • builder-util removePassword: redact single-letter/URI secret flags (security … -k <password>, osslsigncode -key <pkcs11-uri?pin-value=…>) and whitespace-containing secrets in debug logs, and make the /b … /c block-redaction regex ReDoS-safe.
  • builder-util-runtime httpExecutor: fix the non-functional maxRedirects guard (the redirect counter was never advanced), so a redirect loop from a malicious feed/mirror no longer hangs the updater.
  • electron-updater GitLabProvider: only forward the GitLab token to the channel-file request when its URL is same-origin as the API host, so an off-host/http:// direct_asset_url in the release JSON cannot exfiltrate the token.
  • app-builder-lib: defense-in-depth hardening — validate executableName before interpolating it into the generated Flatpak launcher, contain custom-toolset extraction within the cache dir, and XML-escape MSI file-association ext/description.
  • electron-builder migrate-schema: auto-remove the removed linux.syncDesktopName flag.

Updated 1 dependency

b87a0b7

• builder-util-runtime@10.0.0-alpha.6

builder-util@27.0.0-alpha.7

Patch Changes

• Security hardening and a migrate-schema fix: #10036 b87a0b7 @mmaietta
  • builder-util removePassword: redact single-letter/URI secret flags (security … -k <password>, osslsigncode -key <pkcs11-uri?pin-value=…>) and whitespace-containing secrets in debug logs, and make the /b … /c block-redaction regex ReDoS-safe.
  • builder-util-runtime httpExecutor: fix the non-functional maxRedirects guard (the redirect counter was never advanced), so a redirect loop from a malicious feed/mirror no longer hangs the updater.
  • electron-updater GitLabProvider: only forward the GitLab token to the channel-file request when its URL is same-origin as the API host, so an off-host/http:// direct_asset_url in the release JSON cannot exfiltrate the token.
  • app-builder-lib: defense-in-depth hardening — validate executableName before interpolating it into the generated Flatpak launcher, contain custom-toolset extraction within the cache dir, and XML-escape MSI file-association ext/description.
  • electron-builder migrate-schema: auto-remove the removed linux.syncDesktopName flag.

Updated 1 dependency

b87a0b7

• builder-util-runtime@10.0.0-alpha.6

builder-util-runtime@10.0.0-alpha.6

Patch Changes

• Security hardening and a migrate-schema fix: #10036 b87a0b7 @mmaietta
  • builder-util removePassword: redact single-letter/URI secret flags (security … -k <password>, osslsigncode -key <pkcs11-uri?pin-value=…>) and whitespace-containing secrets in debug logs, and make the /b … /c block-redaction regex ReDoS-safe.
  • builder-util-runtime httpExecutor: fix the non-functional maxRedirects guard (the redirect counter was never advanced), so a redirect loop from a malicious feed/mirror no longer hangs the updater.
  • electron-updater GitLabProvider: only forward the GitLab token to the channel-file request when its URL is same-origin as the API host, so an off-host/http:// direct_asset_url in the release JSON cannot exfiltrate the token.
  • app-builder-lib: defense-in-depth hardening — validate executableName before interpolating it into the generated Flatpak launcher, contain custom-toolset extraction within the cache dir, and XML-escape MSI file-association ext/description.
  • electron-builder migrate-schema: auto-remove the removed linux.syncDesktopName flag.

dmg-builder@27.0.0-alpha.7

Patch Changes

Updated 3 dependencies

362a01f f39edbb 0fdb4cb 331afdd 951e177 075efcf b87a0b7 c0b8235 f5babad

• app-builder-lib@27.0.0-alpha.7
• builder-util@27.0.0-alpha.7
• builder-util-runtime@10.0.0-alpha.6

electron-builder@27.0.0-alpha.7

Patch Changes

• Security hardening and a migrate-schema fix: #10036 b87a0b7 @mmaietta
  • builder-util removePassword: redact single-letter/URI secret flags (security … -k <password>, osslsigncode -key <pkcs11-uri?pin-value=…>) and whitespace-containing secrets in debug logs, and make the /b … /c block-redaction regex ReDoS-safe.
  • builder-util-runtime httpExecutor: fix the non-functional maxRedirects guard (the redirect counter was never advanced), so a redirect loop from a malicious feed/mirror no longer hangs the updater.
  • electron-updater GitLabProvider: only forward the GitLab token to the channel-file request when its URL is same-origin as the API host, so an off-host/http:// direct_asset_url in the release JSON cannot exfiltrate the token.
  • app-builder-lib: defense-in-depth hardening — validate executableName before interpolating it into the generated Flatpak launcher, contain custom-toolset extraction within the cache dir, and XML-escape MSI file-association ext/description.
  • electron-builder migrate-schema: auto-remove the removed linux.syncDesktopName flag.

Updated 5 dependencies

362a01f f39edbb 0fdb4cb 331afdd 951e177 075efcf b87a0b7 c0b8235 f5babad

• app-builder-lib@27.0.0-alpha.7
• builder-util@27.0.0-alpha.7
• builder-util-runtime@10.0.0-alpha.6
• dmg-builder@27.0.0-alpha.7
• electron-publish@27.0.0-alpha.7

electron-builder-squirrel-windows@27.0.0-alpha.7

Patch Changes

Updated 2 dependencies

362a01f f39edbb 0fdb4cb 331afdd 951e177 075efcf b87a0b7 c0b8235 f5babad

• app-builder-lib@27.0.0-alpha.7
• builder-util@27.0.0-alpha.7

electron-forge-maker-appimage@27.0.0-alpha.7

Patch Changes

Updated 1 dependency

362a01f f39edbb 0fdb4cb 331afdd 951e177 075efcf b87a0b7 c0b8235 f5babad

• app-builder-lib@27.0.0-alpha.7

electron-forge-maker-nsis@27.0.0-alpha.7

Patch Changes

Updated 1 dependency

362a01f f39edbb 0fdb4cb 331afdd 951e177 075efcf b87a0b7 c0b8235 f5babad

• app-builder-lib@27.0.0-alpha.7

electron-forge-maker-nsis-web@27.0.0-alpha.7

Patch Changes

Updated 1 dependency

362a01f f39edbb 0fdb4cb 331afdd 951e177 075efcf b87a0b7 c0b8235 f5babad

• app-builder-lib@27.0.0-alpha.7

electron-forge-maker-snap@27.0.0-alpha.7

Patch Changes

Updated 1 dependency

362a01f f39edbb 0fdb4cb 331afdd 951e177 075efcf b87a0b7 c0b8235 f5babad

• app-builder-lib@27.0.0-alpha.7

electron-publish@27.0.0-alpha.7

Patch Changes

Updated 2 dependencies

b87a0b7

• builder-util@27.0.0-alpha.7
• builder-util-runtime@10.0.0-alpha.6