[dependabot]

Bumps app-builder-lib to 26.18.0 and updates ancestor dependency electron-builder. These dependencies need to be updated together.

Updates app-builder-lib from 25.1.8 to 26.18.0

Release notes

Sourced from app-builder-lib's releases.

electron-builder@26.18.0

What's Changed

• fix(nsis): warn when differentialPackage "store-asar" finds no app.asar (v26 backport of #10246) by @​claude[bot] in electron-userland/electron-builder#10249
• test(archive): make stored-member assertions independent of 7-Zip folder order (v26 backport of #10247) by @​claude[bot] in electron-userland/electron-builder#10251
• fix(nsis): keep installer extraction in sync with the payload format when useZip is set (v26 backport of #10248) by @​claude[bot] in electron-userland/electron-builder#10252
• fix(pnpm): read the app's own package.json when its name matches a dependency (v26 backport of #10278) by @​claude[bot] in electron-userland/electron-builder#10282
• fix: import blake2b from @noble/hashes/blake2.js by @​mmaietta in electron-userland/electron-builder#10292
• fix: encode GitLab package path segments (v26 backport of #10140) by @​claude[bot] in electron-userland/electron-builder#10299
• fix(updater): validate cached update filenames (v26 backport of #10115) by @​claude[bot] in electron-userland/electron-builder#10300
• fix: escape Squirrel project URLs in nuspec XML (v26 backport of #10141) by @​claude[bot] in electron-userland/electron-builder#10301
• fix: enforce workspace path boundaries for asar (v26 backport of #10135) by @​claude[bot] in electron-userland/electron-builder#10314
• fix(app-builder-lib): bump @​electron/rebuild to 4.2.1 (v26 backport of #10308) by @​claude[bot] in electron-userland/electron-builder#10315
• feat(blockmap): finer content-defined blocks for the stored app.asar region (v26 backport of #10235) by @​imlucas in electron-userland/electron-builder#10309
• fix(pnpm): collect packages that pnpm list only prints as deduped stubs by @​mmaietta in electron-userland/electron-builder#10323
• fix: contain mapped app file destinations (v26 backport of #10137) by @​claude[bot] in electron-userland/electron-builder#10330
• fix(snap): don't request allow-sandbox by default for core24 (v26 backport of #10294) by @​claude[bot] in electron-userland/electron-builder#10331
• fix(snap): don't delete chrome-sandbox from the shared linux-unpacked dir in template builds (v26 backport of #10327) by @​yokomohoyo in electron-userland/electron-builder#10333
• fix(forge): make electron-builder makers loadable by current Electron Forge (v26 backport) by @​claude[bot] in electron-userland/electron-builder#10352
• chore(deploy): Release (v26) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#10250

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.17.0...electron-builder@26.18.0

electron-builder@26.17.0

What's Changed

• fix: detect pnpm workspace root on Windows without shelling out to pwd (v26 backport) by @​claude[bot] in electron-userland/electron-builder#10189
• test: pin globTest "failed peer dep" deps via lockfile fixture and update snapshot for moment 2.31.0 (v26 backport of #10197) by @​claude[bot] in electron-userland/electron-builder#10198
• feat(nsis): "store-asar" mode for proportional differential updates (v26 backport) by @​claude[bot] in electron-userland/electron-builder#10201
• test(v26): bump package manager pins and disable dependency lifecycle scripts in fixture installs (backport #10199) by @​claude[bot] in electron-userland/electron-builder#10203
• fix(app-builder-lib): resolve pnpm deps omitted from deduped list output by declared range (backport #10200) by @​claude[bot] in electron-userland/electron-builder#10207
• fix(pkg): add rootVolumeOnly to for macOS 26 Installer prompt (v26 backport of #10193) by @​claude[bot] in electron-userland/electron-builder#10211
• fix(node-module-collector): clear error on empty output and fall back to traversal when a collector throws (v26 backport of #10210) by @​claude[bot] in electron-userland/electron-builder#10213
• fix(electron-updater): keep cached blockmap consistent with cached installer (v26 backport of #10098) by @​claude[bot] in electron-userland/electron-builder#10163
• fix(updater): make multi-range differential downloads work on real servers (v26 backport of #10192) by @​claude[bot] in electron-userland/electron-builder#10219
• fix(flatpak): stop linux.files from corrupting flatpak files (v26 backport of #10209 + #10227) by @​claude[bot] in electron-userland/electron-builder#10229
• fix(pnpm-collector): pick in-range nested deps with pnpm 11 hoisted layout (v26) by @​claude[bot] in electron-userland/electron-builder#10230
• chore(deploy): Release (v26) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#10191

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.1...electron-builder@26.17.0

electron-builder@26.16.1

What's Changed

• fix(squirrel): backport elevate.exe appOutDir race fix to v26 (#9852) by @​claude[bot] in electron-userland/electron-builder#10157
• fix(mac): use keychain password for set-key-partition-list (v26 backport of #10101) by @​claude[bot] in electron-userland/electron-builder#10172
• fix(win): only log "signing with signtool.exe" when signing actually runs by @​claude[bot] in electron-userland/electron-builder#10171
• chore(CI): auto-label PRs targeting backports to release/v26 (#10158) by @​mmaietta in electron-userland/electron-builder#10166
• fix(mac): Retain Electron and Chromium license files on macOS (v26 backport of #10174) by @​claude[bot] in electron-userland/electron-builder#10177
• fix: prevent infinite recursion in node module collection when a package depends on itself (backport #10070 to v26) by @​claude[bot] in electron-userland/electron-builder#10180
• chore(deploy): Release (v26) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#10165

... (truncated)

Changelog

Sourced from app-builder-lib's changelog.

26.18.0

Minor Changes

• Feat(blockmap): chunk the stored resources/app.asar region with finer content-defined blocks (4/8/16 KiB) than the rest of the artifact (v26 backport of #10235). With nsis.differentialPackage: "store-asar", the asar sits uncompressed in the package and in the signed installer, so its byte range is now chunked on its own parameters instead of the 8/16/32 KiB default used everywhere else — a one-line app-code change costs 5–17% fewer bytes on the wire (measured on a ~32 MB asar). The blockmap format is unchanged and every shipped electron-updater reads it exactly as before; when the asar bytes cannot be located in the package the build logs a warning and falls back to default chunking rather than failing. [#10309](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10309) 206d35d @​imlucas

  Note for apps already shipping "store-asar" (available in v26 since #10201): the block boundaries inside the asar region change once. The first differential update from an installer built without this change to one built with it re-downloads close to the whole asar; updates between installers built with it get the smaller deltas.

Patch Changes

• Fix: bump @​electron/rebuild to 4.2.1 so cross-platform builds from one node*modules no longer reuse a native module built for another platform (#10031) *[#10315](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10315) 3dc7c90 @​claude_
• Fix(forge): make the electron-forge-maker-* packages loadable by Electron Forge 6+ (MakerBase-compatible maker class as the module export and default, also exported by name, with the maker config applied as the target's options); calling the default export as an Electron Forge 5 maker function still works [#10352](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10352) e703212 @​claude
• Fix: contain mapped app file destinations [#10330](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10330) 84f7b46 @​claude
• Fix: import blake2b from @noble/hashes/blake2.js, which both @​noble/hashes 1.x and 2.x export, so projects that override @​noble/hashes to 2.x can load electron-builder again (blockmap checksums are unchanged) [#10292](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10292) 6202a27 @​mmaietta
• Fix(nsis): warn when differentialPackage: "store-asar" finds no resources/app.asar (e.g. asar: false) instead of silently compressing the package normally [#10249](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10249) fcd6897 @​claude
• Fix(nsis): keep installer extraction in sync with the payload format when useZip is set (ignored with a warning for differential-aware builds and for nsis-web, which always use 7z), and only share an app package between targets (e.g. nsis + portable) whose packaging settings match [#10252](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10252) 160c3b4 @​claude
• Fix(pnpm): collect packages that pnpm 10.29.3+ pnpm list only prints as deduped stubs, so they and their dependencies are no longer missing from app.asar (#10253) [#10323](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10323) 1928adf @​mmaietta
• Fix(pnpm-collector): read the app's own package.json from its directory so an app named like one of its dependencies no longer loses production dependencies from the asar [#10282](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10282) c60987c @​claude
• Fix(snap): core24 no longer requests browser-support with allow-sandbox by default (the Snap Store rejects it for non-vetted publishers); default core24 snaps now launch with --no-sandbox and omit chrome-sandbox, and an explicitly configured allow-sandbox in snapcraft.core24.plugs logs a store-review warning (v26 backport of #10294) [#10331](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10331) a92517a @​claude
• Fix(snap): stop deleting chrome-sandbox from the shared linux-unpacked dir when building a core18/core20/core22 template snap. The delete raced the other Linux targets, so a deb, rpm or AppImage built in the same run could ship without chrome-sandbox (no SUID sandbox fallback), and AppImage could fail with ENOENT. The snap still omits chrome-sandbox; the mksquashfs input list already filters it out. [#10333](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10333) a1e9db8 @​yokomohoyo
• Fix: enforce workspace path boundaries for asar [#10314](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10314) 4123c27 @​claude

29d997b a10d12b

• electron-publish@26.18.0
• electron-builder-squirrel-windows@26.18.0
• dmg-builder@26.18.0

26.17.0

Minor Changes

• Feat(nsis): differentialPackage: "store-asar" — store resources/app.asar uncompressed (7-Zip Copy) in the differential-aware app package so a small app-code change costs a proportionally small differential download instead of re-downloading the entire recompressed asar (measured on a ~32 MB asar: 0.2% instead of 100% for a one-line change). nsis.differentialPackage is widened to boolean | "compressed" | "store-asar": false disables differential support as before, "store-asar" opts into the stored asar, and everything else (true, "compressed", unset) keeps today's fully compressed differential package. Backed by a generic ArchiveOptions.storedPaths in archive(). [#10201](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10201) 2a2dd22 @​claude

Patch Changes

• Fix(node-module-collector): report empty package-manager output clearly and fall back to node*modules traversal when a collector throws (#10208) *[#10213](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10213) bae1c8b @​claude_
• Fix(flatpak): stop linux.files globs from leaking into the flatpak files list. getOptionsForTarget's deepAssign concatenated linux.files onto flatpak.files, and @malept/flatpak-bundler then crashed destructuring each glob string as a [src, dest] tuple (ENOENT: no such file or directory, stat '<project-root>/*'); FlatpakTarget now takes files from the flatpak config only. [#10229](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10229) 07c8344 @​claude
• Fix(flatpak): read flatpak.files from the flatpak config directly so that a single-string or FileSet linux.files no longer throws in FlatpakTarget [#10229](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10229) 07c8344 @​claude
• Fix: suppress the macOS 26 "Installer would like to access data from other apps" prompt when building pkg installers. macOS 26's Installer probes the current-user-home install domain while parsing the deprecated <domains> element — even when that domain is disabled — which makes Installer.app request kTCCServiceSystemPolicyAppData as soon as the user leaves the Introduction pane. rootVolumeOnly="true" is now added to <options> when both allowAnywhere and allowCurrentUserHome are false; the install domains reported by installer -volinfo / -dominfo are unchanged, and <domains> is still emitted verbatim. [#10211](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10211) 613cd58 @​claude
• Fix: resolve pnpm dependencies omitted from the pnpm list --json output by their declared range. Since pnpm 10.29.3 a repeated subtree is printed once and every later occurrence is a childless entry flagged deduped: true; the node-module collector recovered such an entry's dependencies by package name only, so when two versions of one package were installed the nested, version-conflicted copy was wired to the wrong version and its whole closure vanished from the packaged node_modules (the #8493 regression, e.g. es5-ext@0.10.64 with esniff, event-emitter and next-tick@1.1.0 dropped while the app pins es5-ext@0.10.53). The collector now resolves an omitted dependency against the dependent's declared range from its real store directory and takes the exact name@version entry, keeping the name-only match only as a fallback for link: dependencies, so version-conflicted transitive dependencies are no longer dropped with pnpm >= 10.29.3, 11 and 12. [#10207](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10207) d4a4f50 @​claude
• Fix(pnpm-collector): package the declared versions of nested dependencies with pnpm 11 and node-linker=hoisted by detecting the hoisted layout from disk and preferring an in-range copy over an out-of-range override, including when the app is a package in a hoisted pnpm workspace with no node_modules of its own (#10228) [#10230](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/10230) 41a027c @​claude

... (truncated)

Commits

• e2a8604 chore(deploy): Release v26.18.0 (electron-updater@6.8.11) (v26) (#10250)
• e703212 fix(forge): make electron-builder makers loadable by current Electron Forge (...
• a1e9db8 fix(snap): don't delete chrome-sandbox from the shared linux-unpacked dir in ...
• a92517a fix(snap): don't request allow-sandbox by default for core24 (v26 backport of...
• 84f7b46 fix: contain mapped app file destinations (v26 backport of #10137) (#10330)
• 1928adf fix(pnpm): collect packages that pnpm list only prints as deduped stubs (#1...
• 206d35d feat(blockmap): finer content-defined blocks for the stored app.asar region (...
• 3dc7c90 fix(app-builder-lib): bump @​electron/rebuild to 4.2.1 (v26 backport of #10308...
• 4123c27 fix: enforce workspace path boundaries for asar (v26 backport of #10135) (#10...
• 6202a27 fix: import blake2b from @noble/hashes/blake2.js (#10292)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for app-builder-lib since your current version.

Updates electron-builder from 25.1.8 to 26.18.0

Release notes

Sourced from electron-builder's releases.

electron-builder@26.18.0

What's Changed

• fix(nsis): warn when differentialPackage "store-asar" finds no app.asar (v26 backport of #10246) by @​claude[bot] in electron-userland/electron-builder#10249
• test(archive): make stored-member assertions independent of 7-Zip folder order (v26 backport of #10247) by @​claude[bot] in electron-userland/electron-builder#10251
• fix(nsis): keep installer extraction in sync with the payload format when useZip is set (v26 backport of #10248) by @​claude[bot] in electron-userland/electron-builder#10252
• fix(pnpm): read the app's own package.json when its name matches a dependency (v26 backport of #10278) by @​claude[bot] in electron-userland/electron-builder#10282
• fix: import blake2b from @noble/hashes/blake2.js by @​mmaietta in electron-userland/electron-builder#10292
• fix: encode GitLab package path segments (v26 backport of #10140) by @​claude[bot] in electron-userland/electron-builder#10299
• fix(updater): validate cached update filenames (v26 backport of #10115) by @​claude[bot] in electron-userland/electron-builder#10300
• fix: escape Squirrel project URLs in nuspec XML (v26 backport of #10141) by @​claude[bot] in electron-userland/electron-builder#10301
• fix: enforce workspace path boundaries for asar (v26 backport of #10135) by @​claude[bot] in electron-userland/electron-builder#10314
• fix(app-builder-lib): bump @​electron/rebuild to 4.2.1 (v26 backport of #10308) by @​claude[bot] in electron-userland/electron-builder#10315
• feat(blockmap): finer content-defined blocks for the stored app.asar region (v26 backport of #10235) by @​imlucas in electron-userland/electron-builder#10309
• fix(pnpm): collect packages that pnpm list only prints as deduped stubs by @​mmaietta in electron-userland/electron-builder#10323
• fix: contain mapped app file destinations (v26 backport of #10137) by @​claude[bot] in electron-userland/electron-builder#10330
• fix(snap): don't request allow-sandbox by default for core24 (v26 backport of #10294) by @​claude[bot] in electron-userland/electron-builder#10331
• fix(snap): don't delete chrome-sandbox from the shared linux-unpacked dir in template builds (v26 backport of #10327) by @​yokomohoyo in electron-userland/electron-builder#10333
• fix(forge): make electron-builder makers loadable by current Electron Forge (v26 backport) by @​claude[bot] in electron-userland/electron-builder#10352
• chore(deploy): Release (v26) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#10250

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.17.0...electron-builder@26.18.0

electron-builder@26.17.0

What's Changed

• fix: detect pnpm workspace root on Windows without shelling out to pwd (v26 backport) by @​claude[bot] in electron-userland/electron-builder#10189
• test: pin globTest "failed peer dep" deps via lockfile fixture and update snapshot for moment 2.31.0 (v26 backport of #10197) by @​claude[bot] in electron-userland/electron-builder#10198
• feat(nsis): "store-asar" mode for proportional differential updates (v26 backport) by @​claude[bot] in electron-userland/electron-builder#10201
• test(v26): bump package manager pins and disable dependency lifecycle scripts in fixture installs (backport #10199) by @​claude[bot] in electron-userland/electron-builder#10203
• fix(app-builder-lib): resolve pnpm deps omitted from deduped list output by declared range (backport #10200) by @​claude[bot] in electron-userland/electron-builder#10207
• fix(pkg): add rootVolumeOnly to for macOS 26 Installer prompt (v26 backport of #10193) by @​claude[bot] in electron-userland/electron-builder#10211
• fix(node-module-collector): clear error on empty output and fall back to traversal when a collector throws (v26 backport of #10210) by @​claude[bot] in electron-userland/electron-builder#10213
• fix(electron-updater): keep cached blockmap consistent with cached installer (v26 backport of #10098) by @​claude[bot] in electron-userland/electron-builder#10163
• fix(updater): make multi-range differential downloads work on real servers (v26 backport of #10192) by @​claude[bot] in electron-userland/electron-builder#10219
• fix(flatpak): stop linux.files from corrupting flatpak files (v26 backport of #10209 + #10227) by @​claude[bot] in electron-userland/electron-builder#10229
• fix(pnpm-collector): pick in-range nested deps with pnpm 11 hoisted layout (v26) by @​claude[bot] in electron-userland/electron-builder#10230
• chore(deploy): Release (v26) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#10191

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.1...electron-builder@26.17.0

electron-builder@26.16.1

What's Changed

• fix(squirrel): backport elevate.exe appOutDir race fix to v26 (#9852) by @​claude[bot] in electron-userland/electron-builder#10157
• fix(mac): use keychain password for set-key-partition-list (v26 backport of #10101) by @​claude[bot] in electron-userland/electron-builder#10172
• fix(win): only log "signing with signtool.exe" when signing actually runs by @​claude[bot] in electron-userland/electron-builder#10171
• chore(CI): auto-label PRs targeting backports to release/v26 (#10158) by @​mmaietta in electron-userland/electron-builder#10166
• fix(mac): Retain Electron and Chromium license files on macOS (v26 backport of #10174) by @​claude[bot] in electron-userland/electron-builder#10177
• fix: prevent infinite recursion in node module collection when a package depends on itself (backport #10070 to v26) by @​claude[bot] in electron-userland/electron-builder#10180
• chore(deploy): Release (v26) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#10165

... (truncated)

Changelog

Sourced from electron-builder's changelog.

26.18.0

Patch Changes

206d35d 3dc7c90 e703212 84f7b46 6202a27 fcd6897 160c3b4 1928adf c60987c a92517a a1e9db8 4123c27

• app-builder-lib@26.18.0
• dmg-builder@26.18.0

26.17.0

Patch Changes

bae1c8b 2a2dd22 07c8344 07c8344 613cd58 d4a4f50 41a027c 59f6364

• app-builder-lib@26.17.0
• dmg-builder@26.17.0

26.16.1

Patch Changes

b9b2e8a d6d4125 a4ec75f 5ae5a02 7c04b35

• app-builder-lib@26.16.1
• dmg-builder@26.16.1

... (truncated)

Commits

• e2a8604 chore(deploy): Release v26.18.0 (electron-updater@6.8.11) (v26) (#10250)
• 5cdf017 chore(deploy): Release v26.17.0 (electron-updater@6.8.10) (v26) (#10191)
• 7d3b30f chore(deploy): Release v26.16.1 (#10165)
• f461097 chore(deploy): Release v26.16.0 (#10059)
• ce825f1 chore(deploy): Release v26.15.7 (#10005)
• 026bbda chore(deploy): Release v26.15.6 (#9952)
• 8d4a578 chore(deploy): Release v26.15.5 (#9938)
• 3332d51 chore(deploy): Release v26.15.4 (#9919)
• 512a57e chore(deploy): Release v26.15.3 (#9858)
• a6117b3 chore(deploy): Release v26.15.2 (#9848)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for electron-builder since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.