npm / electron-builder
electron-builder
What changed in electron-builder 26, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
1 breaking5 security18 new APIs and options1 performance16 behavior and defaults5 tooling85 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initelectron-builder 26131 changes
Breaking changes 1
Windows Azure trusted signing no longer runs preflight checks.
Security 5
Hardens the auto-update flow against relative paths and environment-variable intercepts.
Argument construction is hardened.
Download validation is hardened.
Generated-file output is hardened.
The resolved artifact URL is always passed through, preventing environment variable overrides.
New APIs and options 18
Adds rootVolumeOnly to installer options for the macOS 26 Installer prompt.
Adds a store-asar mode for proportional differential updates.
Controls handling of missing production dependencies; builds warn by default and can be made to fail.
Adds an opt-in for parsing environment variables that target non-localhost HTTP.
Adds a Linux option to align the installed .desktop filename with StartupWMClass.
Adds a config option to skip ASAR integrity computation.
Adds a DMG filesystem option to support the APFS format.
Adds beta support for snap core24.
Adds toolset configuration for makensis.
Adds a CLI command to clear electron-builder's default cache directory.
Adds a config property to disable signing without disabling executable editing.
Adds a per-target override for the squashfs algorithm.
Adds support for the link: protocol.
Adds support for using a static AppImage runtime.
Adds a size option to set the DMG filesystem size explicitly.
Adds Windows capabilities.
Flatpak builds can use configuration for executableArgs.
Adds support for dmgbuild's badge-icon configuration.
Performance 1
Duplicate checking in the asar packager is optimized using Set.
Behavior and default changes 16
The afterSign hook is now emitted for mas and mas-dev builds.
Its checks now run PowerShell with -NoProfile and -NonInteractive.
Base64 SHA-512 checksums are now accepted when downloading a custom NSIS toolset.
Workspace sub-package production dependencies are now bundled into app.asar when the package manager resolves to the workspace root.
For snap core24, the app now runs through a generated launcher script.
Toolset archives are persisted in a predictable cache path.
Replaces png2icons with wasm-vips Lanczos3 resampling for higher-quality icon conversion.
Signing is skipped when no certificate is found; a warning is issued for ad-hoc signing with hardenedRuntime.
On Windows, package managers are invoked via PowerShell -EncodedCommand.
Entitlement files can now be linked from outside the workspace.
AppImages start with --no-sandbox when necessary.
Release notes are now passed to GitHub and GitLab release bodies.
NSIS detects the Windows version and excludes Windows 7 compatibility logic when it is not needed.
Progress updates are provided for multiple range differential downloads.
Target-specific build options can now override top-level publish configuration.
Yarn Berry _dependencies support was added to dependency graph extraction.
Tooling 5
Builds can validate checksums offline using a locally seeded SHASUMS256.txt, supporting air-gapped builds.
The icons toolset update broadens ICNS asset generation.
Logging is improved when electron is in devDependencies.
Logging is improved when electronVersion is not pinned.
Updates dmgbuild and migrates to a portable dmgbuild Python bundle.
Fixes and other changes 85
Keeps the cached blockmap consistent with the cached installer.
Prevents linux.files from corrupting Flatpak files.
Makes multi-range differential downloads work on real servers.
Clears errors on empty collector output and falls back to traversal when a collector throws.
Resolves pnpm dependencies omitted from deduped list output by their declared range.
Selects in-range nested dependencies with the pnpm 11 hoisted layout.
Detects the pnpm workspace root on Windows without shelling out to pwd.
Retains Electron and Chromium license files in macOS builds.
Fixes an appOutDir race involving elevate.exe during Squirrel packaging.
Prevents infinite recursion when a package depends on itself during node module collection.
Uses the keychain password when running set-key-partition-list on macOS.
The signing log is emitted only when signing actually runs.
XML is escaped for appxmanifest.
Blockmap generation works on Node versions below 20.19.
The binaries now run on macOS 15 and later.
Small ICNS sizes are written as ic04/ic05 ARGB.
The locales directory is no longer emptied when electronLanguages uses bare language codes.
Snap template archives with the .tar.7z format are now extracted correctly.
Installation of the main executable and native binaries is now reliable on x64 and arm64.
Writes executableArgs verbatim into the Linux .desktop Exec entry.
Preserves $(...) LangString references in escaped NSIS define values.
Sets the S3 payload header to UNSIGNED-PAYLOAD before SigV4 signing.
Uses native zip to preserve .framework symlinks when creating macOS zip artifacts.
Retries package installation when transient network errors occur.
Fixes package validation.
Redaction detection for <text> (sha256 hash) now checks the whole field.
Nested dependencies are now properly resolved when pnpm uses the hoisted node linker.
Stops appending architecture paths to explicit appPackageUrl values.
Uses package.json desktopName for StartupWMClass in Linux desktop entries.
Limits the full updater changelog to release notes up to the latest release.
Bundles FUSE2 runtime libraries for x64 and ia32, matching the Go implementation.
Uses exact process-name matching to avoid false-positive “cannot be closed” dialogs.
Fixes nsisEscapeString incorrectly converting the INSTDIR runtime variable to double-$$.
Fixes application of electronLanguages configuration filtering for macOS apps.
Makes the ordering of files in update info deterministic.
On Windows, any collector path containing a space is now wrapped in a .bat file.
The internal downloader now respects HTTP and HTTPS proxies.
Fixes the compression mapping for AppImage targets.
Fixes extraFiles output so it uses the branded Electron app name.
AppImage environment variables are validated.
Adds support for pnpm 11.
Unexpected MIME types are skipped.
Source files are now bundled when using extraMetadata.name with Yarn Berry.
Fixes the mismatch between the GitLab auth token used to fetch channel YAML and the token used for API requests.
Prevents infinite recursion when running install-app-deps in npm workspaces.
Package version-to-path resolution now works properly within the pnpm virtual store.
Draft releases are filtered when retrieving the latest version information from a private GitHub provider.
Fixes Windows builds with spaces in the path when resolveCommand returns an extensionless full path, as with Volta or similar tools.
The hashbang now uses /usr/bin/env so AppImages work on non-FHS distributions.
An entry was added for the patched AppImage toolset bundle to resolve issues on Ubuntu 25.1.0.
downloadArtifact now respects electron_builder_binaries_mirror when downloading artifacts.
AppImage toolset binaries are resolved from the linux/<arch> directory.
The app executable is rebuilt when the ASAR header has changed.
Removes the spurious default vendor warning for Squirrel.Windows.
electronLanguages filtering now uses startsWith matching for more generous language matching.
The node module collector now handles pnpm deduped dependencies correctly.
Fixes the MIME type directory in AppDir.
Dependency list entries are now read using the package key instead of the package name.
Quotes the temporary batch file path in cmd.exe arguments, supporting paths with spaces.
Fixes stdio redirects in the update-alternative invocation.
Restores duplicate dependency and workspace tree resolution.
Ignores releases with non-semver tags when collecting the full changelog.
NSIS now allows $INSTDIR to be removed.
Fixes the pnpm collector returning zero modules.
Fixes the DMG background by updating the vendored dmgbuild.
Fixes Windows builds failing with spawn EINVAL after a Node.js security fix.
Aliased packages are now packaged with the correct name.
The hex regex is now case insensitive.
Deleting default macOS appPlist keys using extendInfo now works.
Fixes "Invalid string length" errors during node module collection with pnpm.
Parent directories of unpacked files are now post-processed.
Windows signing is queued to avoid concurrent signing issues with AzureTrustedSigning.
npm list now works with yarn berry and bun project setups.
In two-package.json project setups, the app directory is searched before the package directory.
Dependency graph extraction now uses the correct order.
Whitespace-only custom NSIS and NSIS resource paths are checked, preventing them from being treated as valid paths.
Package versions are validated while traversing directories to find a matching node module.
Sets the correct hostArchitectures to support arm64-only MAS submissions.
Corrects the types for makeUniversalApp, using undefined instead of a potentially null value.
Uses the workspaces list command instead of workspaceRoot for Yarn v2+ package manager support.
Checks hoisted mode for each node module using the filesystem instead of require or import-meta-resolve methods.
Returns the actual path in hoisted mode for pnpm, which can still return virtual paths.
Allows the home directory when it is symlinked from /var/home.
Properly collects node_modules when they are ESM and Node.js is version 16 or later.
Uses yarn config --json to parse Yarn Berry output, which varies across versions 2–4.