# What changed in electron-builder

> 131 changes in electron-builder 26 from its official release notes, upgrade guides and advisories: 1 breaking, 5 security, 18 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/electron-builder/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## electron-builder 26

### Breaking changes

- Windows Azure trusted signing no longer runs preflight checks. (26.9.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.1)

### Security

- Hardens the auto-update flow against relative paths and environment-variable intercepts. (26.13.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.13.0)
- Argument construction is hardened. (26.12.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.1)
- Download validation is hardened. (26.12.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.1)
- Generated-file output is hardened. (26.12.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.1)
- The resolved artifact URL is always passed through, preventing environment variable overrides. (26.11.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.1)

### New APIs and options

- Adds rootVolumeOnly to installer options for the macOS 26 Installer prompt. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Adds a store-asar mode for proportional differential updates. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Controls handling of missing production dependencies; builds warn by default and can be made to fail. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- Adds an opt-in for parsing environment variables that target non-localhost HTTP. (26.15.3) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.3)
- Adds a Linux option to align the installed .desktop filename with StartupWMClass. (26.15.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.0)
- Adds a config option to skip ASAR integrity computation. (26.13.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.13.0)
- Adds a DMG filesystem option to support the APFS format. (26.13.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.13.0)
- Adds beta support for snap core24. (26.12.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.0)
- Adds toolset configuration for makensis. (26.12.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.0)
- Adds a CLI command to clear electron-builder's default cache directory. (26.11.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.0)
- Adds a config property to disable signing without disabling executable editing. (26.11.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.0)
- Adds a per-target override for the squashfs algorithm. (26.11.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.0)
- Adds support for the link: protocol. (26.8.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.0)
- Adds support for using a static AppImage runtime. (26.8.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.0)
- Adds a size option to set the DMG filesystem size explicitly. (26.7.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.7.0)
- Adds Windows capabilities. (26.7.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.7.0)
- Flatpak builds can use configuration for executableArgs. (26.6.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.6.0)
- Adds support for dmgbuild's badge-icon configuration. (26.5.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.5.0)

### Performance

- Duplicate checking in the asar packager is optimized using Set. (26.3.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.2)

### Behavior and default changes

- The afterSign hook is now emitted for mas and mas-dev builds. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- Its checks now run PowerShell with -NoProfile and -NonInteractive. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- Base64 SHA-512 checksums are now accepted when downloading a custom NSIS toolset. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- Workspace sub-package production dependencies are now bundled into app.asar when the package manager resolves to the workspace root. (26.15.6) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.6)
- For snap core24, the app now runs through a generated launcher script. (26.15.5) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.5)
- Toolset archives are persisted in a predictable cache path. (26.15.3) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.3)
- Replaces png2icons with wasm-vips Lanczos3 resampling for higher-quality icon conversion. (26.15.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.2)
- Signing is skipped when no certificate is found; a warning is issued for ad-hoc signing with hardenedRuntime. (26.15.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.0)
- On Windows, package managers are invoked via PowerShell -EncodedCommand. (26.15.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.0)
- Entitlement files can now be linked from outside the workspace. (26.11.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.1)
- AppImages start with --no-sandbox when necessary. (26.9.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.0)
- Release notes are now passed to GitHub and GitLab release bodies. (26.9.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.0)
- NSIS detects the Windows version and excludes Windows 7 compatibility logic when it is not needed. (26.9.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.0)
- Progress updates are provided for multiple range differential downloads. (26.4.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.1)
- Target-specific build options can now override top-level publish configuration. (26.4.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.0)
- Yarn Berry _dependencies support was added to dependency graph extraction. (26.3.6) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.6)

### Tooling

- Builds can validate checksums offline using a locally seeded SHASUMS256.txt, supporting air-gapped builds. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- The icons toolset update broadens ICNS asset generation. (26.15.5) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.5)
- Logging is improved when electron is in devDependencies. (26.12.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.1)
- Logging is improved when electronVersion is not pinned. (26.12.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.1)
- Updates dmgbuild and migrates to a portable dmgbuild Python bundle. (26.6.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.6.0)

### Fixes and other changes

- Keeps the cached blockmap consistent with the cached installer. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Prevents linux.files from corrupting Flatpak files. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Makes multi-range differential downloads work on real servers. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Clears errors on empty collector output and falls back to traversal when a collector throws. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Resolves pnpm dependencies omitted from deduped list output by their declared range. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Selects in-range nested dependencies with the pnpm 11 hoisted layout. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Detects the pnpm workspace root on Windows without shelling out to pwd. (26.17.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.17.0)
- Retains Electron and Chromium license files in macOS builds. (26.16.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.1)
- Fixes an appOutDir race involving elevate.exe during Squirrel packaging. (26.16.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.1)
- Prevents infinite recursion when a package depends on itself during node module collection. (26.16.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.1)
- Uses the keychain password when running set-key-partition-list on macOS. (26.16.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.1)
- The signing log is emitted only when signing actually runs. (26.16.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.1)
- XML is escaped for appxmanifest. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- Blockmap generation works on Node versions below 20.19. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- The binaries now run on macOS 15 and later. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- Small ICNS sizes are written as ic04/ic05 ARGB. (26.16.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.16.0)
- The locales directory is no longer emptied when electronLanguages uses bare language codes. (26.15.7) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.7)
- Snap template archives with the .tar.7z format are now extracted correctly. (26.15.7) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.7)
- Installation of the main executable and native binaries is now reliable on x64 and arm64. (26.15.6) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.6)
- Writes executableArgs verbatim into the Linux .desktop Exec entry. (26.15.4) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.4)
- Preserves $(...) LangString references in escaped NSIS define values. (26.15.4) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.4)
- Sets the S3 payload header to UNSIGNED-PAYLOAD before SigV4 signing. (26.15.3) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.3)
- Uses native zip to preserve .framework symlinks when creating macOS zip artifacts. (26.15.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.2)
- Retries package installation when transient network errors occur. (26.15.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.2)
- Fixes package validation. (26.15.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.1)
- Redaction detection for <text> (sha256 hash) now checks the whole field. (26.15.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.15.0)
- Nested dependencies are now properly resolved when pnpm uses the hoisted node linker. (26.14.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.14.0)
- Stops appending architecture paths to explicit appPackageUrl values. (26.13.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.13.0)
- Uses package.json desktopName for StartupWMClass in Linux desktop entries. (26.13.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.13.0)
- Limits the full updater changelog to release notes up to the latest release. (26.13.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.13.0)
- Bundles FUSE2 runtime libraries for x64 and ia32, matching the Go implementation. (26.13.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.13.0)
- Uses exact process-name matching to avoid false-positive “cannot be closed” dialogs. (26.13.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.13.0)
- Fixes nsisEscapeString incorrectly converting the INSTDIR runtime variable to double-$$. (26.12.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.1)
- Fixes application of electronLanguages configuration filtering for macOS apps. (26.12.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.0)
- Makes the ordering of files in update info deterministic. (26.12.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.12.0)
- On Windows, any collector path containing a space is now wrapped in a .bat file. (26.11.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.1)
- The internal downloader now respects HTTP and HTTPS proxies. (26.11.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.1)
- Fixes the compression mapping for AppImage targets. (26.11.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.0)
- Fixes extraFiles output so it uses the branded Electron app name. (26.11.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.11.0)
- AppImage environment variables are validated. (26.10.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.10.0)
- Adds support for pnpm 11. (26.10.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.10.0)
- Unexpected MIME types are skipped. (26.10.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.10.0)
- Source files are now bundled when using extraMetadata.name with Yarn Berry. (26.9.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.1)
- Fixes the mismatch between the GitLab auth token used to fetch channel YAML and the token used for API requests. (26.9.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.1)
- Prevents infinite recursion when running install-app-deps in npm workspaces. (26.9.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.1)
- Package version-to-path resolution now works properly within the pnpm virtual store. (26.9.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.1)
- Draft releases are filtered when retrieving the latest version information from a private GitHub provider. (26.9.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.1)
- Fixes Windows builds with spaces in the path when resolveCommand returns an extensionless full path, as with Volta or similar tools. (26.9.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.1)
- The hashbang now uses /usr/bin/env so AppImages work on non-FHS distributions. (26.9.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.0)
- An entry was added for the patched AppImage toolset bundle to resolve issues on Ubuntu 25.1.0. (26.9.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.0)
- downloadArtifact now respects electron_builder_binaries_mirror when downloading artifacts. (26.9.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.9.0)
- AppImage toolset binaries are resolved from the linux/<arch> directory. (26.8.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.2)
- The app executable is rebuilt when the ASAR header has changed. (26.8.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.2)
- Removes the spurious default vendor warning for Squirrel.Windows. (26.8.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.2)
- electronLanguages filtering now uses startsWith matching for more generous language matching. (26.8.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.2)
- The node module collector now handles pnpm deduped dependencies correctly. (26.8.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.2)
- Fixes the MIME type directory in AppDir. (26.8.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.1)
- Dependency list entries are now read using the package key instead of the package name. (26.8.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.1)
- Quotes the temporary batch file path in cmd.exe arguments, supporting paths with spaces. (26.8.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.8.0)
- Fixes stdio redirects in the update-alternative invocation. (26.7.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.7.0)
- Restores duplicate dependency and workspace tree resolution. (26.7.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.7.0)
- Ignores releases with non-semver tags when collecting the full changelog. (26.7.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.7.0)
- NSIS now allows $INSTDIR to be removed. (26.6.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.6.0)
- Fixes the pnpm collector returning zero modules. (26.6.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.6.0)
- Fixes the DMG background by updating the vendored dmgbuild. (26.5.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.5.0)
- Fixes Windows builds failing with spawn EINVAL after a Node.js security fix. (26.5.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.5.0)
- Aliased packages are now packaged with the correct name. (26.4.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.1)
- The hex regex is now case insensitive. (26.4.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.1)
- Deleting default macOS appPlist keys using extendInfo now works. (26.4.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.1)
- Fixes "Invalid string length" errors during node module collection with pnpm. (26.4.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.1)
- Parent directories of unpacked files are now post-processed. (26.4.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.1)
- Windows signing is queued to avoid concurrent signing issues with AzureTrustedSigning. (26.4.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.0)
- npm list now works with yarn berry and bun project setups. (26.4.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.0)
- In two-package.json project setups, the app directory is searched before the package directory. (26.4.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.4.0)
- Dependency graph extraction now uses the correct order. (26.3.6) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.6)
- Whitespace-only custom NSIS and NSIS resource paths are checked, preventing them from being treated as valid paths. (26.3.5) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.5)
- Package versions are validated while traversing directories to find a matching node module. (26.3.5) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.5)
- Sets the correct hostArchitectures to support arm64-only MAS submissions. (26.3.4) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.4)
- Corrects the types for makeUniversalApp, using undefined instead of a potentially null value. (26.3.4) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.4)
- Uses the workspaces list command instead of workspaceRoot for Yarn v2+ package manager support. (26.3.4) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.4)
- Checks hoisted mode for each node module using the filesystem instead of require or import-meta-resolve methods. (26.3.3) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.3)
- Returns the actual path in hoisted mode for pnpm, which can still return virtual paths. (26.3.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.2)
- Allows the home directory when it is symlinked from /var/home. (26.3.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.2)
- Properly collects node_modules when they are ESM and Node.js is version 16 or later. (26.3.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.1)
- Uses yarn config --json to parse Yarn Berry output, which varies across versions 2–4. (26.3.1) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-builder%4026.3.1)