npm / electron-updater
electron-updater
What changed in electron-updater 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
2 security2 behavior and defaults7 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initelectron-updater 611 changes
Security 2
Stale cached blockmaps are removed when a download produces no new blockmap, keeping the cached blockmap consistent with the cached installer and preventing poisoned differential downloads.
The auto-update flow is hardened against relative paths in PATH, path traversals, and environment variable intercepts.
Behavior and default changes 2
Console logs for autoupdate checks were removed, changing the output produced during those checks.
Download-progress events are now emitted when downloading with the multiple range differential downloader.
Fixes and other changes 7
Missing and path-valued cached update file names are now rejected.
Multi-range differential downloads now handle bare LF line endings, header terminators split across chunks, and later batches that exceed the watchdog grace period.
Fixes holistic field detection for SHA-256 hash redaction.
The full changelog now includes only release notes up to the latest release.
Fixes the GitLab auth token mismatch between fetching channel YAML and making API requests.
Filters draft releases when determining the latest version for private GitHub releases.
Releases with non-semver tags are ignored when collecting the full changelog.