# What changed in electron-updater

> 11 changes in electron-updater 6 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/electron-updater/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## electron-updater 6

### Security

- Stale cached blockmaps are removed when a download produces no new blockmap, keeping the cached blockmap consistent with the cached installer and preventing poisoned differential downloads. (6.8.10) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.10)
- The auto-update flow is hardened against relative paths in PATH, path traversals, and environment variable intercepts. (6.8.8) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.8)

### Behavior and default changes

- Console logs for autoupdate checks were removed, changing the output produced during those checks. (6.8.3) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.3)
- Download-progress events are now emitted when downloading with the multiple range differential downloader. (6.8.0) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.0)

### Fixes and other changes

- Missing and path-valued cached update file names are now rejected. (6.8.11) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.11)
- Multi-range differential downloads now handle bare LF line endings, header terminators split across chunks, and later batches that exceed the watchdog grace period. (6.8.10) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.10)
- Fixes holistic field detection for SHA-256 hash redaction. (6.8.9) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.9)
- The full changelog now includes only release notes up to the latest release. (6.8.8) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.8)
- Fixes the GitLab auth token mismatch between fetching channel YAML and making API requests. (6.8.5) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.5)
- Filters draft releases when determining the latest version for private GitHub releases. (6.8.5) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.5)
- Releases with non-semver tags are ignored when collecting the full changelog. (6.8.2) — [release notes](https://github.com/electron-userland/electron-builder/releases/tag/electron-updater%406.8.2)