electron-builder@27.0.0-alpha.12

Major Changes

• Feat!: add fileOptions.excludedExts (root and per platform, a list or a single string such as -c.fileOptions.excludedExts=default) to configure the file extensions excluded from the app files and the copied node_modules — "default" is the built-in list, which now includes pdb, any other entry adds an extension, and "!ext" removes one (a list of removals only, such as ["!pdb"], is rejected: write ["default", "!pdb"]; an invalid list fails the build when the configuration is validated, at the root and in every platform section); a later layer's list replaces an earlier one instead of being merged with it (extends child, programmatic or -c configuration, platform section, mas / masDev); a files pattern that names an excluded extension (e.g. native/addon.pdb) re-includes only the files it matches. BREAKING: removed the includePdb option — electron-builder migrate-schema rewrites includePdb: true to "fileOptions": { "excludedExts": ["default", "!pdb"] } and includePdb: false to "fileOptions": { "excludedExts": ["default"] }. #10339 0b508ab — electron-builder, app-builder-lib, builder-util

• Feat(s3)!: explicit AWS credential sources for S3 publishing via the new awsCredentials option (restores shared config / IAM Identity Center profiles, #10054) #10257 46be1f4 — app-builder-lib, builder-util-runtime, electron-publish

  • awsCredentials.source is required to publish (no default, no implicit credentials).
  • awsCredentials.source: "env" reads only AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, or the variable names given in awsCredentials.env.
  • awsCredentials.source: "profile" with profile (plus optional credentialsFile / configFile) reads a named profile from the shared config and credentials files: static keys, IAM Identity Center (SSO), credential_process and assume-role. The AWS SDK providers are loaded lazily, only for non-static profiles, and are given explicit paths. Assume-role hops use an explicitly configured STS client (named profile's region, no configured endpoint URLs). credential_source and web identity (web_identity_token_file) are rejected anywhere in the chain, before the SDK is loaded.
  • awsCredentials.source: "sso-role-chain" with profile resolves an assume-role profile whose source_profile chain (up to 5 hops, no cycles) starts at an IAM Identity Center (SSO) profile: the SSO profile is resolved from the configured files, then STS AssumeRole is called per hop with explicit region, endpoint and credentials (never AWS_REGION, AWS_PROFILE or AWS_ENDPOINT_URL*). credential_source, mfa_serial, web identity and credential_process are rejected in the chain. source: "profile" keeps rejecting SSO-sourced role chains and points to this source.
  • Resolved credentials are reused for every file of a publish instead of being resolved again per upload.

  BREAKING CHANGE: S3 publishing fails with an InvalidConfigurationError unless awsCredentials.source is set (add { "source": "env" } to keep using AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY). AWS_PROFILE, AWS_SDK_LOAD_CONFIG, AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE and an implicit ~/.aws/credentials are no longer read. Missing credentials now fail with a clear error instead of an unsigned or env-fallback signature. For dotted bucket names without region, the region is looked up only when publishing. awsCredentials is never written to app-update.yml.

• Feat(signing)!: fail the build when the signing key isn't in updateManifest.publicKey #10350 6e3153b — electron-builder, app-builder-lib

  BREAKING CHANGE: when updateManifest.publicKey is set explicitly and none of the keys the build signs update
  manifests with is in it, a publishing build now fails at build start, before anything is packed or uploaded, with an
  InvalidConfigurationError naming the key ids of the signing keys and of the listed keys (never key material). Such
  a release embeds no key it is signed with, so its installs would reject manifests signed with the current key(s).
  This was a warning before; a build without a publish policy still only warns. For a deliberate cutover release that
  is signed with the old key but embeds only the new one, set the new updateManifest.allowSigningKeyOutsideTrustList: true (explicit config only) to keep the warning. Nothing changes when publicKey is not set, since the trust list is
  then derived from the signing keys. See the v27 breaking changes guide.

• Feat(signing)!: ELECTRON_BUILDER_UPDATE_SIGN_KEY takes the PEM file base64-encoded on one line, so CI systems such as GitLab can mask it (#10344) — encode it with base64 < update-private-key.pem | tr -d '\n', and for key rotation concatenate the PEM files and encode them once (cat old.pem new.pem | base64 | tr -d '\n'). BREAKING for the 27.0.0 alphas: a raw PEM, or any value that is not the standard base64 of complete PEM private keys (quoted, URL-safe, truncated, separately encoded keys joined together), now fails with an InvalidConfigurationError that never prints the value, and invalid or duplicate signing keys from any source are reported as an InvalidConfigurationError too; ELECTRON_BUILDER_UPDATE_SIGN_KEY_FILE and updateManifest.signingKey / signingKeyFile still take PEM, and electron-builder create-update-key prints the encode command for the key file it writes. #10347 f8a6719 — electron-builder, app-builder-lib, builder-util

Minor Changes

• Fix(forge): make the electron-forge-maker-* packages loadable by Electron Forge 6+ (MakerBase-compatible default export class, also exported by name, with the maker config applied as the target's options); calling the default export as an Electron Forge 5 maker function still works #10351 1e32919 — app-builder-lib, electron-forge-maker-appimage, electron-forge-maker-nsis, electron-forge-maker-nsis-web, electron-forge-maker-snap
• Feat(mac): APPLE_API_KEY also accepts the App Store Connect API key's .p8 contents base64-encoded on one line, so masked CI variables can hold it (#10344) — electron-builder writes it to a new 0600 temporary file for each notarization and deletes it once notarytool is done; a path keeps working unchanged, and key text (PEM) or a damaged base64 value now fails before notarization with an InvalidConfigurationError that does not print the key. The notarization guide documented base64 content before it was supported. #10347 f8a6719 — app-builder-lib
• Feat(mac): embed the Electron 41+ ASAR integrity digest into the Electron Framework (signed again ad hoc afterwards), so with the enableEmbeddedAsarIntegrityValidation fuse the ElectronAsarIntegrity hashes in Info.plist can't be changed to match a modified app.asar; on by default, mac.asarIntegrityDigest: false opts out (#9648) #10346 4cd8a92 — app-builder-lib
• Feat(mac): add a pkgDistributionCreated hook (#10355), mirroring appxManifestCreated and msiProjectCreated. It is called with the path to the PKG target's distribution.xml after electron-builder has written it and before productbuild builds the installer from it, so the distribution (for example, its <title>) can be edited in place or replaced. #10402 09dae73 — app-builder-lib

Patch Changes

• Fix: deduplicate publish tasks by value #10134 48c0645
• Fix: enforce the configured API redirect limit without an extra hop #10121 8b71ed8 — builder-util-runtime
• Fix(publish): detect aborted S3 responses via close instead of the deprecated aborted event, and report non-http(s) or unparseable S3 endpoints as configuration errors #10349 9e0137e — electron-publish
• Fix(signing): a base64 CSC_LINK / WIN_CSC_LINK / CSC_INSTALLER_LINK / SNAP_CSC_LINK / cscLink value must be valid standard base64 (line breaks are ignored; encode it with base64 -w0 or openssl base64 -A) — a value with surrounding quotes, URL-safe characters or other stray characters fails with an InvalidConfigurationError that does not print the value; adds the strict decodeStrictBase64 helper to builder-util. #10347 f8a6719 — app-builder-lib, builder-util
• Fix: cancel GitHub upload retry delays #10138 3910c94 — electron-publish
• Fix: only replace terminal platform icon extensions #10129 08d4a10 — builder-util
• Fix: cancel original async tasks in AsyncTaskManager #10133 b1460cc — builder-util
• Fix(mac): keep an explicit NSAllowsArbitraryLoads from mac.extendInfo. Before, electron-builder always set NSAppTransportSecurity.NSAllowsArbitraryLoads to true on non-MAS builds, after extendInfo was merged, so an app could not turn it off. After, it is set to true only when the app has not set it; the local-networking and localhost/127.0.0.1 exceptions that electron-updater's proxy needs are still added. #10353 f1e4a45 — app-builder-lib
• Fix(nsis): pin the LZMA2 block size of differential-aware packages so their bytes no longer depend on the build host's thread count. On hosts with fewer than 4 threads (such as 2-CPU GitHub runners), 7-Zip wrote one solid stream, so most of the package changed every release and differential updates downloaded nearly the whole package. Output on 4+ thread hosts is unchanged. #10335 f0833ea — app-builder-lib
• Fix(win): with win.sign: false or null, no certificate is read from CSC_LINK / WIN_CSC_LINK, and app-update.yml carries no derived publisherName #10376 38fba92 — app-builder-lib
• Refactor(win): export the Windows Authenticode helpers electron-updater verifies update signatures with (preparePowerShellExec, escapePowerShellSingleQuotes, parseAuthenticodeSignatureOutput, matchPublisherName), moved unchanged from electron-updater so electron-builder can check signed installers with the same code #10378 60e3708 — builder-util-runtime
• Fix(win): fail the build when the signed NSIS installer (or nsis-web stub) is not signed by a certificate matching the publisherName that electron-updater verifies updates against #10378 60e3708 — app-builder-lib
• Fix(deps): bump the @aws-sdk credential providers to drop the vulnerable fast-xml-parser 5.2.5, and reject aws login (login_session) profiles for awsCredentials.source: "profile" #10394 e021179 — electron-publish
• Fix(win): sign .msi with SHA-256 by default. An MSI holds a single signature, and electron-builder picked SHA-1 for it unless signingHashAlgorithms explicitly left SHA-1 out, so the default configuration (["sha1", "sha256"]) produced SHA-1-only signed MSIs. Now an MSI is signed with SHA-256 unless SHA-1 is the only algorithm listed. To keep the previous behaviour, set signingHashAlgorithms: ["sha1"]. Executables are still dual-signed by default. Because an MSI now takes the SHA-256 path, signtool timestamps it via RFC 3161 (/tr rfc3161TimeStampServer /td sha256) instead of the legacy /t timeStampServer, and a custom win.sign hook now receives hash: "sha256" for .msi files. Signing with an empty signingHashAlgorithms list now fails with an InvalidConfigurationError instead of running no signing pass and reporting the file as signed. #10374 0bef576 — app-builder-lib
• Fix(nsis): pressing Tab while a one-click installer shows its progress banner no longer makes the installer stop responding; keyboard focus now moves from the hidden install page to the banner's status text, which screen readers also announce #10396 cf3f5db — app-builder-lib
• Fix: preserve complete XML text and reject incomplete documents #10125 45d3bc4 — builder-util-runtime
• Fix: report finite transfer rates for immediate downloads #10122 370d18c — builder-util-runtime
• Fix(win): rename Electron's electron_wer.dll Windows Error Reporting helper together with the executable for Electron 45 and later, so fail-fast crashes are captured in packaged apps #10398 e9c5ae6 — app-builder-lib
• Fix(win): update the default winCodeSign toolset to 1.3.1. The bundled macOS osslsigncode now ships its own OpenSSL, so signing Windows artifacts on macOS no longer needs Homebrew's openssl@3 (and no longer fails with Symbol not found: _OPENSSL_sk_set_thunks when Homebrew's version doesn't match), and PKCS#11 signing works without installing libp11 or setting OPENSSL_MODULES #10414 5d84f91 — app-builder-lib

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@27.0.0-alpha.11...electron-builder@27.0.0-alpha.12