Skip to content

Bump the electron group across 1 directory with 2 updates - #3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/desktop/electron-6332fdf76c
Open

Bump the electron group across 1 directory with 2 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/desktop/electron-6332fdf76c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown

Bumps the electron group with 2 updates in the /desktop directory: electron-updater and electron-builder.

Updates electron-updater from 6.8.9 to 6.8.11

Release notes

Sourced from electron-updater's releases.

electron-updater@6.8.11

Patch Changes

electron-updater@6.8.10

Patch Changes

  • Fix: make multi-range differential downloads work on real servers. Three independent defects made downloadUpdate fall back to a full download with Response ends without calling any handlers: [#10219](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10219) 7dd7f8a @​claude

    • DataSplitter only recognised CRLF. Some CDNs answer multipart/byteranges with bare LF line endings, so no part was ever split and the whole response accumulated in memory. Header lists now end at whichever of \r\n\r\n / \n\n comes first, and the <EOL>--boundary separator size follows the line ending the server actually uses.
    • A header-list terminator split across two chunks was never found: only the new chunk was searched, the buffered bytes never were, so the parser locked onto the next part's header instead. Only the last few bytes of an unfinished header list are now carried over and searched together with the next chunk, instead of accumulating the whole list.
    • The 10s watchdog armed when a batch response ends was never disarmed after that batch succeeded. With more than 1000 operations (several range requests) it failed the whole download whenever a later batch took longer than the grace period.

  • Fix: keep the cached blockmap consistent with the cached installer. A download round that did not produce a new blockmap (e.g. the differential download was skipped because the cached installer was evicted) now removes the cached current.blockmap instead of leaving a stale one next to the freshly cached file, which poisoned the next differential download and surfaced as a generic sha512 checksum mismatch before falling back to a full download (#10097). Leftover pending blockmaps from previous update rounds are also cleared before a fresh download. sha512-mismatch logging now distinguishes a differential download that failed against stale/corrupt cached inputs (including whether the old blockmap came from the local cache or the server) from a genuine checksum failure of a fully downloaded file. [#10163](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10163) 1dfe1a9 @​claude

Changelog

Sourced from electron-updater's changelog.

6.8.11

Patch Changes

6.8.10

Patch Changes

  • Fix: make multi-range differential downloads work on real servers. Three independent defects made downloadUpdate fall back to a full download with Response ends without calling any handlers: [#10219](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10219) 7dd7f8a @​claude

    • DataSplitter only recognised CRLF. Some CDNs answer multipart/byteranges with bare LF line endings, so no part was ever split and the whole response accumulated in memory. Header lists now end at whichever of \r\n\r\n / \n\n comes first, and the <EOL>--boundary separator size follows the line ending the server actually uses.
    • A header-list terminator split across two chunks was never found: only the new chunk was searched, the buffered bytes never were, so the parser locked onto the next part's header instead. Only the last few bytes of an unfinished header list are now carried over and searched together with the next chunk, instead of accumulating the whole list.
    • The 10s watchdog armed when a batch response ends was never disarmed after that batch succeeded. With more than 1000 operations (several range requests) it failed the whole download whenever a later batch took longer than the grace period.

  • Fix: keep the cached blockmap consistent with the cached installer. A download round that did not produce a new blockmap (e.g. the differential download was skipped because the cached installer was evicted) now removes the cached current.blockmap instead of leaving a stale one next to the freshly cached file, which poisoned the next differential download and surfaced as a generic sha512 checksum mismatch before falling back to a full download (#10097). Leftover pending blockmaps from previous update rounds are also cleared before a fresh download. sha512-mismatch logging now distinguishes a differential download that failed against stale/corrupt cached inputs (including whether the old blockmap came from the local cache or the server) from a genuine checksum failure of a fully downloaded file. [#10163](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10163) 1dfe1a9 @​claude

Commits
  • e2a8604 chore(deploy): Release v26.18.0 (electron-updater@6.8.11) (v26) (#10250)
  • e5e3b41 fix(updater): validate cached update filenames (v26 backport of #10115) (#10300)
  • 5cdf017 chore(deploy): Release v26.17.0 (electron-updater@6.8.10) (v26) (#10191)
  • 7dd7f8a fix(updater): make multi-range differential downloads work on real servers (v...
  • 1dfe1a9 fix(electron-updater): keep cached blockmap consistent with cached installer ...
  • See full diff in compare view

Updates electron-builder from 26.15.3 to 26.18.0

Release notes

Sourced from electron-builder's releases.

electron-builder@26.18.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.17.0...electron-builder@26.18.0

electron-builder@26.17.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.1...electron-builder@26.17.0

electron-builder@26.16.1

What's Changed

... (truncated)

Changelog

Sourced from electron-builder's changelog.

26.18.0

Patch Changes

206d35d 3dc7c90 e703212 84f7b46 6202a27 fcd6897 160c3b4 1928adf c60987c a92517a a1e9db8 4123c27

  • app-builder-lib@26.18.0
  • dmg-builder@26.18.0

26.17.0

Patch Changes

bae1c8b 2a2dd22 07c8344 07c8344 613cd58 d4a4f50 41a027c 59f6364

  • app-builder-lib@26.17.0
  • dmg-builder@26.17.0

26.16.1

Patch Changes

b9b2e8a d6d4125 a4ec75f 5ae5a02 7c04b35

  • app-builder-lib@26.16.1
  • dmg-builder@26.16.1

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the electron group across 1 directory with 2 updates
e074f06 
Bumps the electron group with 2 updates in the /desktop directory: [electron-updater](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater) and [electron-builder](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-builder).


Updates `electron-updater` from 6.8.9 to 6.8.11
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/electron-updater@6.8.11/packages/electron-updater/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-updater@6.8.11/packages/electron-updater)

Updates `electron-builder` from 26.15.3 to 26.18.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/electron-builder@26.18.0/packages/electron-builder/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.18.0/packages/electron-builder)

---
updated-dependencies:
- dependency-name: electron-updater
  dependency-version: 6.8.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: electron
- dependency-name: electron-builder
  dependency-version: 26.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: electron
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@codecov-commenter

codecov-commenter commented Nov 1, 2026

Copy link
Copy Markdown

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@codecov-commenter