electron-userland · electron-builder-release-bot · May 30, 2026
diff --git a/.changeset/few-falcons-grin.md b/.changeset/few-falcons-grin.md
diff --git a/.changeset/six-rice-knock.md b/.changeset/six-rice-knock.md
diff --git a/.changeset/sweet-worlds-study.md b/.changeset/sweet-worlds-study.md
diff --git a/.changeset/wild-roses-carry.md b/.changeset/wild-roses-carry.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/packages/app-builder-lib/CHANGELOG.md b/packages/app-builder-lib/CHANGELOG.md
@@ -1,5 +1,30 @@
 # app-builder-lib
 
+## 26.12.1
+
+### Patch Changes
+
+- Fix: harden generated-file output, argument construction, and download validation _[`#9778`](https://github.com/electron-userland/electron-builder/pull/9778) [`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [@mmaietta](https://github.com/mmaietta)_
+- Fix: properly parse and pass through `mas` configs to overwrite `mac` config when target is `mas` or `mas-dev` _[`#9567`](https://github.com/electron-userland/electron-builder/pull/9567) [`2c4cfa4`](https://github.com/electron-userland/electron-builder/commit/2c4cfa405303fe67008cce2d95a2645014e8e8e2) [@mmaietta](https://github.com/mmaietta)_
+- Fix(codeql): resolving GH CodeQL alerts _[`#9783`](https://github.com/electron-userland/electron-builder/pull/9783) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [@mmaietta](https://github.com/mmaietta)_
+- Chore: provide better error messaging when electron version in devDependencies or electronVersion property are not pinned _[`#9785`](https://github.com/electron-userland/electron-builder/pull/9785) [`f9ecb3c`](https://github.com/electron-userland/electron-builder/commit/f9ecb3c3f985ec999c3c8ba07e6054b0611284b6) [@mmaietta](https://github.com/mmaietta)_
+
+<details><summary>Updated 5 dependencies</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63)
+
+</small>
+
+- `builder-util-runtime@9.6.2`
+- `builder-util@26.12.1`
+- `dmg-builder@26.12.1`
+- `electron-builder-squirrel-windows@26.12.1`
+- `electron-publish@26.12.1`
+
+</details>
+
 ## 26.12.0
 
 ### Minor Changes

diff --git a/packages/app-builder-lib/package.json b/packages/app-builder-lib/package.json
@@ -1,7 +1,7 @@
 {
   "name": "app-builder-lib",
   "description": "electron-builder lib",
-  "version": "26.12.0",
+  "version": "26.12.1",
   "main": "out/index.js",
   "files": [
     "out",

diff --git a/packages/app-builder-lib/src/macPackager.ts b/packages/app-builder-lib/src/macPackager.ts
@@ -1,7 +1,21 @@
 import { SignOptions } from "@electron/osx-sign/dist/cjs/types"
 import { Identity } from "@electron/osx-sign/dist/cjs/util-identities"
 import { makeUniversalApp } from "@electron/universal"
-import { Arch, AsyncTaskManager, copyFile, deepAssign, exec, exists, getArchSuffix, InvalidConfigurationError, log, orIfFileNotExist, sanitizeDirPath, unlinkIfExists, use } from "builder-util"
+import {
+  Arch,
+  AsyncTaskManager,
+  copyFile,
+  deepAssign,
+  exec,
+  exists,
+  getArchSuffix,
+  InvalidConfigurationError,
+  log,
+  orIfFileNotExist,
+  sanitizeDirPath,
+  unlinkIfExists,
+  use,
+} from "builder-util"
 import { MemoLazy, Nullish } from "builder-util-runtime"
 import * as fs from "fs/promises"
 import { mkdir, readdir } from "fs/promises"

diff --git a/packages/app-builder-lib/src/version.ts b/packages/app-builder-lib/src/version.ts
@@ -1 +1 @@
-export const PACKAGE_VERSION = "26.12.0"
+export const PACKAGE_VERSION = "26.12.1"
diff --git a/packages/builder-util-runtime/CHANGELOG.md b/packages/builder-util-runtime/CHANGELOG.md
@@ -1,5 +1,12 @@
 # builder-util-runtime
 
+## 9.6.2
+
+### Patch Changes
+
+- Fix: harden generated-file output, argument construction, and download validation _[`#9778`](https://github.com/electron-userland/electron-builder/pull/9778) [`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [@mmaietta](https://github.com/mmaietta)_
+- Fix(codeql): resolving GH CodeQL alerts _[`#9783`](https://github.com/electron-userland/electron-builder/pull/9783) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [@mmaietta](https://github.com/mmaietta)_
+
 ## 9.6.1
 
 ### Patch Changes

diff --git a/packages/builder-util-runtime/package.json b/packages/builder-util-runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "builder-util-runtime",
-  "version": "9.6.1",
+  "version": "9.6.2",
   "main": "out/index.js",
   "author": "Vladimir Krivosheev",
   "license": "MIT",

diff --git a/packages/builder-util/CHANGELOG.md b/packages/builder-util/CHANGELOG.md
@@ -1,5 +1,24 @@
 # builder-util
 
+## 26.12.1
+
+### Patch Changes
+
+- Fix: harden generated-file output, argument construction, and download validation _[`#9778`](https://github.com/electron-userland/electron-builder/pull/9778) [`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [@mmaietta](https://github.com/mmaietta)_
+- Fix(codeql): resolving GH CodeQL alerts _[`#9783`](https://github.com/electron-userland/electron-builder/pull/9783) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [@mmaietta](https://github.com/mmaietta)_
+
+<details><summary>Updated 1 dependency</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63)
+
+</small>
+
+- `builder-util-runtime@9.6.2`
+
+</details>
+
 ## 26.12.0
 
 ### Minor Changes

diff --git a/packages/builder-util/package.json b/packages/builder-util/package.json
@@ -1,6 +1,6 @@
 {
   "name": "builder-util",
-  "version": "26.12.0",
+  "version": "26.12.1",
   "main": "out/util.js",
   "author": "Vladimir Krivosheev",
   "license": "MIT",

diff --git a/packages/dmg-builder/CHANGELOG.md b/packages/dmg-builder/CHANGELOG.md
@@ -1,5 +1,24 @@
 # dmg-builder
 
+## 26.12.1
+
+### Patch Changes
+
+- Fix: harden generated-file output, argument construction, and download validation _[`#9778`](https://github.com/electron-userland/electron-builder/pull/9778) [`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [@mmaietta](https://github.com/mmaietta)_
+
+<details><summary>Updated 2 dependencies</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`2c4cfa4`](https://github.com/electron-userland/electron-builder/commit/2c4cfa405303fe67008cce2d95a2645014e8e8e2) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [`f9ecb3c`](https://github.com/electron-userland/electron-builder/commit/f9ecb3c3f985ec999c3c8ba07e6054b0611284b6)
+
+</small>
+
+- `app-builder-lib@26.12.1`
+- `builder-util@26.12.1`
+
+</details>
+
 ## 26.12.0
 
 ### Patch Changes

diff --git a/packages/dmg-builder/package.json b/packages/dmg-builder/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "dmg-builder",
-	"version": "26.12.0",
+	"version": "26.12.1",
 	"main": "out/dmgUtil.js",
 	"author": "Vladimir Krivosheev",
 	"license": "MIT",

diff --git a/packages/electron-builder-squirrel-windows/CHANGELOG.md b/packages/electron-builder-squirrel-windows/CHANGELOG.md
@@ -1,5 +1,24 @@
 # electron-builder-squirrel-windows
 
+## 26.12.1
+
+### Patch Changes
+
+- Fix(codeql): resolving GH CodeQL alerts _[`#9783`](https://github.com/electron-userland/electron-builder/pull/9783) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [@mmaietta](https://github.com/mmaietta)_
+
+<details><summary>Updated 2 dependencies</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`2c4cfa4`](https://github.com/electron-userland/electron-builder/commit/2c4cfa405303fe67008cce2d95a2645014e8e8e2) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [`f9ecb3c`](https://github.com/electron-userland/electron-builder/commit/f9ecb3c3f985ec999c3c8ba07e6054b0611284b6)
+
+</small>
+
+- `app-builder-lib@26.12.1`
+- `builder-util@26.12.1`
+
+</details>
+
 ## 26.12.0
 
 ### Patch Changes

diff --git a/packages/electron-builder-squirrel-windows/package.json b/packages/electron-builder-squirrel-windows/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron-builder-squirrel-windows",
-  "version": "26.12.0",
+  "version": "26.12.1",
   "main": "out/SquirrelWindowsTarget.js",
   "author": "Vladimir Krivosheev",
   "license": "MIT",

diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -69,24 +69,24 @@ export default class SquirrelWindowsTarget extends Target {
 
     try {
       canonicalBaseDir = await fs.promises.realpath(resolvedBaseDir)
-    }
-    catch {
+    } catch {
       canonicalBaseDir = resolvedBaseDir
     }
 
     try {
       canonicalTargetPath = await fs.promises.realpath(resolvedTargetPath)
-    }
-    catch {
+    } catch {
       // Target may not exist yet; resolve the parent to handle symlinks/junctions consistently
       try {
         const resolvedTargetParent = path.dirname(resolvedTargetPath)
         const canonicalTargetParent = await fs.promises.realpath(resolvedTargetParent)
         const relativeFromResolvedParent = path.relative(resolvedTargetParent, resolvedTargetPath)
-        if (isEmptyOrSpaces(relativeFromResolvedParent) ||
+        if (
+          isEmptyOrSpaces(relativeFromResolvedParent) ||
           path.isAbsolute(relativeFromResolvedParent) ||
           relativeFromResolvedParent.split(path.sep).includes("..") ||
-          /[\0\r\n]/.test(relativeFromResolvedParent)) {
+          /[\0\r\n]/.test(relativeFromResolvedParent)
+        ) {
           throw new InvalidConfigurationError(`${description} contains invalid path segments`)
         }
         canonicalTargetPath = path.resolve(canonicalTargetParent, relativeFromResolvedParent)

diff --git a/packages/electron-builder/CHANGELOG.md b/packages/electron-builder/CHANGELOG.md
@@ -1,5 +1,26 @@
 # electron-builder
 
+## 26.12.1
+
+### Patch Changes
+
+- Fix: harden generated-file output, argument construction, and download validation _[`#9778`](https://github.com/electron-userland/electron-builder/pull/9778) [`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [@mmaietta](https://github.com/mmaietta)_
+
+<details><summary>Updated 4 dependencies</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`2c4cfa4`](https://github.com/electron-userland/electron-builder/commit/2c4cfa405303fe67008cce2d95a2645014e8e8e2) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [`f9ecb3c`](https://github.com/electron-userland/electron-builder/commit/f9ecb3c3f985ec999c3c8ba07e6054b0611284b6)
+
+</small>
+
+- `builder-util-runtime@9.6.2`
+- `app-builder-lib@26.12.1`
+- `builder-util@26.12.1`
+- `dmg-builder@26.12.1`
+
+</details>
+
 ## 26.12.0
 
 ### Patch Changes

diff --git a/packages/electron-builder/package.json b/packages/electron-builder/package.json
@@ -1,7 +1,7 @@
 {
   "name": "electron-builder",
   "description": "A complete solution to package and build a ready for distribution Electron app for MacOS, Windows and Linux with “auto update” support out of the box",
-  "version": "26.12.0",
+  "version": "26.12.1",
   "main": "out/index.js",
   "files": [
     "out"

diff --git a/packages/electron-forge-maker-appimage/CHANGELOG.md b/packages/electron-forge-maker-appimage/CHANGELOG.md
@@ -1,5 +1,21 @@
 # electron-forge-maker-appimage
 
+## 26.12.1
+
+### Patch Changes
+
+<details><summary>Updated 1 dependency</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`2c4cfa4`](https://github.com/electron-userland/electron-builder/commit/2c4cfa405303fe67008cce2d95a2645014e8e8e2) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [`f9ecb3c`](https://github.com/electron-userland/electron-builder/commit/f9ecb3c3f985ec999c3c8ba07e6054b0611284b6)
+
+</small>
+
+- `app-builder-lib@26.12.1`
+
+</details>
+
 ## 26.12.0
 
 ### Patch Changes

diff --git a/packages/electron-forge-maker-appimage/package.json b/packages/electron-forge-maker-appimage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron-forge-maker-appimage",
-  "version": "26.12.0",
+  "version": "26.12.1",
   "main": "main.js",
   "author": "Vladimir Krivosheev",
   "license": "MIT",

diff --git a/packages/electron-forge-maker-nsis-web/CHANGELOG.md b/packages/electron-forge-maker-nsis-web/CHANGELOG.md
@@ -1,5 +1,21 @@
 # electron-forge-maker-nsis-web
 
+## 26.12.1
+
+### Patch Changes
+
+<details><summary>Updated 1 dependency</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`2c4cfa4`](https://github.com/electron-userland/electron-builder/commit/2c4cfa405303fe67008cce2d95a2645014e8e8e2) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [`f9ecb3c`](https://github.com/electron-userland/electron-builder/commit/f9ecb3c3f985ec999c3c8ba07e6054b0611284b6)
+
+</small>
+
+- `app-builder-lib@26.12.1`
+
+</details>
+
 ## 26.12.0
 
 ### Patch Changes

diff --git a/packages/electron-forge-maker-nsis-web/package.json b/packages/electron-forge-maker-nsis-web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron-forge-maker-nsis-web",
-  "version": "26.12.0",
+  "version": "26.12.1",
   "main": "main.js",
   "author": "Vladimir Krivosheev",
   "license": "MIT",

diff --git a/packages/electron-forge-maker-nsis/CHANGELOG.md b/packages/electron-forge-maker-nsis/CHANGELOG.md
@@ -1,5 +1,21 @@
 # electron-forge-maker-nsis
 
+## 26.12.1
+
+### Patch Changes
+
+<details><summary>Updated 1 dependency</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`2c4cfa4`](https://github.com/electron-userland/electron-builder/commit/2c4cfa405303fe67008cce2d95a2645014e8e8e2) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [`f9ecb3c`](https://github.com/electron-userland/electron-builder/commit/f9ecb3c3f985ec999c3c8ba07e6054b0611284b6)
+
+</small>
+
+- `app-builder-lib@26.12.1`
+
+</details>
+
 ## 26.12.0
 
 ### Patch Changes

diff --git a/packages/electron-forge-maker-nsis/package.json b/packages/electron-forge-maker-nsis/package.json
@@ -1,6 +1,6 @@
 {
   "name": "electron-forge-maker-nsis",
-  "version": "26.12.0",
+  "version": "26.12.1",
   "main": "main.js",
   "author": "Vladimir Krivosheev",
   "license": "MIT",

diff --git a/packages/electron-forge-maker-snap/CHANGELOG.md b/packages/electron-forge-maker-snap/CHANGELOG.md
@@ -1,5 +1,21 @@
 # electron-forge-maker-snap
 
+## 26.12.1
+
+### Patch Changes
+
+<details><summary>Updated 1 dependency</summary>
+
+<small>
+
+[`d6a5aee`](https://github.com/electron-userland/electron-builder/commit/d6a5aee821138449dc0c082606da6a1bf5ba0798) [`2c4cfa4`](https://github.com/electron-userland/electron-builder/commit/2c4cfa405303fe67008cce2d95a2645014e8e8e2) [`4866737`](https://github.com/electron-userland/electron-builder/commit/4866737e4fe1f0cca210d318b9ce440f8e978a63) [`f9ecb3c`](https://github.com/electron-userland/electron-builder/commit/f9ecb3c3f985ec999c3c8ba07e6054b0611284b6)
+
+</small>
+
+- `app-builder-lib@26.12.1`
+
+</details>
+
 ## 26.12.0
 
 ### Patch Changes
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		export const PACKAGE_VERSION = "26.12.0"
		export const PACKAGE_VERSION = "26.12.1"