Skip to content

chore(deps-dev): bump electron-builder from 26.15.3 to 26.18.0 in /apps/desktop in the desktop-minor-patch group across 1 directory - #44

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/desktop/desktop-minor-patch-c754d40a5b
Open

chore(deps-dev): bump electron-builder from 26.15.3 to 26.18.0 in /apps/desktop in the desktop-minor-patch group across 1 directory#44
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/desktop/desktop-minor-patch-c754d40a5b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the desktop-minor-patch group with 1 update in the /apps/desktop directory: electron-builder.

Updates electron-builder from 26.15.3 to 26.18.0

Release notes

Sourced from electron-builder's releases.

electron-builder@26.18.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.17.0...electron-builder@26.18.0

electron-builder@26.17.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.1...electron-builder@26.17.0

electron-builder@26.16.1

What's Changed

... (truncated)

Changelog

Sourced from electron-builder's changelog.

26.18.0

Patch Changes

206d35d 3dc7c90 e703212 84f7b46 6202a27 fcd6897 160c3b4 1928adf c60987c a92517a a1e9db8 4123c27

  • app-builder-lib@26.18.0
  • dmg-builder@26.18.0

26.17.0

Patch Changes

bae1c8b 2a2dd22 07c8344 07c8344 613cd58 d4a4f50 41a027c 59f6364

  • app-builder-lib@26.17.0
  • dmg-builder@26.17.0

26.16.1

Patch Changes

b9b2e8a d6d4125 a4ec75f 5ae5a02 7c04b35

  • app-builder-lib@26.16.1
  • dmg-builder@26.16.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump electron-builder
73b778e 
Bumps the desktop-minor-patch group with 1 update in the /apps/desktop directory: [electron-builder](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-builder).


Updates `electron-builder` from 26.15.3 to 26.18.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/electron-builder@26.18.0/packages/electron-builder/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.18.0/packages/electron-builder)

---
updated-dependencies:
- dependency-name: electron-builder
  dependency-version: 26.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: desktop-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 28, 2026
@styayur styayur mentioned this pull request Nov 2, 2026
Draft
@styayur

styayur commented Nov 2, 2026

Copy link
Copy Markdown
Owner

The unchanged dependency gate requires zero desktop/production findings. The current integration fixes Brotli/Electron/Undici/fast-uri, but npm still reports 15 moderate desktop and 4 moderate web-tool findings. No compatible complete patched upstream builder graph is currently published.

Created isolated Draft #54 with Brotli 1.2.1, Electron 44.9.1, builder 26.18.0, Undici 6.29.1 and 7.30.1 in their exact desktop paths, and fast-uri 3.1.9. 98 API tests and full pip audit pass. Current API/Windows packaged renderer/Android candidate/CodeQL CI pass. Web gate correctly fails. Inspected modern upstream asar/universal/EJS alternatives and the remaining electron-winstaller -> temp 0.9.4 -> rimraf 2.6.3 -> glob 7.2.3 -> function-export minimatch 3.1.5 chain; no callback-compatible upgrade exists within that chain. A blind minimatch 11 or rimraf 6 override changes the legacy callable APIs. No policy expansion or API shim/version masquerading was applied.

Keep #54 Draft and originals open. Recheck a released builder/winstaller/temp chain or an upstream advisory-range correction, then rerun the full zero-finding gate, real browser tests, Windows packaged renderer and Android candidate checks on the exact combined head. A different packaging toolchain would need its own full migration acceptance. Default-branch Brotli remains an unresolved risk until a valid merge; branch-only fixes are not reported as resolved.

Evidence: #54 https://github.com/styayur/calligra/actions/runs/41487847608 GHSA-g3hv-75wg-m249 github/advisory-database#10811 https://github.com/electron/asar/releases

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@styayur