[dependabot]

Bumps @electron-forge/maker-squirrel from 8.0.0-alpha.10 to 8.0.1.

Release notes

Sourced from @​electron-forge/maker-squirrel's releases.

v8.0.1

Electron Forge 8

It’s time for a new major version! Forge is now ESM-only on Node.js 22, the Vite plugin is out of experimental, create-electron-app owns project scaffolding, and Forge installs with far fewer dependencies.

Read the Breaking changes section before upgrading.

Highlights

• ESM and Node.js 22. Every @electron-forge/* package is ESM-only and requires Node.js 22.17 or newer. Existing Forge configurations keep working in CommonJS or ESM projects. (#4059)
• The Vite plugin is promoted to stable. @electron-forge/plugin-vite is no longer experimental and is covered by semver. It now targets Vite 8, builds each target in an isolated process, supports opt-in main-process hot restart (hotRestart: true) and honours a custom server.host. (#4382, #4167, #4163, #4226, #4346, #4363)
• electron-forge publish is now electron-forge release to avoid conflict with the npm publish command. make always saves its results, so release --from-make can publish artifacts built by an earlier make, for example on another CI job. publish still works as a deprecated alias. (#4305, #4395)
• One template per bundler. create-electron-app --template vite --typescript replaces the separate *-typescript templates. New projects use oxlint and oxfmt, moduleResolution: bundler and a release script, and init gains --package-manager and --electron-version flags. (#4229, #4186, #4175, #4107, #4037)
• webpack output in your terminal. The webpack plugin renders compiler output as tabs in the terminal instead of a browser logger on port 9000. (#4389)
• Lighter install. got, fs-extra, fast-glob, find-up, chalk, lodash, rechoir and others were replaced with Node.js built-ins. (#4189, #4250, #4227, #4248, #4245, #4066)
• Makers and publishers. PKG notarization (#4234), MSIX outputFileName (#4295), typed copyright for deb and rpm (#4298), byte-level GitHub upload progress (#4304), and the artifact version in S3 and GCS keyResolver (#4033).

Breaking changes

Everyone

• Node.js 22.17.0 or newer is required (was 16.4.0). (#4059)
• All packages are ESM-only. The CLI needs no changes. If you call the programmatic API with require('@electron-forge/core'), that relies on Node's require(esm); switch to import to be safe. (#4059)
• Custom makers, publishers, plugins and string packagerConfig hooks must have a default export (export default or module.exports =). (#4059)
• Config templating was removed. Strings in your config are no longer rendered as lodash templates (${version}, ${year}, other package.json fields), and require:./path strings are no longer resolved. Use JavaScript in forge.config.* instead. (#4066)
• Only forge.config.{js,mjs,cjs,ts,mts,cts} are loaded. Config files in other languages (CoffeeScript, Babel-registered files, etc.) are no longer supported through rechoir. (#4066)
• init and import moved to create-electron-app. Use npx create-electron-app@latest my-app and npx create-electron-app@latest import. The electron-forge init and electron-forge import commands, and their core API functions, were removed. Importing Forge 5 projects (#4083) and loading globally installed templates (#4065) are no longer supported. (#4148)
• init no longer guesses your package manager. It asks when run interactively and uses npm otherwise. Pass --package-manager pnpm, yarn or an exact version such as yarn@1.22.22 in scripts and CI. (#4107)
• Deprecated, still working: publish → release, make --skip-package → --from-package, release --from-dry-run → --from-make, release --dry-run → make. Dry runs saved by Forge 7 cannot be resumed; run make again with Forge 8. (#4305, #4395)
• Plugins are initialized once per command. make and release no longer re-resolve the config for their nested steps, so init() and resolveForgeConfig run once. (#4394)

Vite and webpack plugins

• Main and preload bundles are emitted as .cjs. Both plugins stop with an error explaining the fix if your project still uses the old paths. (#4393)
  • Vite: set "main": ".vite/build/main.cjs" and load preloads with path.join(__dirname, 'preload.cjs').
  • webpack: set "main": ".webpack/main/index.cjs".
• The Vite plugin targets Vite 8. Upgrade vite to 8.x and port custom Rollup options to Vite 8. (#4167)
• The webpack loggerPort option was removed along with @electron-forge/web-multi-logger. In the terminal UI, press r to restart the app. (#4389)
• webpack-dev-server 5. Custom devServer options must follow the v5 API. (#4308)

Makers

• DMG output moved to out/make/dmg/<arch>/ (#4275) and PKG output moved to out/make/pkg/<arch>/ (#4383). Update any CI globs that upload from out/make/.
• @electron-forge/maker-appx is deprecated and now builds .msix through electron-windows-msix. Several Desktop App Converter options are ignored with a warning, no development certificate is generated when devCert is unset, and a publisher is required. Move to @electron-forge/maker-msix. (#4392)
• maker-deb rejects unsupported architectures, including arm (armel). Supported: ia32, x64, arm64, armv7l, mips64el. (#4059)
• maker-wix only builds x64, ia64 and x86. (#3859)
• maker-deb and maker-rpm use electron-installer-debian and electron-installer-redhat v4. (#4379)
• Type renames: MakerFlatpakOptionsConfig is now MakerFlatpakConfigOptions, and maker-dmg no longer re-exports the electron-installer-dmg option types. (#4321)

Publishers

... (truncated)

Changelog

Sourced from @​electron-forge/maker-squirrel's changelog.

Changelog

The changelog for subsequent updates is available for each release independently on this repo's GitHub Releases page. This document is preserved for historical purposes.

6.0.2 (2022-11-14)

6.0.1 (2022-11-08)

6.0.0 (2022-11-02)

6.0.0-beta.75 (2022-11-01)

New Features

• move create-electron-app into forge (#2988) (a2eadbcb)

6.0.0-beta.74 (2022-11-01)

Bug Fixes

• do not proxify class instances in forge config (#3039) (a89ed7d3)

Other Changes

• add proper package test for webpack ts template (#3040) (6e9cca35)

6.0.0-beta.73 (2022-11-01)

Bug Fixes

• ensure webpack typescript template runs (#3038) (e1d5db00)

6.0.0-beta.72 (2022-10-31)

6.0.0-beta.71 (2022-10-31)

Bug Fixes

• packager: "packaging application" log never stops when building for multiple architectures (#3006) (247f52ab)
• publish: ignore unnecessary files when publishing to npm (#3024) (ab8ea661)
• template-base: use minimum instead of exact version when replacing ELECTRON_FORGE/VERSION in templates (#3030) (7aaa7029)
• use @​electron-forge/cli hint for project resolution (#3023) (b5d05874)
• restore isProd in the webpack plugin (#3021) (531788ba)

6.0.0-beta.70 (2022-10-28)

Bug Fixes

... (truncated)

Commits

• 48f38bb chore: bump version to 8.0.1 (#4426)
• 40b4adf chore: bump version to 8.0.0 (#4425)
• 2868de8 refactor(maker-appx)!: reimplement as a legacy wrapper over the MSIX maker (#...
• d7c592c docs: add AGENTS.md guidance for AI coding agents (#4416)
• 5023ae1 build(deps): upgrade Electron to 44.4.3 (#4410)
• 1d268aa build(deps): bump vulnerable transitive and direct dependencies (#4408)
• c7bae14 fix(template): typecheck root-level config files (#4407)
• 198d934 fix(template-vite): use .mts for Vite configs in the TypeScript variant (#4406)
• e0fb4d4 build: bump @​electron/lint-roller to ^4.0.0 (#4404)
• 7b2f0e8 feat!: replace release --from-dry-run with --from-make, and `make --skip-...
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​electron-forge/​maker-squirrel@​8.0.0-alpha.10 ⏵ 8.0.1	+1		+3

View full report

[claude]

🔴 CI and release jobs will fail at install, because the lockfile is missing two packages the new maker-squirrel needs. yarn install --immutable would have to add them and stops. The new @ electron-forge/maker-squirrel@ npm:8.0.1 and @ electron-forge/core-utils@ npm:8.0.1 entries depend on @ electron-forge/maker-base and @ electron-forge/shared-types at npm:8.0.1. Only the 8.0.0-alpha.10 entries for those two exist (yarn.lock:421, yarn.lock:558). Fix: regenerate yarn.lock with flock /tmp/fiddle-2027-yarn.lock yarn install so every npm:8.0.1 dependency has an entry. Bumping all @ electron-forge/* packages to 8.0.1 together also avoids mixing alpha and stable Forge versions.

Why this was flagged

The trigger is any CI or release run, which installs with yarn install --immutable (.github/workflows/ci.yml:56, ci.yml:138, release.yml:57, release.yml:127, release.yml:220). yarn.lock:387-398 adds @ electron-forge/core-utils@ npm:8.0.1, which depends on @ electron-forge/shared-types: npm:8.0.1. yarn.lock:471-478 changes maker-squirrel so it depends on @ electron-forge/maker-base: npm:8.0.1 and @ electron-forge/shared-types: npm:8.0.1. The lockfile has no resolution entry for either descriptor. The only ones are @ electron-forge/maker-base@ npm:8.0.0-alpha.10 (yarn.lock:421) and @ electron-forge/shared-types@ npm:8.0.0-alpha.10 (yarn.lock:558). Yarn Berry must add those entries during resolution, and --immutable fails with YN0028 "The lockfile would have been modified by this install, which is explicitly forbidden". On the base branch the lockfile is consistent and the install succeeds. After this change, lint, test and the yarn make release jobs never get past install. Nothing guards against this: the lockfile was edited by hand or only partly regenerated.

Verification: The trigger is any CI or release job running yarn install --immutable (.github/workflows/ci.yml:56). Maker-squirrel (yarn.lock:471-478) depends on maker-base and shared-types at npm:8.0.1, but yarn.lock has only their alpha.10 entries (lines 421 and 558). With --immutable, any change to the lockfile is an error (YN0028), so install aborts in every CI and release job.

[claude]

Code review found no new issues

No new issues were found in this update; 1 finding from earlier reviews is still open above.

Still open from earlier reviews (1):

• 🔴 yarn.lock:398 — CI and release jobs will fail at install, because the lockfile is missing two packages the new maker-squirrel needs. ya…

If you have decided not to act on one of these findings, resolve its thread (a reply alone leaves it open) and the next review stops counting it. To review this commit again now, use Re-run on its "Claude Code Review" check.