Skip to content

Upgrade electron-builder to 26.6.0 (latest)#18474

Draft
abergs wants to merge 12 commits intomainfrom
anders/electron-builder
Draft

Upgrade electron-builder to 26.6.0 (latest)#18474
abergs wants to merge 12 commits intomainfrom
anders/electron-builder

Conversation

@abergs
Copy link
Member

@abergs abergs commented Jan 21, 2026 •
edited
Loading

🎟️ Tracking

📔 Objective

This PR updates electron-builder to 26.6.0. The reason for upgrading is to unblock another PR: https://github.com/bitwarden/clients/pull/17982/changes#r2711707144

What do we normally test when we're bumping electron builder?
I've verified the dmg build.

📸 Screenshots

@github-actions
Copy link
Contributor

github-actions bot commented Jan 21, 2026 •
edited
Loading

Logo
Checkmarx One – Scan Summary & Details – 4bef5fed-c186-4a5e-963a-c5f5ed020879

New Issues (1) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 MEDIUM Missing_HSTS_Header /apps/web/src/app/dirt/reports/pages/inactive-two-factor-report.component.ts: 141
detailsThe web-application does not define an HSTS header, leaving it vulnerable to attack.
Attack Vector

@codecov
Copy link

codecov bot commented Jan 21, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.22%. Comparing base (4f256fe) to head (fc2bca6).
⚠️ Report is 58 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #18474      +/-   ##
==========================================
+ Coverage   44.14%   44.22%   +0.07%     
==========================================
  Files        3725     3721       -4     
  Lines      109380   110048     +668     
  Branches    16618    16727     +109     
==========================================
+ Hits        48287    48664     +377     
- Misses      59032    59306     +274     
- Partials     2061     2078      +17

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@abergs
Fix macOS universal build for electron-builder 26.4.0
ba7a594 
electron-builder 26.4.0 includes a stricter version of @electron/universal
that validates Mach-O binaries during universal app creation. The bufferutil
package installs prebuilt binaries for all architectures (darwin-x64 and
darwin-arm64), causing the universal merger to detect identical files in
both builds and fail.

Add x64ArchFiles pattern to allow these architecture-specific prebuilds
to pass validation without attempting to merge them with lipo.
@abergs abergs force-pushed the anders/electron-builder branch from a9c447f to ba7a594 Compare January 21, 2026 12:01
@abergs abergs force-pushed the anders/electron-builder branch from c9b76a5 to f83f602 Compare January 22, 2026 08:26
abergs
abergs commented Jan 22, 2026
View reviewed changes
apps/desktop/electron-builder.json
},
"provisioningProfile": "bitwarden_desktop_developer_id.provisionprofile",
"singleArchFiles": "node_modules/@bitwarden/desktop-napi/desktop_napi.darwin-*.node",
"x64ArchFiles": "**/bufferutil/**/darwin-*/*.node",
Copy link
Member Author

@abergs abergs Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Turns out electron builder now has a more detailed check for duplicates of binaries in universal builds.

abergs
abergs commented Jan 22, 2026
View reviewed changes
apps/desktop/electron-builder.json
}
},
"mas": {
"identity": "Bitwarden Inc",
Copy link
Member Author

@abergs abergs Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Without providing the identity signing the .pkg file fails. Most likely because of upstream bug in resolving identity.

@abergs abergs force-pushed the anders/electron-builder branch from 73a22af to 8e58fb2 Compare January 22, 2026 16:09
@vleague2
Copy link
Contributor

vleague2 commented Jan 22, 2026

We had an issue with Chromatic that is now fixed. I just reran the Chromatic workflow on your PR. You can ignore pending checks for clients_autofill!

@abergs abergs changed the title Upgrade electron-builder to 26.4.0 (latest) Upgrade electron-builder to 26.5.0 (latest) Jan 23, 2026
@wrobelda
Copy link

wrobelda commented Feb 7, 2026 •
edited
Loading

Please note that updating electron-builder to latest should also enable building aarch64 versions of DEB and RPM packages:
electron-userland/electron-builder#9563

The current setup only builds a tar.gz package.

Also see comments under this commit for reference: signalapp/Signal-Desktop@560dcb9

@abergs abergs changed the title Upgrade electron-builder to 26.5.0 (latest) Upgrade electron-builder to 26.6.0 (latest) Feb 19, 2026
@sonarqubecloud
Copy link

sonarqubecloud bot commented Feb 24, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@wrobelda wrobelda mentioned this pull request Feb 25, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@abergs @vleague2 @wrobelda