Bump app-builder-lib from 26.8.2 to 26.15.0

[dependabot]

Bumps app-builder-lib from 26.8.2 to 26.15.0.

Release notes

Sourced from app-builder-lib's releases.

electron-builder@26.15.0

What's Changed

• chore(pr-labeler): force run to only pull_request on core repo (ignore forks) by @​mmaietta in electron-userland/electron-builder#9821
• fix(mac): skip signing when no certificate found; warn on ad-hoc + hardenedRuntime by @​mmaietta in electron-userland/electron-builder#9822
• fix: use bash instead of sh in package.json by @​mmaietta in electron-userland/electron-builder#9823
• chore: replace app-builder-bin node-dep-tree and rebuild-node-modules by @​mmaietta in electron-userland/electron-builder#9828
• feat(node-module-collector): invoke package managers via PowerShell -EncodedCommand on Windows by @​mmaietta in electron-userland/electron-builder#9827
• feat(migration): fully replace Go binary app-builder-bin with TS implementation by @​mmaietta in electron-userland/electron-builder#9829
• chore(test): print out shard duration calculation results during shard-count step by @​mmaietta in electron-userland/electron-builder#9831
• feat(linux): add syncDesktopName option to align installed .desktop filename with StartupWMClass by @​mmaietta in electron-userland/electron-builder#9832
• fix(smart-cache): deep-merge shard caches so linux timing data survives across runs by @​mmaietta in electron-userland/electron-builder#9833
• fix: holistic field detection for <text> (sha256 hash) redaction by @​mmaietta in electron-userland/electron-builder#9834
• fix(mac/pkg): explicitly pass --version to pkgbuild by @​mmaietta in electron-userland/electron-builder#9835
• chore(deploy): Release (next) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#9825

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.14.0...electron-builder@26.15.0

electron-builder@26.14.0

What's Changed

• fix(pnpm): properly resolve nested dependencies when nodeLinker: hoisted by @​mmaietta in electron-userland/electron-builder#9811
• feat: migrate blockmap and icon commands from app-builder-bin to pure TypeScript by @​mmaietta in electron-userland/electron-builder#9800
• feat(dmg-builder): migrate license attachment to dmg-builder at creation time by @​mmaietta in electron-userland/electron-builder#9815
• fix: resolve vitest smart cache never being located on CI by @​mmaietta in electron-userland/electron-builder#9813
• fix(dynamic-import): resolve module paths via CJS resolver for reliable subpath imports by @​mmaietta in electron-userland/electron-builder#9817
• fix(builder-util): add timeout to spawnAndWriteWithOutput by @​mmaietta in electron-userland/electron-builder#9820
• chore(deploy): Release (next) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#9812

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.13.1...electron-builder@26.14.0

electron-builder@26.13.1

What's Changed

• fix: correct update-alternatives --remove path and unload AppArmor profile on removal by @​mmaietta in electron-userland/electron-builder#9801
• fix(traversal): accept transitive dependencies resolved outside their declared range by package manager overrides by @​mmaietta in electron-userland/electron-builder#9804
• fix(win): log actionable hint when signAndEditExecutable: false that icon and metadata are not applied by @​mmaietta in electron-userland/electron-builder#9807
• chore(deps): replace @develar/schema-utils with a self-contained ajv@8 validator by @​mmaietta in electron-userland/electron-builder#9803
• fix(win): restore getToolPath() on WindowsSignToolManager and improve public API by @​mmaietta in electron-userland/electron-builder#9806
• fix(nsis): validate makensis stderr and installer file size post-build by @​mmaietta in electron-userland/electron-builder#9802
• chore: document non-existent swiftshader directory in newer electron versions by @​Lemonexe in electron-userland/electron-builder#9781
• fix(node-module-collector): suppress expected npm list stderr from user-visible warnings when collecting dependencies for Yarn projects using resolutions by @​mmaietta in electron-userland/electron-builder#9810
• chore(deploy): Release (next) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#9805

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.13.0...electron-builder@26.13.1

electron-builder@26.13.0

What's Changed

• chore(test): fix caching mechanism for vitest-smart-cache test suite durations by @​mmaietta in electron-userland/electron-builder#9791
• feat: add disableAsarIntegrity config option to skip ASAR integrity computation by @​mmaietta in electron-userland/electron-builder#9786

... (truncated)

Changelog

Sourced from app-builder-lib's changelog.

26.15.0

Minor Changes

• Feat(linux): add linux.syncDesktopName opt-in flag to align installed .desktop filename with desktopName and StartupWMClass; will become default in v27 [#9832](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9832) 8096732 @​mmaietta
• Fix(node-module-collector): invoke package managers via PowerShell -EncodedCommand on Windows to eliminate shell injection vectors and the Node DEP0190 deprecation warning [#9827](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9827) 3e3ea31 @​mmaietta
• Chore: replace app-builder-bin node-dep-tree and rebuild-node-modules with pure-TS equivalents; nativeRebuilder: "legacy" now routes to @electron/rebuild sequential mode [#9828](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9828) 198c10c @​mmaietta
• Chore: replace app-builder-bin proton-native command with pure-TS equivalents; Node.js and LaunchUI binaries are now downloaded via downloadBuilderToolset; config.launchUiVersion string is now respected [#9829](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9829) 01b8ba9 @​mmaietta
• Chore: replace app-builder-bin snap and wine commands with pure-TS equivalents; executeAppBuilder and app-builder-bin package fully removed from codebase; snap templates now downloaded via downloadBuilderToolset with pinned checksums; Wine is downloaded automatically on macOS (legacy 4.0.1 bundle by default, Wine 11 bundle available via toolsets.wine: "1.0.1"); on Linux with legacy config and when USE_SYSTEM_WINE=true, system wine is used instead [#9829](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9829) 01b8ba9 @​mmaietta

Patch Changes

• Fix(mac): skip signing when no certificate found; warn on ad-hoc + hardenedRuntime [#9822](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9822) 8f0621b @​mmaietta
• Fix(mac/pkg): explicitly pass --version to pkgbuild [#9835](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9835) 2fb4078 @​mmaietta

198c10c 01b8ba9 22a7532

• builder-util-runtime@9.7.0
• builder-util@26.15.0
• electron-publish@26.15.0
• dmg-builder@26.15.0
• electron-builder-squirrel-windows@26.15.0

26.14.0

Minor Changes

• Feat: migrate blockmap and icon commands from app-builder-bin to pure TypeScript [#9800](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9800) 7a71b01 @​mmaietta

Patch Changes

• Fix(pnpm): properly resolve nested dependencies when nodeLinker: hoisted [#9811](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9811) 2be34d2 @​mmaietta
• Fix(dynamic-import): use CJS resolver to reliably resolve package subpaths in pnpm projects [#9817](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9817) 370bd75 @​mmaietta
• Fix(builder-util): add timeout to spawnAndWriteWithOutput [#9820](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib/issues/9820) 0e67339 @​mmaietta

f0e33f0 0e67339

... (truncated)

Commits

• bed3a9c chore(deploy): Release v26.15.0 (electron-updater@6.8.9) (#9825)
• 2fb4078 fix(mac/pkg): explicitly pass --version to pkgbuild (#9835)
• 8096732 feat(linux): add syncDesktopName option to align installed .desktop filen...
• 01b8ba9 feat(migration): fully replace Go binary app-builder-bin with TS implementa...
• 3e3ea31 feat(node-module-collector): invoke package managers via PowerShell `-Encoded...
• 198c10c chore: replace app-builder-bin node-dep-tree and rebuild-node-modules (#9...
• 8f0621b fix(mac): skip signing when no certificate found; warn on ad-hoc + hardenedRu...
• e236392 chore(deploy): Release v26.14.0 (#9812)
• 0e67339 fix(builder-util): add timeout to spawnAndWriteWithOutput (#9820)
• 370bd75 fix(dynamic-import): resolve module paths via CJS resolver for reliable subpa...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	app-builder-lib@​26.15.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm es-abstract is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/eslint-plugin-matrix-org@3.0.0 → npm/es-abstract@1.24.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/app-builder-lib@26.15.0 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report