[dependabot]

Bumps tar to 7.5.22 and updates ancestor dependencies tar, @electron-forge/cli, @electron-forge/maker-squirrel, @electron-forge/maker-zip, @electron-forge/plugin-auto-unpack-natives, @electron-forge/plugin-fuses and @electron-forge/plugin-vite. These dependencies need to be updated together.

Updates tar from 6.2.1 to 7.5.22

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @electron-forge/cli from 7.11.1 to 8.0.1

Release notes

Sourced from @​electron-forge/cli's releases.

v8.0.1

Electron Forge 8

It’s time for a new major version! Forge is now ESM-only on Node.js 22, the Vite plugin is out of experimental, create-electron-app owns project scaffolding, and Forge installs with far fewer dependencies.

Read the Breaking changes section before upgrading.

Highlights

• ESM and Node.js 22. Every @electron-forge/* package is ESM-only and requires Node.js 22.17 or newer. Existing Forge configurations keep working in CommonJS or ESM projects. (#4059)
• The Vite plugin is promoted to stable. @electron-forge/plugin-vite is no longer experimental and is covered by semver. It now targets Vite 8, builds each target in an isolated process, supports opt-in main-process hot restart (hotRestart: true) and honours a custom server.host. (#4382, #4167, #4163, #4226, #4346, #4363)
• electron-forge publish is now electron-forge release to avoid conflict with the npm publish command. make always saves its results, so release --from-make can publish artifacts built by an earlier make, for example on another CI job. publish still works as a deprecated alias. (#4305, #4395)
• One template per bundler. create-electron-app --template vite --typescript replaces the separate *-typescript templates. New projects use oxlint and oxfmt, moduleResolution: bundler and a release script, and init gains --package-manager and --electron-version flags. (#4229, #4186, #4175, #4107, #4037)
• webpack output in your terminal. The webpack plugin renders compiler output as tabs in the terminal instead of a browser logger on port 9000. (#4389)
• Lighter install. got, fs-extra, fast-glob, find-up, chalk, lodash, rechoir and others were replaced with Node.js built-ins. (#4189, #4250, #4227, #4248, #4245, #4066)
• Makers and publishers. PKG notarization (#4234), MSIX outputFileName (#4295), typed copyright for deb and rpm (#4298), byte-level GitHub upload progress (#4304), and the artifact version in S3 and GCS keyResolver (#4033).

Breaking changes

Everyone

• Node.js 22.17.0 or newer is required (was 16.4.0). (#4059)
• All packages are ESM-only. The CLI needs no changes. If you call the programmatic API with require('@electron-forge/core'), that relies on Node's require(esm); switch to import to be safe. (#4059)
• Custom makers, publishers, plugins and string packagerConfig hooks must have a default export (export default or module.exports =). (#4059)
• Config templating was removed. Strings in your config are no longer rendered as lodash templates (${version}, ${year}, other package.json fields), and require:./path strings are no longer resolved. Use JavaScript in forge.config.* instead. (#4066)
• Only forge.config.{js,mjs,cjs,ts,mts,cts} are loaded. Config files in other languages (CoffeeScript, Babel-registered files, etc.) are no longer supported through rechoir. (#4066)
• init and import moved to create-electron-app. Use npx create-electron-app@latest my-app and npx create-electron-app@latest import. The electron-forge init and electron-forge import commands, and their core API functions, were removed. Importing Forge 5 projects (#4083) and loading globally installed templates (#4065) are no longer supported. (#4148)
• init no longer guesses your package manager. It asks when run interactively and uses npm otherwise. Pass --package-manager pnpm, yarn or an exact version such as yarn@1.22.22 in scripts and CI. (#4107)
• Deprecated, still working: publish → release, make --skip-package → --from-package, release --from-dry-run → --from-make, release --dry-run → make. Dry runs saved by Forge 7 cannot be resumed; run make again with Forge 8. (#4305, #4395)
• Plugins are initialized once per command. make and release no longer re-resolve the config for their nested steps, so init() and resolveForgeConfig run once. (#4394)

Vite and webpack plugins

• Main and preload bundles are emitted as .cjs. Both plugins stop with an error explaining the fix if your project still uses the old paths. (#4393)
  • Vite: set "main": ".vite/build/main.cjs" and load preloads with path.join(__dirname, 'preload.cjs').
  • webpack: set "main": ".webpack/main/index.cjs".
• The Vite plugin targets Vite 8. Upgrade vite to 8.x and port custom Rollup options to Vite 8. (#4167)
• The webpack loggerPort option was removed along with @electron-forge/web-multi-logger. In the terminal UI, press r to restart the app. (#4389)
• webpack-dev-server 5. Custom devServer options must follow the v5 API. (#4308)

Makers

• DMG output moved to out/make/dmg/<arch>/ (#4275) and PKG output moved to out/make/pkg/<arch>/ (#4383). Update any CI globs that upload from out/make/.
• @electron-forge/maker-appx is deprecated and now builds .msix through electron-windows-msix. Several Desktop App Converter options are ignored with a warning, no development certificate is generated when devCert is unset, and a publisher is required. Move to @electron-forge/maker-msix. (#4392)
• maker-deb rejects unsupported architectures, including arm (armel). Supported: ia32, x64, arm64, armv7l, mips64el. (#4059)
• maker-wix only builds x64, ia64 and x86. (#3859)
• maker-deb and maker-rpm use electron-installer-debian and electron-installer-redhat v4. (#4379)
• Type renames: MakerFlatpakOptionsConfig is now MakerFlatpakConfigOptions, and maker-dmg no longer re-exports the electron-installer-dmg option types. (#4321)

Publishers

... (truncated)

Changelog

Sourced from @​electron-forge/cli's changelog.

Changelog

The changelog for subsequent updates is available for each release independently on this repo's GitHub Releases page. This document is preserved for historical purposes.

6.0.2 (2022-11-14)

6.0.1 (2022-11-08)

6.0.0 (2022-11-02)

6.0.0-beta.75 (2022-11-01)

New Features

• move create-electron-app into forge (#2988) (a2eadbcb)

6.0.0-beta.74 (2022-11-01)

Bug Fixes

• do not proxify class instances in forge config (#3039) (a89ed7d3)

Other Changes

• add proper package test for webpack ts template (#3040) (6e9cca35)

6.0.0-beta.73 (2022-11-01)

Bug Fixes

• ensure webpack typescript template runs (#3038) (e1d5db00)

6.0.0-beta.72 (2022-10-31)

6.0.0-beta.71 (2022-10-31)

Bug Fixes

• packager: "packaging application" log never stops when building for multiple architectures (#3006) (247f52ab)
• publish: ignore unnecessary files when publishing to npm (#3024) (ab8ea661)
• template-base: use minimum instead of exact version when replacing ELECTRON_FORGE/VERSION in templates (#3030) (7aaa7029)
• use @​electron-forge/cli hint for project resolution (#3023) (b5d05874)
• restore isProd in the webpack plugin (#3021) (531788ba)

6.0.0-beta.70 (2022-10-28)

Bug Fixes

... (truncated)

Commits

• 48f38bb chore: bump version to 8.0.1 (#4426)
• 40b4adf chore: bump version to 8.0.0 (#4425)
• 2868de8 refactor(maker-appx)!: reimplement as a legacy wrapper over the MSIX maker (#...
• d7c592c docs: add AGENTS.md guidance for AI coding agents (#4416)
• 5023ae1 build(deps): upgrade Electron to 44.4.3 (#4410)
• 1d268aa build(deps): bump vulnerable transitive and direct dependencies (#4408)
• c7bae14 fix(template): typecheck root-level config files (#4407)
• 198d934 fix(template-vite): use .mts for Vite configs in the TypeScript variant (#4406)
• e0fb4d4 build: bump @​electron/lint-roller to ^4.0.0 (#4404)
• 7b2f0e8 feat!: replace release --from-dry-run with --from-make, and `make --skip-...
• Additional commits viewable in compare view

Updates @electron-forge/maker-squirrel from 7.11.1 to 8.0.1

Release notes

Sourced from @​electron-forge/maker-squirrel's releases.

v8.0.1

Electron Forge 8

It’s time for a new major version! Forge is now ESM-only on Node.js 22, the Vite plugin is out of experimental, create-electron-app owns project scaffolding, and Forge installs with far fewer dependencies.

Read the Breaking changes section before upgrading.

Highlights

• ESM and Node.js 22. Every @electron-forge/* package is ESM-only and requires Node.js 22.17 or newer. Existing Forge configurations keep working in CommonJS or ESM projects. (#4059)
• The Vite plugin is promoted to stable. @electron-forge/plugin-vite is no longer experimental and is covered by semver. It now targets Vite 8, builds each target in an isolated process, supports opt-in main-process hot restart (hotRestart: true) and honours a custom server.host. (#4382, #4167, #4163, #4226, #4346, #4363)
• electron-forge publish is now electron-forge release to avoid conflict with the npm publish command. make always saves its results, so release --from-make can publish artifacts built by an earlier make, for example on another CI job. publish still works as a deprecated alias. (#4305, #4395)
• One template per bundler. create-electron-app --template vite --typescript replaces the separate *-typescript templates. New projects use oxlint and oxfmt, moduleResolution: bundler and a release script, and init gains --package-manager and --electron-version flags. (#4229, #4186, #4175, #4107, #4037)
• webpack output in your terminal. The webpack plugin renders compiler output as tabs in the terminal instead of a browser logger on port 9000. (#4389)
• Lighter install. got, fs-extra, fast-glob, find-up, chalk, lodash, rechoir and others were replaced with Node.js built-ins. (#4189, #4250, #4227, #4248, #4245, #4066)
• Makers and publishers. PKG notarization (#4234), MSIX outputFileName (#4295), typed copyright for deb and rpm (#4298), byte-level GitHub upload progress (#4304), and the artifact version in S3 and GCS keyResolver (#4033).

Breaking changes

Everyone

• Node.js 22.17.0 or newer is required (was 16.4.0). (#4059)
• All packages are ESM-only. The CLI needs no changes. If you call the programmatic API with require('@electron-forge/core'), that relies on Node's require(esm); switch to import to be safe. (#4059)
• Custom makers, publishers, plugins and string packagerConfig hooks must have a default export (export default or module.exports =). (#4059)
• Config templating was removed. Strings in your config are no longer rendered as lodash templates (${version}, ${year}, other package.json fields), and require:./path strings are no longer resolved. Use JavaScript in forge.config.* instead. (#4066)
• Only forge.config.{js,mjs,cjs,ts,mts,cts} are loaded. Config files in other languages (CoffeeScript, Babel-registered files, etc.) are no longer supported through rechoir. (#4066)
• init and import moved to create-electron-app. Use npx create-electron-app@latest my-app and npx create-electron-app@latest import. The electron-forge init and electron-forge import commands, and their core API functions, were removed. Importing Forge 5 projects (#4083) and loading globally installed templates (#4065) are no longer supported. (#4148)
• init no longer guesses your package manager. It asks when run interactively and uses npm otherwise. Pass --package-manager pnpm, yarn or an exact version such as yarn@1.22.22 in scripts and CI. (#4107)
• Deprecated, still working: publish → release, make --skip-package → --from-package, release --from-dry-run → --from-make, release --dry-run → make. Dry runs saved by Forge 7 cannot be resumed; run make again with Forge 8. (#4305, #4395)
• Plugins are initialized once per command. make and release no longer re-resolve the config for their nested steps, so init() and resolveForgeConfig run once. (#4394)

Vite and webpack plugins

• Main and preload bundles are emitted as .cjs. Both plugins stop with an error explaining the fix if your project still uses the old paths. (#4393)
  • Vite: set "main": ".vite/build/main.cjs" and load preloads with path.join(__dirname, 'preload.cjs').
  • webpack: set "main": ".webpack/main/index.cjs".
• The Vite plugin targets Vite 8. Upgrade vite to 8.x and port custom Rollup options to Vite 8. (#4167)
• The webpack loggerPort option was removed along with @electron-forge/web-multi-logger. In the terminal UI, press r to restart the app. (#4389)
• webpack-dev-server 5. Custom devServer options must follow the v5 API. (#4308)

Makers

• DMG output moved to out/make/dmg/<arch>/ (#4275) and PKG output moved to out/make/pkg/<arch>/ (#4383). Update any CI globs that upload from out/make/.
• @electron-forge/maker-appx is deprecated and now builds .msix through electron-windows-msix. Several Desktop App Converter options are ignored with a warning, no development certificate is generated when devCert is unset, and a publisher is required. Move to @electron-forge/maker-msix. (#4392)
• maker-deb rejects unsupported architectures, including arm (armel). Supported: ia32, x64, arm64, armv7l, mips64el. (#4059)
• maker-wix only builds x64, ia64 and x86. (#3859)
• maker-deb and maker-rpm use electron-installer-debian and electron-installer-redhat v4. (#4379)
• Type renames: MakerFlatpakOptionsConfig is now MakerFlatpakConfigOptions, and maker-dmg no longer re-exports the electron-installer-dmg option types. (#4321)

Publishers

... (truncated)

Changelog

Sourced from @​electron-forge/maker-squirrel's changelog.

Changelog

The changelog for subsequent updates is available for each release independently on this repo's GitHub Releases page. This document is preserved for historical purposes.

6.0.2 (2022-11-14)

6.0.1 (2022-11-08)

6.0.0 (2022-11-02)

6.0.0-beta.75 (2022-11-01)

New Features

• move create-electron-app into forge (#2988) (a2eadbcb)

6.0.0-beta.74 (2022-11-01)

Bug Fixes

• do not proxify class instances in forge config (#3039) (a89ed7d3)

Other Changes

• add proper package test for webpack ts template (#3040) (6e9cca35)

6.0.0-beta.73 (2022-11-01)

Bug Fixes

• ensure webpack typescript template runs (#3038) (e1d5db00)

6.0.0-beta.72 (2022-10-31)

6.0.0-beta.71 (2022-10-31)

Bug Fixes

• packager: "packaging application" log never stops when building for multiple architectures (#3006) (247f52ab)
• publish: ignore unnecessary files when publishing to npm (#3024) (ab8ea661)
• template-base: use minimum instead of exact version when replacing ELECTRON_FORGE/VERSION in templates (#3030) (7aaa7029)
• use @​electron-forge/cli hint for project resolution (#3023) (b5d05874)
• restore isProd in the webpack plugin (#3021) (531788ba)

6.0.0-beta.70 (2022-10-28)

Bug Fixes

... (truncated)

Commits

• 48f38bb chore: bump version to 8.0.1 (#4426)
• 40b4adf chore: bump version to 8.0.0 (#4425)
• 2868de8 refactor(maker-appx)!: reimplement as a legacy wrapper over the MSIX maker (#...
• d7c592c docs: add AGENTS.md guidance for AI coding agents (#4416)
• 5023ae1 build(deps): upgrade Electron to 44.4.3 (#4410)
• 1d268aa build(deps): bump vulnerable transitive and direct dependencies (#4408)
• c7bae14 fix(template): typecheck root-level config files (#4407)
• 198d934 fix(template-vite): use .mts for Vite configs in the TypeScript variant (#4406)
• e0fb4d4 build: bump @​electron/lint-roller to ^4.0.0 (#4404)
• 7b2f0e8 feat!: replace release --from-dry-run with --from-make, and `make --skip-...
• Additional commits viewable in compare view

Updates @electron-forge/maker-zip from 7.11.1 to 8.0.1

Release notes

Sourced from @​electron-forge/maker-zip's releases.

v8.0.1

Electron Forge 8

It’s time for a new major version! Forge is now ESM-only on Node.js 22, the Vite plugin is out of experimental, create-electron-app owns project scaffolding, and Forge installs with far fewer dependencies.

Read the Breaking changes section before upgrading.

Highlights

• ESM and Node.js 22. Every @electron-forge/* package is ESM-only and requires Node.js 22.17 or newer. Existing Forge configurations keep working in CommonJS or ESM projects. (#4059)
• The Vite plugin is promoted to stable. @electron-forge/plugin-vite is no longer experimental and is covered by semver. It now targets Vite 8, builds each target in an isolated process, supports opt-in main-process hot restart (hotRestart: true) and honours a custom server.host. (#4382, #4167, #4163, #4226, #4346, #4363)
• electron-forge publish is now electron-forge release to avoid conflict with the npm publish command. make always saves its results, so release --from-make can publish artifacts built by an earlier make, for example on another CI job. publish still works as a deprecated alias. (#4305, #4395)
• One template per bundler. create-electron-app --template vite --typescript replaces the separate *-typescript templates. New projects use oxlint and oxfmt, moduleResolution: bundler and a release script, and init gains --package-manager and --electron-version flags. (#4229, #4186, #4175, #4107, #4037)
• webpack output in your terminal. The webpack plugin renders compiler output as tabs in the terminal instead of a browser logger on port 9000. (#4389)
• Lighter install. got, fs-extra, fast-glob, find-up, chalk, lodash, rechoir and others were replaced with Node.js built-ins. (#4189, #4250, #4227, #4248, #4245, #4066)
• Makers and publishers. PKG notarization (#4234), MSIX outputFileName (#4295), typed copyright for deb and rpm (#4298), byte-level GitHub upload progress (#4304), and the artifact version in S3 and GCS keyResolver (#4033).

Breaking changes

Everyone

• Node.js 22.17.0 or newer is required (was 16.4.0). (#4059)
• All packages are ESM-only. The CLI needs no changes. If you call the programmatic API with require('@electron-forge/core'), that relies on Node's require(esm); switch to import to be safe. (#4059)
• Custom makers, publishers, plugins and string packagerConfig hooks must have a default export (export default or module.exports =). (#4059)
• Config templating was removed. Strings in your config are no longer rendered as lodash templates (${version}, ${year}, other package.json fields), and require:./path strings are no longer resolved. Use JavaScript in forge.config.* instead. (#4066)
• Only forge.config.{js,mjs,cjs,ts,mts,cts} are loaded. Config files in other languages (CoffeeScript, Babel-registered files, etc.) are no longer supported through rechoir. (#4066)
• init and import moved to create-electron-app. Use npx create-electron-app@latest my-app and npx create-electron-app@latest import. The electron-forge init and electron-forge import commands, and their core API functions, were removed. Importing Forge 5 projects (#4083) and loading globally installed templates (#4065) are no longer supported. (#4148)
• init no longer guesses your package manager. It asks when run interactively and uses npm otherwise. Pass --package-manager pnpm, yarn or an exact version such as yarn@1.22.22 in scripts and CI. (#4107)
• Deprecated, still working: publish → release, make --skip-package → --from-package, release --from-dry-run → --from-make, release --dry-run → make. Dry runs saved by Forge 7 cannot be resumed; run make again with Forge 8. (#4305, #4395)
• Plugins are initialized once per command. make and release no longer re-resolve the config for their nested steps, so init() and resolveForgeConfig run once. (#4394)

Vite and webpack plugins

• Main and preload bundles are emitted as .cjs. Both plugins stop with an error explaining the fix if your project still uses the old paths. (#4393)
  • Vite: set "main": ".vite/build/main.cjs" and load preloads with path.join(__dirname, 'preload.cjs').
  • webpack: set "main": ".webpack/main/index.cjs".
• The Vite plugin targets Vite 8. Upgrade vite to 8.x and port custom Rollup options to Vite 8. (#4167)
• The webpack loggerPort option was removed along with @electron-forge/web-multi-logger. In the terminal UI, press r to restart the app. (#4389)
• webpack-dev-server 5. Custom devServer options must follow the v5 API. (#4308)

Makers

• DMG output moved to out/make/dmg/<arch>/ (#4275) and PKG output moved to out/make/pkg/<arch>/ (#4383). Update any CI globs that upload from out/make/.
• @electron-forge/maker-appx is deprecated and now builds .msix through electron-windows-msix. Several Desktop App Converter options are ignored with a warning, no development certificate is generated when devCert is unset, and a publisher is required. Move to @electron-forge/maker-msix. (#4392)
• maker-deb rejects unsupported architectures, including arm (armel). Supported: ia32, x64, arm64, armv7l, mips64el. (#4059)
• maker-wix only builds x64, ia64 and x86. (#3859)
• maker-deb and maker-rpm use electron-installer-debian and electron-installer-redhat v4. (#4379)
• Type renames: MakerFlatpakOptionsConfig is now MakerFlatpakConfigOptions, and maker-dmg no longer re-exports the electron-installer-dmg option types. (#4321)

Publishers

... (truncated)

Changelog

Sourced from @​electron-forge/maker-zip's changelog.

Changelog

The changelog for subsequent updates is available for each release independently on this repo's GitHub Releases page. This document is preserved for historical purposes.

6.0.2 (2022-11-14)

6.0.1 (2022-11-08)

6.0.0 (2022-11-02)

6.0.0-beta.75 (2022-11-01)

New Features

• move create-electron-app into forge (#2988) (a2eadbcb)

6.0.0-beta.74 (2022-11-01)

Bug Fixes

• do not proxify class instances in forge config (#3039) (a89ed7d3)

Other Changes

• add proper package test for webpack ts template (#3040) (6e9cca35)

6.0.0-beta.73 (2022-11-01)

Bug Fixes

• ensure webpack typescript template runs (#3038) (e1d5db00)

6.0.0-beta.72 (2022-10-31)

6.0.0-beta.71 (2022-10-31)

Bug Fixes

• packager: "packaging application" log never stops when building for multiple architectures (#3006) (247f52ab)
• publish: ignore unnecessary files when publishing to npm (#3024) (ab8ea661)
• template-base: use minimum instead of exact version when replacing ELECTRON_FORGE/VERSION in templates (#3030) (7aaa7029)
• use @​electron-forge/cli hint for project resolution (#3023) (b5d05874)
• restore isProd in the webpack plugin (#3021) (531788ba)

6.0.0-beta.70 (2022-10-28)

Bug Fixes

... (truncated)

Commits

• 48f38bb chore: bump version to 8.0.1 (#4426)
• 40b4adf chore: bump version to 8.0.0 (#4425)
• 2868de8 refactor(maker-appx)!: reimplement as a legacy wrapper over the MSIX maker (#...
• d7c592c docs: add AGENTS.md guidance for AI coding agents (#4416)
• 5023ae1 build(deps): upgrade Electron to 44.4.3 (#4410)
• 1d268aa build(deps): bump vulnerable transitive and direct dependencies (#4408)
• c7bae14 fix(template): typecheck root-level config files (#4407)
• 198d934 fix(template-vite): use .mts for Vite configs in the TypeScript variant (#4406)
• e0fb4d4 build: bump @​electron/lint-roller to ^4.0.0 (#4404)
• 7b2f0e8 feat!: replace release --from-dry-run with --from-make, and `make --skip-...
• Additional commits viewable in compare view

Updates @electron-forge/plugin-auto-unpack-natives from 7.11.1 to 8.0.1

Release notes

Sourced from @​electron-forge/plugin-auto-unpack-natives's releases.

v8.0.1

Electron Forge 8

It’s time for a new major version! Forge is now ESM-only on Node.js 22, the Vite plugin is out of experimental, create-electron-app owns project scaffolding, and Forge installs with far fewer dependencies.

Read the Breaking changes section before upgrading.

Highlights

• ESM and Node.js 22. Every @electron-forge/* package is ESM-only and requires Node.js 22.17 or newer. Existing Forge configurations keep working in CommonJS or ESM projects. (#4059)
• The Vite plugin is promoted to stable. @electron-forge/plugin-vite is no longer experimental and is covered by semver. It now targets Vite 8, builds each target in an isolated process, supports opt-in main-process hot restart (hotRestart: true) and honours a custom server.host. (#4382, #4167, #4163, #4226, #4346, #4363)
• electron-forge publish is now electron-forge release to avoid conflict with the npm publish command. make always saves its results, so release --from-make can publish artifacts built by an earlier make, for example on another CI job. publish still works as a deprecated alias. (#4305, #4395)
• One template per bundler. create-electron-app --template vite --typescript replaces the separate *-typescript templates. New projects use oxlint and oxfmt, moduleResolution: bundler and a release script, and init gains --package-manager and --electron-version flags. (#4229, #4186, #4175, #4107, #4037)
• webpack output in your terminal. The webpack plugin renders compiler output as tabs in the terminal instead of a browser logger on port 9000. (#4389)
• Lighter install. got, fs-extra, fast-glob, find-up, chalk, lodash, rechoir and others were replaced with Node.js built-ins. (#4189, #4250, #4227, #4248, #4245, #4066)
• Makers and publishers. PKG notarization (#4234), MSIX outputFileName (#4295), typed copyright for deb and rpm (#4298), byte-level GitHub upload progress (#4304), and the artifact version in S3 and GCS keyResolver (#4033).

Breaking changes

Everyone

• Node.js 22.17.0 or newer is required (was 16.4.0). (#4059)
• All packages are ESM-only. The CLI needs no changes. If you call the programmatic API with require('@electron-forge/core'), that relies on Node's require(esm); switch to import to be safe. (#4059)
• Custom makers, publishers, plugins and string packagerConfig hooks must have a default export (export default or module.exports =). (#4059)
• Config templating was removed. Strings in your config are no longer rendered as lodash templates (${version}, ${year}, other package.json fields), and require:./path strings are no longer resolved. Use JavaScript in forge.config.* instead. (#4066)
• Only forge.config.{js,mjs,cjs,ts,mts,cts} are loaded. Config files in other languages (CoffeeScript, Babel-registered files, etc.) are no longer supported through rechoir. (#4066)
• init and import moved to create-electron-app. Use npx create-electron-app@latest my-app and npx create-electron-app@latest import. The electron-forge init and electron-forge import commands, and their core API functions, were removed. Importing Forge 5 projects (#4083) and loading globally installed templates (#4065) are no longer supported. (#4148)
• init no longer guesses your package manager. It asks when run interactively and uses npm otherwise. Pass --package-manager pnpm, yarn or an exact version such as yarn@1.22.22 in scripts and CI. (#4107)
• Deprecated, still working: publish → release, make --skip-package → --from-package, release --from-dry-run → --from-make, release --dry-run → make. Dry runs saved by Forge 7 cannot be resumed; run make again with Forge 8. (#4305, #4395)
• Plugins are initialized once per command. make and release no longer re-resolve the config for their nested steps, so init() and resolveForgeConfig ...

  Description has been truncated

[dbfx]

Superseded by #38, which lands this upgrade together with the config changes it needs.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.