electron-userland/electron-builder electron-updater@6.8.12

on GitHub

Patch Changes

• Fix(updater): every request of a differential download (single-range, multi-range and reading the embedded block map) follows redirects itself: credential headers such as Authorization, PRIVATE-TOKEN, X-Api-Key and Cookie are sent to a redirect target only on the same origin, each multi-range request starts at the update URL, at most 10 redirects are followed per request, and an invalid redirect URL fails the download instead of leaving it waiting #10447 99e0dc5 @claude
• Fix(updater): differential downloads made with single range requests no longer send credential headers such as Authorization to a redirect target on another origin, which made pre-signed S3 or R2 URLs reject the range requests and forced a full download #10427 a1a74b1 @claude
• Fix: stop following redirects after 10 hops on the Electron path, matching the Node path #10452 d80fc04 @claude
• Fix(nsis): don't plan a differential download against a cached block map of another release. The cached block map is replaced when a download finishes, but the cached installer only when the update is installed, so a release found before the previous one was installed was planned against the wrong base: every differential byte was downloaded, the sha512 check failed, and the full installer was downloaded too. A cached block map that does not end at the cached installer's size is now ignored and the installed version's block map is fetched from the server. #10338 6f2dd83 @imlucas
• Fix: reject update download redirects to non-HTTP(S) URLs instead of throwing an uncaught exception #10450 1c5002e @claude