Patch version as pre-release

[AxelMolina1]

Please, don't use patch versions for pre-release, most of repos are using "^" to auto update to latest patch version which switch to your pre-release versions.

We've been having issues with your pre-release versions (impossible to deploy on macOS since >26.0.12, signing step last forever) and it can be hard to track the breaking changes when it's just a patch version introducing bugs.

Thanks for listening to my demand.

[mmaietta]

impossible to deploy on macOS since >26.0.12, signing step last forever

Can you elaborate on this further? This seems worthwhile to investigate.

most of repos are using "^" to auto update to latest patch version which switch to your pre-release versions

Then don't? Pinning dependencies explicitly is, by default, the best approach from both a security and stability perspective.

More importantly, my main concern is regarding oversight of this project. What breaking changes have been introduced in a patch version?

[AxelMolina1]

Then don't? Pinning dependencies explicitly is, by default, the best approach from both a security and stability perspective.

Thank you for the advice, we'll do that now on.

Can you elaborate on this further? This seems worthwhile to investigate.

On version >26.0.12, when we deploy on macOS, when it is at "signing" step, it is usually long because it's doing the notarization on the same step. But since this version, it stays on this step forever (the longer we tried was 1 hour). I checked on Apple side and it seems the request for notarization didn't come to them so it must be a problem before that.

[mmaietta]

Can you try setting notarize: false in the config? Curious as to whether something changed because mac signing+notarize logic hasn't changed in quite some time IIRC. We also use electron/notarize npm package, I'll need to check if there was an update to that package.

[jtbandes]

Jumping in to add/ask: are the newer patch versions (e.g. 26.0.13 – 26.0.20) meant to be stable or not? I see the "pre-release" label on https://github.com/electron-userland/electron-builder/releases, and I see that latest still points to 26.0.12 on https://www.npmjs.com/package/electron-builder/v/22.11.1?activeTab=versions, however the fact that it's a patch release would seem to indicate it should be safe to upgrade to (which is why we use ^ dependencies, which causes yarn upgrade-interactive to offer to upgrade to 26.0.20). So I'm a bit unclear on whether the "pre-release" label is intentional/meaningful or not. What differentiates the pre-releases from the non-pre-releases?

[AxelMolina1]

Can you try setting notarize: false in the config? Curious as to whether something changed because mac signing+notarize logic hasn't changed in quite some time IIRC. We also use electron/notarize npm package, I'll need to check if there was an update to that package.

@mmaietta I tried and it didn't change anything, here are the logs :

App • WAIT • Bundling app with electron/builder...
• electron-builder version=26.1.0 os=24.6.0
• artifacts will be published if draft release exists reason=CI detected
• executing @electron/rebuild electronVersion=37.5.0 arch=x64 buildFromSource=false appDir=dist/electron/UnPackaged
• installing native dependencies arch=x64
• preparing moduleName=sqlite3 arch=x64
• finished moduleName=sqlite3 arch=x64
• preparing moduleName=sqlite3 arch=x64
• finished moduleName=sqlite3 arch=x64
• completed installing native dependencies
• packaging platform=darwin arch=x64 electron=37.5.0 appOutDir=dist/electron/Packaged/mac-universal-x64-temp
• downloading url=https://github.com/electron/electron/releases/download/v37.5.0/electron-v37.5.0-darwin-x64.zip size=115 MB parts=6
• downloaded url=https://github.com/electron/electron/releases/download/v37.5.0/electron-v37.5.0-darwin-x64.zip duration=1.49s
<-------- Took longer than expected here, ~2min -------->
• executing @electron/rebuild electronVersion=37.5.0 arch=arm64 buildFromSource=false appDir=dist/electron/UnPackaged
• installing native dependencies arch=arm64
• preparing moduleName=sqlite3 arch=arm64
• finished moduleName=sqlite3 arch=arm64
• preparing moduleName=sqlite3 arch=arm64
• finished moduleName=sqlite3 arch=arm64
• completed installing native dependencies
• packaging platform=darwin arch=arm64 electron=37.5.0 appOutDir=dist/electron/Packaged/mac-universal-arm64-temp
• downloading url=https://github.com/electron/electron/releases/download/v37.5.0/electron-v37.5.0-darwin-arm64.zip size=111 MB parts=6
• downloaded url=https://github.com/electron/electron/releases/download/v37.5.0/electron-v37.5.0-darwin-arm64.zip duration=1.221s
<-------- Took longer than expected here, ~2min -------->
• packaging platform=darwin arch=universal electron=37.5.0 appOutDir=dist/electron/Packaged/mac-universal
• signing file=dist/electron/Packaged/mac-universal/***.app platform=darwin type=distribution identityName=***** identityHash=***** provisioningProfile=none
<-------- Stuck here, with or without notarize -------->

[DCzajkowski]

We are experiencing a problem with rebuilding deps on 26.0.13, but 26.0.12 works correctly.

We were upgrading our packages and set electron-builder to ^26.0.0, which auto-resolved to 26.1.0. However, now we see it is marked with next tag on npm. Versions >26.0.12 are not under latest tag and are marked as pre-release on GitHub.

Which versions are meant to be stable?

[mmaietta]

latest is considered most stable next is an intermediary stage as part of the rollout to stable. I use it to prevent a blanket update by all auto-merging dependabot PRs. -alpha tags are the bleeding-edge changes and considered unstable

I typically promote to latest when there's a critical fix that needs to be rolled out, or I see enough adoption increase on next tag compared to the current latest tag version based on: https://www.npmjs.com/package/electron-builder?activeTab=versions

[mmaietta]

We are experiencing a problem with rebuilding deps on 26.0.13, but 26.0.12 works correctly.

Re: this. Can you please open a GH Issue with DEBUG=electron-builder env var set for more logs. Would like to understand what is happening as there was an update to the electron/rebuild version to 3.7.2, but I'd like to dive deeper first. https://github.com/electron-userland/electron-builder/compare/v26.0.12...v26.0.13