electron-builder packages with wrong electron binary version

• Version: 20.44.1

• Target: mac / snap / nsis/ appx …

I have electron@5.0.4 installed but when I package, electron-builder downloads electron@5.0.0 which is not the version I developed and tested with. This may lead to very unfortunate bugs/incompatibilities.

Details: electron-builder appears to rely on the electron version provided in package.json and ignores installed/locked versions. A version string like ^5.0.0 can be understood as 5.0.0 >= allowed versions > 6.0.0.

Example While version 5 is specified in package.json

"dependencies": {
    "electron": "^5",
    "electron-builder": "20.44.1"
}

The package manager may/will choose to install more recent packages: yarn.lock

electron@5:
  version "5.0.4"
  resolved "https://registry.yarnpkg.com/electron/-/electron-5.0.4.tgz#2e0d09055363e983f4a73317cde4821c39617b02"
  integrity sha512-7QaKorvANvP+azMT7wElx33oLlqw8QxmLs7/outfH7LC5amErk4EUtWDesQ6Zgr+s5pYFbykl8ZtJ4ZGXER05g==
  dependencies:
    "@types/node" "^10.12.18"
    electron-download "^4.1.0"
    extract-zip "^1.0.3"

yarn.lock or package-lock.json do reflect the actual used package versions.

The workaround is to set the specific electron version in the package.json dependencies, this is however not the way one normally uses the package manager since lock files exist. (and will most certainly interfere with greenkeeper and depandabot)

Just noticed this by accident, packaging using electron 5.0.0 and expecting 5.0.4 (since I specifically updated to 5.0.4) would have caused a lot of headaches.

[sandeep1995]

If you are trying to upgrade to Electron 7.0, make sure your dev dependencies is like the following

"devDependencies": {
    "electron": "7.0.0",
}

Notice it has to be 7.0.0 not ^7.0.0. The parser is poorly written.

[edmofro]

If using a yarn-workspaces based mono-repo and seeing “none of the possible electron modules are installed”, add the following to your package.json

"workspaces": {
    "nohoist": [
      "electron"
    ]
  }

This forces yarn to keep electron in the package node_modules rather than hoisting it up to the root (where electron-builder doesn’t seem to spot it)