chore(deps-dev): bump @electron-forge/maker-dmg from 7.11.2 to 8.0.1

[dependabot]

Bumps @electron-forge/maker-dmg from 7.11.2 to 8.0.1.

Release notes

Sourced from @​electron-forge/maker-dmg's releases.

v8.0.1

Electron Forge 8

It’s time for a new major version! Forge is now ESM-only on Node.js 22, the Vite plugin is out of experimental, create-electron-app owns project scaffolding, and Forge installs with far fewer dependencies.

Read the Breaking changes section before upgrading.

Highlights

• ESM and Node.js 22. Every @electron-forge/* package is ESM-only and requires Node.js 22.17 or newer. Existing Forge configurations keep working in CommonJS or ESM projects. (#4059)
• The Vite plugin is promoted to stable. @electron-forge/plugin-vite is no longer experimental and is covered by semver. It now targets Vite 8, builds each target in an isolated process, supports opt-in main-process hot restart (hotRestart: true) and honours a custom server.host. (#4382, #4167, #4163, #4226, #4346, #4363)
• electron-forge publish is now electron-forge release to avoid conflict with the npm publish command. make always saves its results, so release --from-make can publish artifacts built by an earlier make, for example on another CI job. publish still works as a deprecated alias. (#4305, #4395)
• One template per bundler. create-electron-app --template vite --typescript replaces the separate *-typescript templates. New projects use oxlint and oxfmt, moduleResolution: bundler and a release script, and init gains --package-manager and --electron-version flags. (#4229, #4186, #4175, #4107, #4037)
• webpack output in your terminal. The webpack plugin renders compiler output as tabs in the terminal instead of a browser logger on port 9000. (#4389)
• Lighter install. got, fs-extra, fast-glob, find-up, chalk, lodash, rechoir and others were replaced with Node.js built-ins. (#4189, #4250, #4227, #4248, #4245, #4066)
• Makers and publishers. PKG notarization (#4234), MSIX outputFileName (#4295), typed copyright for deb and rpm (#4298), byte-level GitHub upload progress (#4304), and the artifact version in S3 and GCS keyResolver (#4033).

Breaking changes

Everyone

• Node.js 22.17.0 or newer is required (was 16.4.0). (#4059)
• All packages are ESM-only. The CLI needs no changes. If you call the programmatic API with require('@electron-forge/core'), that relies on Node's require(esm); switch to import to be safe. (#4059)
• Custom makers, publishers, plugins and string packagerConfig hooks must have a default export (export default or module.exports =). (#4059)
• Config templating was removed. Strings in your config are no longer rendered as lodash templates (${version}, ${year}, other package.json fields), and require:./path strings are no longer resolved. Use JavaScript in forge.config.* instead. (#4066)
• Only forge.config.{js,mjs,cjs,ts,mts,cts} are loaded. Config files in other languages (CoffeeScript, Babel-registered files, etc.) are no longer supported through rechoir. (#4066)
• init and import moved to create-electron-app. Use npx create-electron-app@latest my-app and npx create-electron-app@latest import. The electron-forge init and electron-forge import commands, and their core API functions, were removed. Importing Forge 5 projects (#4083) and loading globally installed templates (#4065) are no longer supported. (#4148)
• init no longer guesses your package manager. It asks when run interactively and uses npm otherwise. Pass --package-manager pnpm, yarn or an exact version such as yarn@1.22.22 in scripts and CI. (#4107)
• Deprecated, still working: publish → release, make --skip-package → --from-package, release --from-dry-run → --from-make, release --dry-run → make. Dry runs saved by Forge 7 cannot be resumed; run make again with Forge 8. (#4305, #4395)
• Plugins are initialized once per command. make and release no longer re-resolve the config for their nested steps, so init() and resolveForgeConfig run once. (#4394)

Vite and webpack plugins

• Main and preload bundles are emitted as .cjs. Both plugins stop with an error explaining the fix if your project still uses the old paths. (#4393)
  • Vite: set "main": ".vite/build/main.cjs" and load preloads with path.join(__dirname, 'preload.cjs').
  • webpack: set "main": ".webpack/main/index.cjs".
• The Vite plugin targets Vite 8. Upgrade vite to 8.x and port custom Rollup options to Vite 8. (#4167)
• The webpack loggerPort option was removed along with @electron-forge/web-multi-logger. In the terminal UI, press r to restart the app. (#4389)
• webpack-dev-server 5. Custom devServer options must follow the v5 API. (#4308)

Makers

• DMG output moved to out/make/dmg/<arch>/ (#4275) and PKG output moved to out/make/pkg/<arch>/ (#4383). Update any CI globs that upload from out/make/.
• @electron-forge/maker-appx is deprecated and now builds .msix through electron-windows-msix. Several Desktop App Converter options are ignored with a warning, no development certificate is generated when devCert is unset, and a publisher is required. Move to @electron-forge/maker-msix. (#4392)
• maker-deb rejects unsupported architectures, including arm (armel). Supported: ia32, x64, arm64, armv7l, mips64el. (#4059)
• maker-wix only builds x64, ia64 and x86. (#3859)
• maker-deb and maker-rpm use electron-installer-debian and electron-installer-redhat v4. (#4379)
• Type renames: MakerFlatpakOptionsConfig is now MakerFlatpakConfigOptions, and maker-dmg no longer re-exports the electron-installer-dmg option types. (#4321)

Publishers

... (truncated)

Changelog

Sourced from @​electron-forge/maker-dmg's changelog.

Changelog

The changelog for subsequent updates is available for each release independently on this repo's GitHub Releases page. This document is preserved for historical purposes.

6.0.2 (2022-11-14)

6.0.1 (2022-11-08)

6.0.0 (2022-11-02)

6.0.0-beta.75 (2022-11-01)

New Features

• move create-electron-app into forge (#2988) (a2eadbcb)

6.0.0-beta.74 (2022-11-01)

Bug Fixes

• do not proxify class instances in forge config (#3039) (a89ed7d3)

Other Changes

• add proper package test for webpack ts template (#3040) (6e9cca35)

6.0.0-beta.73 (2022-11-01)

Bug Fixes

• ensure webpack typescript template runs (#3038) (e1d5db00)

6.0.0-beta.72 (2022-10-31)

6.0.0-beta.71 (2022-10-31)

Bug Fixes

• packager: "packaging application" log never stops when building for multiple architectures (#3006) (247f52ab)
• publish: ignore unnecessary files when publishing to npm (#3024) (ab8ea661)
• template-base: use minimum instead of exact version when replacing ELECTRON_FORGE/VERSION in templates (#3030) (7aaa7029)
• use @​electron-forge/cli hint for project resolution (#3023) (b5d05874)
• restore isProd in the webpack plugin (#3021) (531788ba)

6.0.0-beta.70 (2022-10-28)

Bug Fixes

... (truncated)

Commits

• 48f38bb chore: bump version to 8.0.1 (#4426)
• 40b4adf chore: bump version to 8.0.0 (#4425)
• 2868de8 refactor(maker-appx)!: reimplement as a legacy wrapper over the MSIX maker (#...
• d7c592c docs: add AGENTS.md guidance for AI coding agents (#4416)
• 5023ae1 build(deps): upgrade Electron to 44.4.3 (#4410)
• 1d268aa build(deps): bump vulnerable transitive and direct dependencies (#4408)
• c7bae14 fix(template): typecheck root-level config files (#4407)
• 198d934 fix(template-vite): use .mts for Vite configs in the TypeScript variant (#4406)
• e0fb4d4 build: bump @​electron/lint-roller to ^4.0.0 (#4404)
• 7b2f0e8 feat!: replace release --from-dry-run with --from-make, and `make --skip-...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Major bump on a release-time packaging tool with mixed Forge 7/8 versions and a higher Node requirement; DMG output path changes could break release automation if anything assumes the old directory layout.

Overview
Upgrades the desktop app’s macOS DMG maker from 7.11.2 to 8.0.1 in apps/desktop/package.json, with matching package-lock.json updates (including nested Forge 8 packages).

@electron-forge/cli, maker-zip, and plugin-fuses stay on 7.11.2, so only the DMG maker moves to Forge 8. Forge 8’s maker-dmg expects Node ≥ 22.13 and can emit DMGs under out/make/dmg/<arch>/ instead of the older layout—worth confirming macOS packaging/CI Node versions and any scripts that glob artifact paths (distribution logic consumes paths returned from forge.make, not fixed globs in-repo).

^{Reviewed by Cursor Bugbot for commit 4ae9ae7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4ae9ae7. Configure here.}

[cursor]

Incompatible Electron Forge major versions

High Severity

@electron-forge/maker-dmg is now 8.0.1 while @electron-forge/cli, @electron-forge/maker-zip, and @electron-forge/plugin-fuses remain 7.11.2. Forge 8 makers are ESM-only and pair with maker-base 8, so Forge 7 forge.make() cannot load or run this maker. make:desktop will fail and the signed DMG release path will not produce artifacts.

Additional Locations (1)

• package-lock.json#L48-L52

 

^{Reviewed by Cursor Bugbot for commit 4ae9ae7. Configure here.}