fix(release): take the electron-builder keychain-password fix

[Juliusolsson05]

Problem

The first macOS release run with signing secrets configured, 35282765891 on 1a1410ac, failed in Package macOS artifacts before anything was signed:

⨯ /usr/bin/security process failed 1
Command failed: /usr/bin/security set-key-partition-list -S apple-tool:,apple: -s -k *** <tmp>.keychain
security: SecKeychainUnlock: The user name or passphrase you entered is not correct.

The preceding security import … -P <cert password> succeeded, so the configured CSC_KEY_PASSWORD is correct.

Fixes #989

Cause

app-builder-lib@26.15.3, out/codeSign/macCodeSign.js:

• createKeychain() creates the temporary keychain with a random password (randomBytes(32)), then create-keychain -p <keychainPassword>.
• importCerts() imports with the certificate password (correct), then runs set-key-partition-list … -k <certificate password> — but that flag takes the keychain password. The two can never match, so every CSC_LINK-based signing run fails.

Upstream: electron-userland/electron-builder#10066, fixed by #10101, backported in #10172.

Verified by unpacking each published tarball and reading the same line:

app-builder-lib	set-key-partition-list … -k
26.15.3 (before)	password (certificate password)
26.15.7	password
26.16.0	password
26.16.1 (this PR)	keychainPassword

Change

Lockfile plus one range. electron-builder 26.15.3 → 26.16.1, with app-builder-lib, dmg-builder, electron-publish, builder-util and dev-only transitive dependencies following. All of it is devDependencies, so nothing here ships inside the app.

The declared range moves ^26.15.3 → ^26.16.1, because latest on npm is still 26.15.3: under the old range a fresh install resolves straight back to the broken version. That is also why npm update electron-builder alone does not fix this.

npm update's rewrite would have pruned 27 unrelated entries (node_modules/vitest/node_modules/esbuild and its @esbuild/* platform packages), which main needs because vitest's vite wants esbuild ^0.27.0 || ^0.28.0 and the deduped root is 0.25.12. The lockfile is therefore rebuilt in main's key order with those entries preserved: 0 entries added, 0 removed.

Verification

• npm audit --omit=dev --audit-level=high --package-lock-only exits 0.
• npm ls --package-lock-only --all reports exactly the same two pre-existing problem lines as main — no new inconsistencies.
• Lockfile diff contains no entry additions or removals.
• A release.yml run on this branch with publish_release=false is dispatched to exercise sign → notarize → staple → verify. Its result will be added here.

Note on the earlier run

That run also showed APPLE_ID and APPLE_APP_SPECIFIC_PASSWORD arriving empty in package-macos, despite being added to the repo six minutes before that job started. GitHub resolves secrets when the run starts, not when each job starts, so secrets added mid-run never reach later jobs. Any run must be dispatched after the secrets exist.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MpFfu5xMd77Y2sNUeytvCG