fix(build): pin app-builder-lib minimatch to restore mac releases

[arnestrickmann]

Summary

Pin app-builder-lib to minimatch@10.1.2 via pnpm overrides.

This fixes the mac release packaging regression introduced after the broader minimatch security override update, where electron-builder produced an app.asar without the dist/ output and then failed with:

Application entry file "dist/main/main/entry.js" ... was not found in this archive

Root cause

The v0.4.28 dependency update forced newer minimatch versions across the tree. With a fresh install, app-builder-lib resolved a newer minimatch version and stopped packaging dist/**/* into app.asar during mac builds.

Changes

• Add a targeted pnpm override for app-builder-lib>minimatch to 10.1.2
• Update pnpm-lock.yaml accordingly

Verification

Reproduced the failure locally, then verified the fix by rerunning:

pnpm exec electron-builder --mac dmg --x64 --publish never --config.npmRebuild=false

Result:

• Packaging completed successfully
• dist/main/main/entry.js was present inside the packaged app.asar

Notes

This keeps the broader minimatch security overrides in place and only pins the Electron Builder path back to the last known working version.

[vercel]

@arnestrickmann is attempting to deploy a commit to the General Action Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Greptile Summary

This PR adds a targeted pnpm path override (app-builder-lib>minimatch: "10.1.2") to restore Mac release builds that were broken when app-builder-lib resolved a newer minimatch version and stopped packaging dist/**/* into app.asar. The fix is minimal, well-scoped, and leaves the broader security overrides for other minimatch ranges untouched.

Key points:

• The new app-builder-lib>minimatch path-specific override correctly takes precedence over the existing minimatch@10: "10.2.3" override per pnpm's resolution rules, as confirmed by both app-builder-lib snapshots in the lockfile now resolving to 10.1.2.
• minimatch@10.1.2 requires node: 20 || >=22, which is fully compatible with this project's engine constraint of >=20.0.0 <23.0.0 — no environment risk.
• The lockfile accurately captures the new package entry (integrity hash, @isaacs/brace-expansion@5.0.1 dependency) and updates both app-builder-lib snapshots to 10.1.2.
• The root cause (glob pattern behavioural difference in a newer minimatch version causing dist/**/* files to be excluded from packaging) is a well-known class of electron-builder/app-builder-lib regression.

Confidence Score: 5/5

• This PR is safe to merge — it is a minimal, targeted dependency pin with no production runtime impact.
• The change is two-line (one in package.json, one in pnpm-lock.yaml) and only affects app-builder-lib, a build-time tool. The path-specific override is consistent with pnpm semantics, doesn't conflict with the existing minimatch@10 override, and the pinned version's Node engine requirement matches the project's own constraint. The PR author also verified the fix locally end-to-end.
• No files require special attention.

Important Files Changed

Filename	Overview
package.json	Adds a targeted pnpm path override app-builder-lib>minimatch: "10.1.2" alongside the existing broad version overrides. The path-specific override correctly takes precedence over the broader minimatch@10: "10.2.3" entry per pnpm resolution rules, and minimatch@10.1.2's engine requirement (`node: 20
pnpm-lock.yaml	Lockfile correctly reflects the new override: both app-builder-lib snapshots (one previously resolved to minimatch@5.1.8, the other to minimatch@10.2.3) are now pinned to minimatch@10.1.2. The new package entry includes the correct integrity hash and the @isaacs/brace-expansion@5.0.1 dependency (the scoped predecessor to brace-expansion used starting in 10.2.x).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[pnpm install] --> B{Resolve minimatch\nfor app-builder-lib}
    B --> C[Check path-specific override\napp-builder-lib gt minimatch]
    C --> D[Override found: v10.1.2\nTakes precedence]
    D --> E[minimatch v10.1.2 resolved\nfor app-builder-lib]
    E --> F[isaacs/brace-expansion v5.0.1\nas transitive dep]

    B --> G[Broad version override\nminimatch v10 to v10.2.3]
    G --> H[Superseded by path override\nNot applied to app-builder-lib]

    E --> I[electron-builder runs\napp-builder-lib uses v10.1.2]
    I --> J[dist glob patterns\nmatch correctly]
    J --> K[dist/main/main/entry.js\npackaged into app.asar]
    K --> L[Mac DMG build succeeds]

    style D fill:#22c55e,color:#fff
    style H fill:#f97316,color:#fff
    style L fill:#22c55e,color:#fff

Loading

_{Last reviewed commit: fc9460b}