8000 Auto-updater downloads but never installs on Windows — app stays on old version · Issue #96 · amirlehmam/wmux · GitHub
[go: up one dir, main page]

Skip to content

Auto-updater downloads but never installs on Windows — app stays on old version #96

Closed

Description

@Rajveerx11

I am facing this issue myself on Windows 11 — my installed wmux never updates. When a new release comes out I get the update notification, click it, the app restarts, and it's still on the old version. The first update never lands and it just keeps prompting me.

After digging into it, here's what's actually going on:

The problem

On Windows the app can detect and download an update fine, but it can never install it. So it quits, relaunches the same old version, and the update badge shows up again — forever.

Why it happens

  • The Windows release only ships latest.yml + a .zip (wmux-x.y.z-win-x64.zip). There's no NSIS .exe installer or .blockmap.
  • electron-updater on Windows installs by running an NSIS installer. A zip is a macOS update mechanism, so quitAndInstall() has nothing to run and effectively no-ops. The download succeeds and the checksum verifies, which is why it looks like it's working — but nothing ever gets applied.
  • Two smaller things pile on: the update badge in the titlebar just opens the GitHub release page (it doesn't trigger the real installer), and the 3-day quarantine window in updater.ts often blocks fresh releases from even downloading since releases ship more than once a day.

How I'd like to fix it

  • Switch the Windows build target to nsis (the nsis block already exists in electron-builder.json, it's just not referenced), build without --dir, and let electron-builder generate latest.yml + .blockmap instead of hand-writing the yaml in the release workflow.
  • Wire the in-app update badge to the real install flow (or remove the duplicate path) so clicking it actually does something.
  • Make the quarantine window a bit more sensible so updates aren't held indefinitely.

Happy to work on this if you'll assign it to me — I've already traced it end to end.

Activity

  1. amirlehmam commented on Jul 16, 2026

    @amirlehmam
    Owner

    Thanks for the excellent diagnosis — you traced it exactly right, and your fix is merged (#97) and shipped in v0.26.0.

    What changed:

    • Releases now ship wmux-X.Y.Z-setup.exe (NSIS) — the artifact electron-updater's NsisUpdater can actually run. The portable zip stays alongside it for people who prefer extract-and-run.
    • latest.yml now points at the installer and is generated after signing, gated on a chain-trusted signature.

    On your two smaller points:

    • Update badge opens the GitHub page: that's the notify-only fallback path (it also covers releases without latest.yml). The real install flow is separate — once an update downloads, you get an explicit install-and-restart dialog. Keeping both for now.
    • 3-day quarantine: intentional (see Security: harden the auto-update channel (no authenticity, no quarantine window) #29) — it's a supply-chain control so a malicious release can be yanked before clients adopt it, using GitHub's server-side published_at. It's configurable via WMUX_MIN_RELEASE_AGE_DAYS if it gets in your way locally.

    One caveat: the SignPath OSS certificate is currently unavailable (#71), so v0.26.0 ships unsigned and latest.yml is deliberately withheld — electron-updater refuses installers without a chain-valid signature, which would have recreated this exact bug. So clients on ≤0.25.0 need one manual download of v0.26.0; auto-update turns on automatically once releases are signed again.

  2. added 2 commits that reference this issue on Aug 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      0