build(deps): bump @electron/* and electron-installer-* packages

[erickzhao]

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project follows, as appropriate.
• The changes are appropriately documented (if applicable).
• The changes have sufficient test coverage (if applicable).
• The testsuite passes successfully on my local machine (if applicable).

Summarize your changes:

Upgrades every @electron/* and electron-installer-* dependency to its latest release.

New majors

• electron-installer-debian ^3.2.0 → ^4.0.0
• electron-installer-redhat ^3.2.0 → ^4.0.0

Both are now ESM-only and require Node >= 22.12, which matches Forge's own engines. Their programmatic API (default-exported async function returning { packagePaths }) is unchanged, and MakerDeb/MakerRpm already load them via dynamic import(), so no maker code changes were required for the upgrade itself.

Latest release within the current major

• @electron/packager ^20.3.0
• @electron/rebuild ^4.2.0
• @electron/get ^5.1.0
• @electron/fuses ^2.1.3
• @electron/osx-sign ^2.7.0
• @electron/notarize ^3.1.1
• @electron/lint-roller ^3.3.0
• electron-installer-common ^0.10.4

electron-installer-snap, electron-installer-dmg, and @malept/electron-installer-flatpak were already on their latest release.

Build fix: declare types: ["node"]

Bumping @electron/osx-sign exposed a latent problem. The TypeScript build only ever received @types/node through a /// <reference types="node" /> inside a transitively nested @electron/osx-sign@2.3.0 declaration file. Once that copy was deduped away, every package failed with Cannot find name 'process', because the generated tsconfigs never declared types: ["node"] and the native TypeScript 7 compiler does not auto-include @types/*. tsconfig.base.json now declares it explicitly, and tools/gen-tsconfigs.ts propagates it to every package.

maker-deb: drop fakeroot from required binaries

electron-installer-debian 4.x invokes dpkg-deb directly and no longer wraps the build in fakeroot, so the maker no longer refuses to run on machines that only have dpkg. The maker README and docs/config/makers/deb.md are updated to match.

User-facing behavior changes from the installer majors

None of these require Forge config changes, but generated Linux packages will differ:

• deb: .desktop entries gain Terminal=false and StartupWMClass. Default Depends now include libsecret-1-0 (used by Electron's safeStorage), prefer libasound2t64 | libasound2 | pulseaudio, and use gvfs / gnome-keyring instead of the removed gvfs-bin / libgnome-keyring0 package names.
• rpm: .desktop entries gain Terminal=false and StartupWMClass. Default Requires now include libsecret and (libdrm or libdrm2). Stripping is skipped when cross-building for a different architecture, and rpmbuild --target now receives <arch>-none-<platform>.

Verification

yarn install --immutable, yarn build, yarn constraints, yarn knip, yarn lint:js, and the fast vitest project (522 tests) all pass locally. Both v4 installers were smoke-tested to import correctly through the built makers.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KUdgwBibLdmA2Q58WB3KDg

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​electron-installer-common@​0.10.3 ⏵ 0.10.4			+1
	npm/​@​electron/​lint-roller@​3.1.3 ⏵ 3.3.0	+1		+1	-4
	npm/​@​electron/​get@​5.1.0
	npm/​@​electron/​rebuild@​4.0.4 ⏵ 4.2.0	+1			+4
	npm/​@​electron/​fuses@​2.1.0 ⏵ 2.1.3	+1		+1	+10
	npm/​electron-installer-redhat@​3.3.0 ⏵ 4.0.0	+1			+6
	npm/​electron-installer-debian@​3.2.0 ⏵ 4.0.0	+1		+1
	npm/​@​electron/​osx-sign@​2.3.0 ⏵ 2.7.0	+1			+3
	npm/​@​electron/​packager@​20.0.1 ⏵ 20.3.0				+6

View full report

[claude]

Code review found no issues

No high-confidence issues detected in this change.