Pecans

Pecans is an Electron Release Server.

Features

• Download URLs (the client chooses the platform; user-agent autodetection was removed in 2.0)
  • /download/:platform — latest build for a platform (osx_64, windows_64, windows_arm64, linux_arm64, … legacy and update.electronjs.org-style aliases like darwin, win32, mac-arm64, win32-arm64, linux-arm64 are accepted; on bare-os requests such as /download/windows, arm64 ranks last and is only served when it is the sole matching build)
  • /download/channel/:channel/:platform — latest build on a release channel
  • /download/version/:tag/:platform — a specific version
  • /download/:tag/:filename — a specific release asset by filename
  • /dl/:os/:arch — resolve by discrete OS (osx, windows, linux) and arch (32, 64, arm64 for all three OSes since 2.0, plus universal for osx and windows); supports ?channel, ?version, and ?pkg (deb/rpm/msix) queries
  • /dl/:filename — a release asset by filename
• Auto-updates with Squirrel
  • For Mac using Squirrel.Mac
    • /update/:platform/:version
    • /update/channel/:channel/:platform/:version
  • For Windows using Squirrel.Windows and NuGet packages
    • /update/:platform/:version/RELEASES
    • /update/channel/:channel/:platform/:version/RELEASES
  • update.electronjs.org-compatible format segment (drop-in for update-electron-app-style clients pointed at private repos). The platform segment is a single platform-arch id such as darwin-x64, darwin-arm64, win32-x64, or win32-arm64:
    • /update/:platform/squirrel/:version (+ /RELEASES for Squirrel.Windows), e.g. /update/darwin-arm64/squirrel/1.2.3
    • /update/:platform/msix/:version — Squirrel.Mac-shaped JSON feed for Electron's built-in MSIX updater (39.5+/40.2+/41+), e.g. /update/win32-x64/msix/1.2.3. The format segment is the only way to select the msix feed: the nuts-era ?filetype query on /update was removed in 2.0 (?filetype remains on /download, where the feed-minted urls use it)
    • channel variants (a pecans extension; uejs has no channel concept): /update/channel/:channel/:platform/:format/:version (+ /RELEASES), e.g. /update/channel/beta/win32-x64/msix/1.2.3
• API
  • /api/channels — release channels with their latest versions
  • /api/versions — releases, filterable with ?channel, ?platform, ?version
  • /api/status — server uptime
• Release Notes API, /notes?version=<x.x.x> (JSON or plain text via Accept)
• GitHub Release Integration
• GitHub Private Repository Hosted Releases
• GitHub Release Webhook to keep releases up-to-date
• Release Channels (beta, alpha, ...)
• Express App (composable)

Requirements

• Node.js >= 22.12
• @dopry/pecans is ESM-only — load it with import; require() is not supported

Deploy it / Start it

Follow our guide to deploy Pecans.

Auto-updater / Squirrel

This server provides an endpoint for Squirrel auto-updater, it supports both OS X and Windows.

Cache-refresh webhook

Release lists are cached (2 hours by default). POST /webhook/refresh busts the cache without waiting for expiry; it is enabled by configuring a refreshSecret on the backend and disabled otherwise. For the standalone server (npm start, Docker, Heroku), set the PECANS_REFRESH_SECRET environment variable — configure() passes it to the backend as the refreshSecret.

• GitHub backend: point a GitHub release webhook at /webhook/refresh with the secret set to your refreshSecret; the payload signature is verified with @octokit/webhooks.
• Other backends (base Backend middleware): send the refreshSecret in an X-Pecans-Secret header (the ?secret= query parameter was removed in 2.0 — query strings leak secrets into proxy and access logs). A valid request responds 200 {"refreshed": true}; a missing or wrong secret responds 403. Use a high-entropy secret, e.g. openssl rand -hex 32.

Migrating from 1.x

2.0 is a major release: ESM-only, hardened routes, and update.electronjs.org semantics. Every breaking change and its replacement is listed in the migration guide.

Documentation

Check out the documentation for more details.

Acknowledgements

• forked from Nuts.