State Forge's position/rationale for Squirrel.Windows

[robatwilliams]

Pre-flight checklist

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project uses.
• I have searched the issue tracker for a feature request that matches the one I want to file, without success.

Problem description

I'm looking to start my next Electron project, and see the Squirrel.Windows option is recommended by the Forge project. However I also see numerous indicators that the underlying project is not in good health, which seems at odds with that.

I would appreciate hearing the team's thoughts around this. I believe the community would benefit from some confidence that this remains a sustainable choice for use in our projects, and/or some greater visibility as to the health of key underlying projects to help ensure we make our own informed decisions.

I've framed this as a feature request as it felt the best fit and place to raise this. I've found previous issues on the subject already and will link them within later sections.

Proposed solution

Consider the situation and respond to this issue.

Alternatives considered

• electron-builder with NSIS
• Velopack

Additional information

My perception is that Squirrel.Windows is historically the most commonly used option for a target that supports automatic updates, and is still used by popular applications including Slack, GitHub Desktop, Postman, Figma.

The Forge project responded to a question about the future of Squirrel in late 2022.

Electron Builder continues to maintain their Squirrel integration, although they have deprecated that integration in favour of NSIS.

Squirrel.Windows was last released in Sep 2020, although there have been some PRs merged since.

The project readme says they're looking for help with maintenance, and refers to a 2019 discussion issue about rebooting the project, which doesn't appear to have gained/maintained traction.

Clowd.Squirrel is a fork from 2021 that gained "some" popularity, which led to the creation of Velopack.

For non-public repositories, distributing updates for Squirrel requires running a purpose-built server. All the server implementations listed appear to be unmaintained (Hazel, Nuts, Nucleus), except for electron-release-server. That server has some nontrivial complexity to deploy (e.g. it needs its own database), especially compared to NSIS (which can work with e.g. generic web server).