chore(deps): update dependency sparkle to v2.9.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
Sparkle	from	minor	2.6.0 → 2.9.1

---

Release Notes

sparkle-project/Sparkle (Sparkle)

v2.9.1

Compare Source

• Fix potential crash due to race condition within clearDownloadedUpdate (#​2863) (Julian Pscheid)
• Fix generate_appcast failing if feed URL doesn't have lastPathComponent (#​2862) (Julian Pscheid)
• Don't let progress status text title string line wrap (#​2856) (Zorg)
• Add minimal framework support for building arm64e (#​2858, #​2860) (Zorg)
• Add SKIP_INSTALL=YES to for XPCServices targets (#​2864) (Jeremy Huddleston Sequoia)

v2.9.0

Compare Source

• Add basic markdown support for release notes (requires macOS 12+) including customizing its presentation (#​2810, #​2817) (Zorg)
• Add support for signing and verifying appcast feeds (#​2822, #​2828) (Zorg)
• Add sparkle:hardwareRequirements for enforcing an Apple silicon (arm64) requirement (#​2797) (Zorg)
• Add sparkle:minimumUpdateVersion for specifying a minimum version an app needs to be on before upgrading (#​2811) (Zorg)
• Add API annotations for Swift concurrency (#​2827) (Zorg)
• Validate Obj-C class when reading objects from user defaults / Info plists (#​2782) (Zorg)
• Download temporary files in-memory using NSURLSessionDataTask (#​2825) (Zorg)
• Allow impatient update check interval to be configured for updates that are downloaded automatically (#​2799) (Zorg)
• Probe agent & status service as soon as we launch it to reduce timeout issues (#​2852) (Zorg)
• Add allowsAutomaticUpdates property to determine if automatic downloading/installing of updates option should be enabled (#​2809) (Zorg)
• Add Vietnamese translation (#​2816, #​2839) (TranPhuong319)
• Add missing nn language to Installer progress Info.plist (#​2818) (Zorg)
• Improve German localization (#​2847) (Marco Hillger)
• Find non-canonical Sparkle.framework locations in generate_appcast when creating delta updates to determine compatibility (#​2833) (Zorg)
• Make Debug builds of Sparkle use same time interval settings as Release (#​2805) (Zorg)
• Remove sparkle-cli from the binary distribution (#​2826) (Zorg)
• Make generate_appcast deltas order stable and thread-safe (#​2848) (Nathan Manceaux-Panot)
• Fix Xcode 26.4 beta compiler warnings (#​2850) (Zorg)

v2.8.1

Compare Source

• Enforce RunAtLoad to reduce potential timeout issue when launching updater task (#​2795) (Zorg)
• Add missing executable bit permission warnings on connection failure (#​2792) (Zorg)
• Add missing localizations to zh-CN & zh-TW (#​2789, #​2791) (Francis Feng)
• Add documentation note for delegates being weakly referenced (#​2802) (Zorg)
• Include app name in startUpdater: failure in SPUStandardUpdaterController (#​2780) (Zorg)

v2.8.0

Compare Source

• UI modernization and macOS Tahoe support
  • Modernize update alert and release notes UI (#​2737) (Zorg, Noah Nuebling, Cykelero, Daniel Jalkut, Peter Nowell)
  • Update retrieving app icon to work better in Tahoe (#​2742) (Zorg)
  • Improve retrieval of main app icon for authorization dialog (#​2743) (Zorg)
• Delta updates
  • Improve bsdiff performance by preventing excessive iterations when processing similar data blocks (#​2693) (Will Fairclough)
  • Fix an issue while searching a cloneable file for delta updates (#​2748, #​2753) (Vincent Bénony, Zorg)
  • Add support for relative URLs for delta updates (#​2741) (jj)
• Localization
  • Set STRINGS_FILE_OUTPUT_ENCODING build setting to "binary" (#​2712) (Nicolas Kick)
  • Move all localizations to main Sparkle.strings (#​2760) (Zorg)
• Synchronize updater settings with user defaults to fix out-of-sync UI state (#​2728) (Zorg)
• Document and better enforce main thread only requirement for using Sparkle methods (#​2746, #​2754, #​2768)) (Sebastien Marchand, Zorg)
• Make -[SPUUserDriver showUpdateInFocus] optional (#​2717) (Zorg)
• Add private module map for framework (#​2722) (Zorg)
• Workaround a corner case in which the bundle path of a running application contains Contents/MacOS/Executable (#​2726, #​2747) (Jeremy Huddleston Sequoia, Zorg)
• Disable false dependency scan analysis warnings when building Sparkle from source (#​2762) (Daniel Jalkut)
• Refactor the logic for avoiding re-sending the system profile more frequently than once a week (#​2720) (Daniel Jalkut)
• Remove deprecated interactive package installer type (#​2767) (Zorg)

v2.7.3

Compare Source

• Double quote team identifiers in requirement strings to fix crash if Team ID starts with number (#​2766) (Zorg)

v2.7.2

Compare Source

• Harden policy on what operations clients are allowed to take (#​2763) (Zorg)

v2.7.1

Compare Source

• Fix typo in NN localisation (#​2694) (Sjur N Moshagen)
• Fix compiler warnings for Xcode 16.3 (#​2709) (Zorg)
• Fix Sparkle not building when SPARKLE_COPY_LOCALIZATIONS=0 (#​2707) (Zorg)
• Fix release notes constraints when compiled with macOS 26 SDK (#​2730) (Zorg)
• Fix reserved identifier warnings for Xcode 26 (#​2729) (Zorg)

v2.7.0

Compare Source

• Unarchiver / validation improvements (Zorg)
  • Remove old checksum verification checks for dmg archives to improve extraction speed (#​2568) (Zorg)
  • Skip extracting auxiliary files and improve extraction progress for disk images (#​2569) (Zorg)
  • Improve robustness around extracting dmg's with passwords (#​2627, #​2571) (Zorg)
  • Randomize the download archive name the installer extracts/executes (#​2584) (Zorg)
  • Retry extracting zip file without piping if extraction fails to workaround bug prior to macOS 15 (#​2616) (Zorg)
  • Add opt-in SUVerifyUpdateBeforeExtraction option to force verification of updates before extraction (#​2667) (Zorg)
  • Add support for extracting Apple Archives (.aar files; requires SUVerifyUpdateBeforeExtraction, macOS 10.15+) (#​2586, #​2588, #​2590) (Zorg)
  • Don't allow removal of signing keys more strictly (#​2647) (Zorg)
  • Remove SPARKLE_BUILD_DMG_SUPPORT option (#​2690) (Zorg)
• Add new BinaryDelta format (version 4) (Zorg)
  • Preserve bundle creation date when creating and applying delta updates (#​2583) (Zorg)
  • Use faster crc32 hashes for binary delta version 4 (#​2638) (Zorg)
  • Make binary delta version 4 the default (#​2668) (Zorg)
• Language / layout improvements
  • Fix recovery error suggestion not shown when app is translocated or on read-only mount (#​2689) (Zorg)
  • Fix typo in Dutch localisation (#​2642) (Eitot)
  • Add baseline alignment to status text in SUStatus dialog (#​2587) (Eitot)
  • Make horizontal hugging priority required for status text field (#​2614) (Zorg)
  • Adjust the layout of anonymous system profile info to align better with the rest of the panel's UI (#​2564) (Daniel Jalkut)
  • Fix typo in Dutch localisation (#​2642) (Eitot)
  • Internationalize system profile display keys (#​2577) (Zorg)
  • Update hebrew locale and add right-to-left characters (#​2573, #​2576, #​2578, #​2579) (Shlomo)
  • Update localisations for Dutch and German (#​2582) (Eitot)
  • Add unlocalized strings in Japanese (#​2589) (1024jp)
  • Fix typo in LICENSE (#​2648) (fujisoft)
• Deprecate custom version comparators (#​2639) (Zorg)
• Skip preflight update check in sparkle-cli if user is root (#​2645) (Zorg)
• Avoid assert/crash when app is moved before update alert shows (#​2658) (Zorg)
• Use default NSURLRequest timeoutInterval for the downloader (currently 60s) (#​2673) (Zorg)
• Fix process substitution failing to work for providing the private key as file argument (#​2615) (Zorg)
• Improve unable decode private key error messages in generate_appcast (#​2675) (Zorg)
• Clarify that default channel must be in allowed channels set in API documentation (#​2676) (Zorg)
• Call update permission prompt delegate method only when needed (#​2622) (Zorg)
• Resolve duplicate class definitions from BinaryDelta, Sparkle Test App, and unit tests (#​2570, #​2629) (Zorg)

v2.6.4

Compare Source

• Fix app modification prompt from appearing when downloaded update overrides NSUpdateSecurityPolicy (#​2593)

v2.6.3

Compare Source

• Guard update timer update check against sessionInProgress to fix rare crash when checking for updates (#​2561)
• Remove extra writeData: call when unarchiving disk images (#​2562)
• Ignore crashes due to SIGPIPE in generate_appcast when failing to extract zip files (#​2563)

v2.6.2

Compare Source

• Create and use temp extraction directory in generate_appcast again (#​2555) (Zorg)

v2.6.1

Compare Source

• Extract archives in a separate directory from the input archive (#​2550) (Zorg)
• Fix the release notes WebKit view not updating background when transitioning from light to dark mode (#​2542) (Zorg)
• Add NN (Norwegian Nynorsk) locale (#​2532) (Sjur N Moshagen, Zorg)
• Create tar.xz files with built-in tar and remove bzip2 fallback for creating a release distribution (#​2535) (Zorg)
• Add fallback in case SULocalizedStringFromTableInBundle() fails (#​2533) (Zorg)
• Remove assert on download response being available fixing rare crash (#​2547) (Zorg)
• Clarify when authoriation prompt may show in SPUUserDriver documentation (#​2531, #​2534) (Zorg)
• Fix typos in codebase (#​2537) (Viktor Szépe)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.