1.18.0

• Name of the host app is used in authorization prompt (the SPARKLE_RELAUNCH_TOOL_NAME setting is now obsolete)
• More detailed progress bar for package installers (Kornel Lesiński)
• Disabled the keyboard shortcut for the install button for scheduled updates to avoid accidental installs. (George Nachman)
• generate_appcast tool adds release notes if there's an .html file with the same base name as the archive (Brett Walker)
• Added sparkle:shortVersionString to the enclosure, #1032 (Brett Walker)
• Fixed Japanese localization (1024jp)
• Fixed escaping of system profile URLs
• Added more logging in various failure cases (Kornel Lesiński)
• Better error message for quarantined apps that can't be updated
• Feed attribute sparkle:os now works as documented (Memphiz)

1.17.0

• Added Touch Bar support (Bi11)
• Skip buttons are disabled if the update is marked as critical (Kornel Lesiński)
• Keyboard shortcut for the install button is disabled for scheduled updates to avoid accidental installs (George Nachman)
• Background updates ask OS for lower-priority networking (Kornel Lesiński)
• Upgraded SULog to use logging APIs that Apple provides built-in (Zorg)
• Refactorings to sync with upcoming 2.0
  • Added kqueue-based termination listener (Zorg)
  • Added AppKit prevention guards to modules that shouldn't import it (Zorg)
  • Added Obj-C generics where applicable (Zorg)
  • Made SUBundleIcon & SUApplicationInfo take SUHost, not NSBundle (Zorg)
  • Improved -[SUHost objectForInfoDictionaryKey:] (Zorg)
  • Detect and fail if any two-way dependencies exist in the project (Zorg)
• generate_appcast:
  • fixed handling of multiple directories in an archive
  • percent encode the filename used in the delta url (Brett Walker)
• Update Sparkle.strings (BR Lingo)
• Improved handling of non-ASCII names in delta archives (Kornel Lesiński)
• Don't touch Info.plist unless git version changes (Václav Slavík)

OS X 10.7 or later required

If you're not generating appcasts automatically, remember to add <sparkle:minimumSystemVersion>10.7</sparkle:minimumSystemVersion> tag to <item>s in your appcast. Sparkle will crash on Snow Leopard.

HTTPS required

Apple has deprecated insecure HTTP in macOS 10.11. Please use HTTPS for updates.

1.16 Automatic Appcast Generator

• Guided package installs are now the default for updating packages (Zorg)
  • pkg installers won't show any UI. If you require the old behavior of showing a full installer window, rename the *.pkg file to *.sparkle_interactive.pkg
• Previous version of the app is now deleted instead of staying in the trash (Zorg)
• Added generate_appcast helper tool (Kornel Lesiński)
• Made manual check resume pending automatic updates instead of starting a new update (Kornel Lesiński)
• Started using length value from RSS if HTTP doesn't give one (Zorg)
• Hidden automatic updates checkbox for information only updates (Bi11)
• Fixed UI update scheduler not prompting for install & relaunch (Zorg)
• Added progressbar for DMG and binary delta extraction (Kornel Lesiński)
• Fixed showing of download status if we attempt a 2nd download (Zorg)
• Refactorings to sync with upcoming 2.0
  • Decoupled and simplified installation code using protocols (Zorg)
  • Added nullability annotations (Zorg)
  • Allowed delegate methods that return an object to return nil (Zorg)
  • Decreased responsibility of SUHost and moved code into other components (Zorg)
  • Removed Sparkle.pch and many file #includes (Zorg)

The new generate_appcast tool automatically creates and updates appcast.xml files with DSA signatures and binary delta updates from a directory of archives.

./bin/generate_appcast path/to/your/private/dsa_key.pem update_downloads_folder/

The first argument for the tool is a DSA private key that must be corresponding to a DSA public key embedded in your app.

The second argument is a folder that should contain archived versions of your app bundle, e.g. example-app-1.2.zip, example-app-1.3.zip, etc.

The tool will read all information from the archives, e.g. read app versions and appcast URL from Info.plist of the archived apps.

It will generate (or update existing) appcast and create delta update files in the same directory. You can upload/rsync the entire directory to your server.

Note that the tool currently works only with regular .app bundles (i.e. not .pkg updates) and requires apps to use DSA signatures and have SUFeedURL in the Info.plist.

OS X 10.7 or later required

If you're not generating appcasts automatically, remember to add <sparkle:minimumSystemVersion>10.7</sparkle:minimumSystemVersion> tag to <item>s in your appcast. Sparkle will crash on Snow Leopard.

HTTPS required

OS X 10.11 has deprecated insecure HTTP. Please use HTTPS for updates.

1.15.1

Same as 1.15.0, except a build bugfix:

• A new icon! Thanks to 1024jp
• Show alert when an update is sent over insecure HTTP with no DSA key (Zorg)
  • If you can't use HTTPS, you must at least sign updates with a DSA key.
• Improved binary delta implementation (Zorg)
• Added improved -validateMenuItem: as a method in SUUpdater.h for public use (Zorg)
• Removed reachability preflight check (Zorg)
• Clear update caches directory before downloading new update (Zorg)
• Check the bundle's parent directory for writability too (Zorg)
• Don't follow symbolic links for file operations (Zorg)
• Don't bring up an authorized dialog during cleanup (Zorg)
• Made Sparkle look for the highest compatible version regardless of timestamps (Zorg)
• Fixed compatibility with 10.7
  • Fixed crash on 10.7 - subscript operator not available (kleuter)
  • Fixed warnings caused by -Wpartial-availability (Zorg)
• Fixed german l10n. (Sebastian Volland)
• Error code for download errors (Kornel Lesiński)
• Update last update check date when the update driver finishes (Zorg)
• Scale app icon up if needed in Software Update window (Nicholas Riley)
• Don't register for termination notifications more than once (Zorg)
• Don't terminate the app if we're already terminating (Zorg)
• Removed SUEnableAutomaticChecksKeyOld and SUCheckAtStartup constants (Eitot)
• Updated Sparkle framework headers to use modules if modules are available (B. Kevin Hardman)
• Fixed warnings, fixed uses of SULocalizedString (Jerry Krinock)

OS X 10.7 or later required

Make sure you add <sparkle:minimumSystemVersion>10.7</sparkle:minimumSystemVersion> tag to <item>s in your appcast. Sparkle will crash on Snow Leopard.

HTTPS required

OS X 10.11 has deprecated insecure HTTP. Please use HTTPS for updates.

1.15.0

• A new icon! Thanks to 1024jp
• Show alert when an update is sent over insecure HTTP with no DSA key (Zorg)
  • If you can't use HTTPS, you must at least sign updates with a DSA key.
• Improved binary delta implementation (Zorg)
• Added improved -validateMenuItem: as a method in SUUpdater.h for public use (Zorg)
• Removed reachability preflight check (Zorg)
• Clear update caches directory before downloading new update (Zorg)
• Check the bundle's parent directory for writability too (Zorg)
• Don't follow symbolic links for file operations (Zorg)
• Don't bring up an authorized dialog during cleanup (Zorg)
• Made Sparkle look for the highest compatible version regardless of timestamps (Zorg)
• Fixed compatibility with 10.7
  • Fixed crash on 10.7 - subscript operator not available (kleuter)
  • Fixed warnings caused by -Wpartial-availability (Zorg)
• Fixed german l10n. (Sebastian Volland)
• Error code for download errors (Kornel Lesiński)
• Update last update check date when the update driver finishes (Zorg)
• Scale app icon up if needed in Software Update window (Nicholas Riley)
• Don't register for termination notifications more than once (Zorg)
• Don't terminate the app if we're already terminating (Zorg)
• Removed SUEnableAutomaticChecksKeyOld and SUCheckAtStartup constants (Eitot)
• Updated Sparkle framework headers to use modules if modules are available (B. Kevin Hardman)
• Fixed warnings, fixed uses of SULocalizedString (Jerry Krinock)

OS X 10.7 or later required

Make sure you add <sparkle:minimumSystemVersion>10.7</sparkle:minimumSystemVersion> tag to <item>s in your appcast. Sparkle will crash on Snow Leopard.

HTTPS required

OS X 10.11 has deprecated insecure HTTP. Please use HTTPS for updates.

1.14.0

Sparkle used to try to fix invalid URLs, but now it's stricter. When upgrading, make sure your URLs in the appcast don't contain un-encoded non-ASCII characters.

JavaScript is disabled in release notes' HTML, unless you add SUEnableJavaScript to app's Info.plist.

• Disable javascript by default and make it opt-in (Zorg)
• URL-encoding of appcast URLs is preserved (Kornel Lesiński)
• Delegate is asked for fallback updates if delta update fails (Kornel Lesiński)
• Fixed crash on 10.7 - subscript operator not available (kleuter)
• Fixed check of feed URL before delegate had a chance to set it (Kornel Lesiński)
• Re-added support for password-protected dmg images (Andrew K. Boyd)
• Added warning about ATS blocking (Kornel Lesiński)
• Translation fixes for pt-BR. (vitu)
• Add some Japanese lozalized strings (1024jp)
• Made test app available in all languages (LIU Dongyuan / 柳东原)
• Czech localizations update (Frantisek Erben)
• Removed a test resource from the framework bundle (Karl Moskowski)
• Test if the updated app is the frontmost one (Zorg)
• UI Tests for the Test Application (Zorg)

OS X 10.7 or later required

Make sure you add <sparkle:minimumSystemVersion>10.7</sparkle:minimumSystemVersion> tag to <item>s in your appcast. Sparkle will crash on Snow Leopard.

HTTPS or ATS exception required

OS X 10.11 deprecated HTTP and blocks updates unless you use HTTPS or disable App Transport Security.