Bump github.com/sparkle-project/sparkle from 2.4.0 to 2.6.4 in /Core

[dependabot]

Bumps github.com/sparkle-project/sparkle from 2.4.0 to 2.6.4.

Release notes

Sourced from github.com/sparkle-project/sparkle's releases.

2.6.4

Changes:

• Fix app modification prompt from appearing when downloaded update overrides NSUpdateSecurityPolicy (#2593)

If your app overrides NSUpdateSecurityPolicy and doesn't require a custom policy, please consider removing it.

Please also check 2.6.3, 2.6.2 - Important security fix, and 2.6.0 Further Sonoma Improvements for previous changes.

2.6.3

Changes:

• Guard update timer update check against sessionInProgress to fix rare crash when checking for updates (#2561) (Zorg)
• Remove extra writeData: call when unarchiving disk images (#2562) (Zorg)
• Ignore crashes due to SIGPIPE in generate_appcast when failing to extract zip files (#2563) (Zorg)

Please also see 2.6.2 - Important security fix and 2.6.0 Further Sonoma Improvements for previous changes.

2.6.2 - Important security fix + generate_appcast fix

This is the same as 2.6.1 - Important security fix except it includes a bug fix for generate_appcast (#2555) where archives may have not been able to unarchive.

2.6.1 - Important security fix

This update fixes a vulnerability that allows an attacker to replace an existing signed update with another payload, which bypasses Sparkle’s (Ed)DSA signing checks (#2550). Apps that serve updates over HTTPS (most if not all apps) are not immediately impacted because the server hosting the update (or a CA) needs to first be compromised for an attacker to exploit this issue. Updating Sparkle with this fix ASAP is still strongly recommended however because an important security layer can be bypassed.

All older versions of Sparkle are affected by this bug. This fix is back ported to 1.27.3 for Sparkle 1. For older versions of Sparkle 2, a 2.2.x branch is available which is based on 2.2.2.

Please check the Discussions topic for this release for more details or follow up.

Update: generate_appcast may not work for certain archive types (sparkle-project/Sparkle#2554) in 2.6.1. This is fixed in 2.6.2.

Overall changes in 2.6.1:

• Extract archives in a separate directory from the input archive and fixes a security vulnerability (#2550) (Zorg)
• Fix the release notes WebKit view not updating background when transitioning from light to dark mode (#2542) (Zorg)
• Add NN (Norwegian Nynorsk) locale (#2532) (Sjur N Moshagen, Zorg)
• Create tar.xz files with built-in tar and remove bzip2 fallback for creating a release distribution (#2535) (Zorg)
• Add fallback in case SULocalizedStringFromTableInBundle() fails (#2533) (Zorg)
• Remove assert on download response being available fixing rare crash (#2547) (Zorg)
• Clarify when authoriation prompt may show in SPUUserDriver documentation (#2531, #2534) (Zorg)
• Fix typos in codebase (#2537) (Viktor Szépe)

2.6.0 Further Sonoma Improvements

Changes:

• Perform Gatekeeper scan to pre-warm app launch (#2505) (Zorg)
• Disable sandboxing for the Downloader XPC service by default to fix downloader prompt warnings about “Downloader” differing from previously opened versions (#2511) (Zorg)
• Store private seed as the secret for newly generated keys (#2472) (Zorg)
• Improve signing error message to developers if they serve the wrong update file (#2471) (Zorg)
• Prevent app modification warnings from external updaters (like sparkli-cli) by improving installation (#2516) (Zorg)
• Update Korean localization (#2504) (CheolHyun Mun)

... (truncated)

Commits

• 0ef1ee0 Update Package management files for version 2.6.4
• 6aa15e9 Update change log for 2.6.4
• b8986f6 Skip safe atomic swap if update has custom update security policy (#2593)
• b456fd4 Update Package management files for version 2.6.3
• 5af89de Update changelog for 2.6.3
• 2247105 Ignore crashes due to SIGPIPE in generate_appcast (#2563)
• f904466 Remove extra writeData: call when unarchiving disk images (#2562)
• 9d6e8c2 Merge CHANGELOG changes from 1.x
• dd76d00 Update Carthage package to include 1.27.3
• be8247e Guard update timer update check against sessionInProgress (#2561)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.