# Velopack: a Rust updater with bindings for six languages

> Velopack turns compiler output into an installer, delta packages and a self-updating portable build with one command. The interesting part is that the core is Rust while the first-class citizen is .NET, and both are true.

**velopack/velopack** — Installer and automatic update framework for cross-platform desktop applications

- Repository: https://github.com/velopack/velopack
- Website: https://velopack.io
- Stars: 2,414 · Forks: 164
- Language: C#
- License: MIT
- Published: 2026-10-07 · Updated: 2026-10-07 · Language: en
- Canonical page: https://hysenlabs.com/projects/velopack-velopack

## One command from build output to installable

The pitch in the README is that Velopack takes compiler output and generates an installer, updates, delta packages, and a self-updating portable package, with zero config, in one command. It describes itself as opinionated, which is the word that explains both the appeal and the limit: an opinionated framework makes decisions for you and then does not let you easily overrule them.

The list of supported build targets is Windows, macOS, and Linux, from one solution. Updates ship as delta packages so a user downloads only what changed between versions, and the README attributes the speed to the core being written in Rust rather than to a scripting language.

Localization is part of the product rather than an afterthought: the README claims translation into 39 languages across 6 continents, and the tree carries a `locales/` directory to match. A framework that ships its installer translated means a maintainer does not have to solve that problem, and a framework that claims it can also be wrong about it, which is why the `locales/` directory is the place to check before promising a language to your users.

The documentation lives outside the repository, at docs.velopack.io, with quick start guides and sample apps as separate sections. That split is deliberate and reasonable, but it means the README is a summary of a design rather than a manual for it.

## A Rust workspace under a C-shaped repository

GitHub reports the primary language of this repository as C#, and the README says Velopack is written in Rust. Both are accurate descriptions of different things, and the tree is where you can settle it.

```toml
[workspace]
resolver = "2"
members = [
    "src/bins",
    "src/l18n",
    "src/lib-rust",
    "src/lib-nodejs/velopack_nodeffi",
    "src/lib-cpp",
    "src/lib-python",
    "src/wix-dll",
]
```

One workspace, seven members, and the bindings are siblings of the core rather than a wrapper around a shipped binary. `src/lib-rust` is the Rust library, `src/bins` is the command line tools, `src/l18n` is localization, `src/lib-cpp`, `src/lib-python`, and `src/lib-nodejs/velopack_nodeffi` are the three non-.NET language bindings, and `src/wix-dll` is the Windows Installer XML piece.

The C# side shows up in `Velopack.slnx`, the solution file, alongside `global.json`, `nuget.config`, and `Velopack.snk`, a strong name key. A strong name key in the tree is a distribution concern: it is what lets a .NET assembly be referenced by a signed identity rather than only by name, which matters if your application is itself strong named.

The workspace package metadata gives a minimum toolchain of Rust 1.75 on edition 2021, and marks the project MIT licensed with Velopack Ltd and Caelan Sayler as authors. Reading `Cargo.toml` is more informative than either language label here, because it tells you the Rust core is what every other binding targets.

## Squirrel is the migration target, not the competitor

Automatic migrations are listed as a headline feature, and the README names the framework explicitly: if you are coming from other popular frameworks such as Squirrel, Velopack can migrate your application automatically. The repository topics carry the same lineage, listing `squirrel` and `clickonce` alongside the generic installer and updater terms.

That framing tells you who the project is aimed at, and it explains a good deal of the design. A Squirrel.Windows application has an existing install layout and an existing update feed, and the hard part of moving is not the download but agreeing on the file layout and the release metadata. Doing that migration automatically is a real service, and it is the reason a .NET desktop developer would look here first.

The release history shows the same continuity being maintained. Version 1.2.0 included a fallback to fix old versions of Velopack updating on Mac, which is the sort of change that only matters if you care about upgrading an application that is already installed and already on an earlier Velopack. That is a compatibility promise most new projects decline to make, and it is the clearest evidence that this is aimed at existing shipped applications rather than greenfield ones.

The testimonials in the README, several of them from Discord, are consistent on the same two points: install and update feel fast, and the tool integrated with existing build pipelines without separate installer scripts in another language. Read them as user reports from users who came from Squirrel, which is who the project is for.

## Samples decide whether you can use this at all

The `samples/` directory is the most useful thing in the tree for a reader deciding whether Velopack fits, because it enumerates the combinations the project actually supports rather than the ones the README hopes for.

There is a C# sample for every major .NET desktop stack: WinForms, WPF, Avalonia, Uno, and Unity Mono. There are three C++ samples covering Qt, Qt Widgets, and the raw Win32 API, which is a deliberate spread from managed UI frameworks down to no framework at all. There is a Python sample twice over, once with Qt and once with WXPython. There is a Rust sample using Iced, and a Node sample using Electron.

The three C++ samples are the interesting set. Qt and Qt Widgets cover the two ways Qt code is usually written, and Win32 covers the case where you have a native Windows application with no cross-platform UI layer and just want updates. If your stack is not on this list, the README's language agnostic claim is doing more work than the samples demonstrate, and the question to ask is whether a binding exists for it, not whether the documentation promises one.

There is also a `samples/README.md` and a shared `samples/SampleHelper.cs`, which together suggest the samples share a helper rather than each being a standalone copy, and a `samples/Directory.Build.targets` file for the .NET ones. Buildable examples are worth more here than documentation, because the hard part of adopting an updater is wiring it into a project that already has its own build.

## Supply chain files you would not find in a smaller project

A few tree entries signal that this project takes its build inputs seriously. `deny.toml` configures `cargo deny`, a tool that checks dependency licenses and advisories, and the release notes show it being used in anger: pyo3 advisories RUSTSEC-2026-0176 and RUSTSEC-0177 are explicitly ignored in the deny configuration, which is the kind of documented exception that is far better than a silent one. `renovate.json` at the root automates dependency updates, and there is a `rustfmt.toml` for formatting.

The 1.2.158 release notes also record a supply-chain CI fix that bumped vite to 8.0.16 to resolve an npm audit failure, in a repository whose main language is C#. That is a useful signal about the project's shape: the build itself pulls in Node tooling for the frontend pieces, so the dependency surface spans Cargo, NuGet, and npm at once.

`vendor/` in the tree suggests vendored dependencies, and `.cargo/` holds repository-level Cargo configuration, which is where you would pin a registry or a source replacement if you build behind a mirror.

The release notes are also unusually detailed for a project of this size. Beyond the supply-chain work, 1.2.158 shipped 64-bit Windows bootstrapper binaries from `vpk pack`, allowed an S3 region to be specified at the same time as an endpoint, added Python typings, and improved semver validation to avoid Rust crashes. The last of those is the kind of fix that only appears once a tool has been run against a lot of real version strings.

## Version numbers, tag shapes, and the feed

Three releases are visible and their tags are not uniform. There is `1.2.0` from 2026-06-03, `1.2.110-ge826545` from 2026-07-16, and `1.2.158` from 2026-09-21. The middle tag carries a git hash suffix, which is a development or prerelease shape rather than a release shape, and the last push was on 2026-09-28, so the repository is being worked on continuously.

Something to be aware of when reading the changelogs: the `1.2.158` and `1.2.110-ge826545` entries list the same set of pull requests, down to the same numbers and authors. Whatever process generates those notes is re-emitting one list across two tags, so the notes tell you what changed in that range of work rather than what is new in each tag. The `1.2.0` entry is narrower and looks like a genuine per-release list.

The deployment commands are visible in the tree through the CLI structure: argument validation was moved to the command layer with JSON support added, and the deployment commands were refactored, all in one pull request. JSON output on a deployment command is a small feature with a large effect on CI, because it is the difference between grepping log text and reading a field.

Finally, there is a `version.json` at the root, which is the kind of file that exists because a client needs to know what it is running before it can decide whether to update. If you are integrating manually rather than through the bindings, that file and the `vpk` command are the two pieces to look at first.

## Conclusion

Velopack's practical argument is that update infrastructure is a solved problem you should not be solving per product, and the repository backs that up with a cross-platform Rust core, bindings for the languages desktop apps are actually written in, and a migration path from the Squirrel framework it clearly intends to replace. The parts to verify before committing are narrower than they first appear: whether a sample app exists for your language, since the ones in `samples/` cover .NET desktop, Qt, Node with Electron, and Rust, and whether your CI can run the `vpk` command and reach your release feed. Squirrel users have an automated migration in the README. Everyone else starts at the quick start guides on docs.velopack.io.

## FAQ

### What is Velopack used for?

It is an installation and automatic update framework for cross-platform desktop applications. One command takes compiler output and produces an installer, delta packages, and a self-updating portable package, for Windows, macOS, and Linux.

### Which languages can I use Velopack from?

The README lists C#, C++, JavaScript, and Rust, and the samples directory backs that with C# apps for WinForms, WPF, Avalonia, Uno and Unity Mono, C++ samples for Qt, Qt Widgets and Win32, Python samples for Qt and WXPython, plus Node with Electron and Rust with Iced. The core is Rust, exposed through sibling bindings in the Cargo workspace.

### Can Velopack migrate an existing Squirrel application?

Yes. Automatic migration from frameworks such as Squirrel is a listed feature, and the repository topics include both `squirrel` and `clickonce`. The 1.2.0 release also added a fallback so that older Velopack versions can update on Mac.

### How does Velopack reduce update download size?

It generates delta packages, so a user downloads only what changed between versions rather than the whole application. The README attributes the speed of both building and updating to the core being written in Rust.

## Sources

- [License: MIT](https://github.com/velopack/velopack/blob/develop/LICENSE)
- [Project website](https://velopack.io)
- [README](https://github.com/velopack/velopack/blob/develop/README.md)
- [Releases](https://github.com/velopack/velopack/releases)
- [velopack/velopack on GitHub](https://github.com/velopack/velopack)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/velopack-velopack