@driftengine/core 4.14.0 → 4.14.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.json +11 -0
- package/package.json +6 -6
package/CHANGELOG.json
CHANGED
|
@@ -1,4 +1,15 @@
|
|
|
1
1
|
[
|
|
2
|
+
{
|
|
3
|
+
"version": "4.14.1",
|
|
4
|
+
"date": "2026-11-03",
|
|
5
|
+
"entries": [
|
|
6
|
+
{
|
|
7
|
+
"kind": "fixed",
|
|
8
|
+
"short": "A desktop build ships Electron 43.8.1 or later: the packager asks for it, past the nine security advisories against the 43.4.1 it asked for until now.",
|
|
9
|
+
"text": "`@driftengine/package` asks for Electron `^43.8.1` where it asked for `^43.4.1`, so a desktop build made with this release ships a runtime past the nine advisories published against the versions between. Two are high: a sandboxed preload's code cache that a compromised renderer could poison (CVE-2026-102677), and the compromised eMudhra intermediate certificates (CVE-2026-115570). Four are medium: SameSite cookie restrictions not applied to a window opened from a link, and three kinds of permission request attributed to the wrong origin or frame. Three are low. A project whose lockfile holds an older 43 moves the next time it installs this version. The packager is otherwise as it was: on an RX 9070 XT, a small program packaged for the desktop target on Electron 43.8.6 starts to its first frame in 373 ms, against the 380 recorded for 43.4.1 in September. Nothing else a consumer installs is different. The repository's own lockfile, which no package ships, takes undici, fast-uri, brace-expansion, ip-address, vite and vitest to their patched versions inside the ranges already declared. Two moderate advisories stay, against `glob` below 14 and `minimatch` below 11, because they arrive only through electron-builder and through `@kmamal/gpu`'s build chain, and no release of either takes the fixed major."
|
|
10
|
+
}
|
|
11
|
+
]
|
|
12
|
+
},
|
|
2
13
|
{
|
|
3
14
|
"version": "4.14.0",
|
|
4
15
|
"date": "2026-10-18",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@driftengine/core",
|
|
3
|
-
"version": "4.14.
|
|
3
|
+
"version": "4.14.1",
|
|
4
4
|
"description": "The runtime of DriftEngine, a WebGPU game engine with a WebGL2 fallback: renderer, loop, input, cameras, scene graph and physics",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
],
|
|
30
30
|
"sideEffects": false,
|
|
31
31
|
"dependencies": {
|
|
32
|
-
"@driftengine/drft": "4.14.
|
|
33
|
-
"@driftengine/physics": "4.14.
|
|
32
|
+
"@driftengine/drft": "4.14.1",
|
|
33
|
+
"@driftengine/physics": "4.14.1",
|
|
34
34
|
"gl-matrix": "^3.4.3"
|
|
35
35
|
},
|
|
36
36
|
"author": "Drift Technologies",
|
|
@@ -67,8 +67,8 @@
|
|
|
67
67
|
"prepack": "node ../../scripts/build.mjs @driftengine/core"
|
|
68
68
|
},
|
|
69
69
|
"devDependencies": {
|
|
70
|
-
"@driftengine/nav": "4.14.
|
|
71
|
-
"@driftengine/network": "4.14.
|
|
72
|
-
"@driftengine/texture": "4.14.
|
|
70
|
+
"@driftengine/nav": "4.14.1",
|
|
71
|
+
"@driftengine/network": "4.14.1",
|
|
72
|
+
"@driftengine/texture": "4.14.1"
|
|
73
73
|
}
|
|
74
74
|
}
|