@driftengine/core 4.14.0 → 4.14.2

package/CHANGELOG.json

@@ -1,4 +1,26 @@
 [
+  {
+    "version": "4.14.2",
+    "date": "2026-11-03",
+    "entries": [
+      {
+        "kind": "changed",
+        "short": "A desktop build is made with electron-builder 26.18.1 or later, which keeps what it packs into an asar inside the project's own folders.",
+        "text": "`@driftengine/package` asks for electron-builder `^26.18.1` where it asked for `^26.0.0`. Between the two, electron-builder backported a run of fixes to 26, and two reach what the packager does: what it packs into an asar is held inside the project's own folders, and native modules are rebuilt with `@electron/rebuild` 4.2.1. None carried a published advisory, and a project installing afresh already resolved 26.18.1, so this is a floor for a project whose lockfile held an older 26. On an RX 9070 XT, a small program packaged for the desktop target with 26.18.1 comes out at the sizes 26.15.3 gave it, a 130.1 MB AppImage and a 123.2 MB tarball, and starts to its first frame in 381 ms. Nothing else a consumer installs is different. The repository moves its CI to `actions/checkout` and `actions/setup-node` 7 and its own tools to oxlint 1.90, prettier 3.9.10, tsx 4.23.15 and Node's types 26.6.5, with no new warning and nothing reformatted, and its tests now run on a pull request as well as on a push, so an update Dependabot proposes is seen green or red before it is taken."
+      }
+    ]
+  },
+  {
+    "version": "4.14.1",
+    "date": "2026-11-03",
+    "entries": [
+      {
+        "kind": "fixed",
+        "short": "A desktop build ships Electron 43.8.1 or later: the packager asks for it, past the nine security advisories against the 43.4.1 it asked for until now.",
+        "text": "`@driftengine/package` asks for Electron `^43.8.1` where it asked for `^43.4.1`, so a desktop build made with this release ships a runtime past the nine advisories published against the versions between. Two are high: a sandboxed preload's code cache that a compromised renderer could poison (CVE-2026-102677), and the compromised eMudhra intermediate certificates (CVE-2026-115570). Four are medium: SameSite cookie restrictions not applied to a window opened from a link, and three kinds of permission request attributed to the wrong origin or frame. Three are low. A project whose lockfile holds an older 43 moves the next time it installs this version. The packager is otherwise as it was: on an RX 9070 XT, a small program packaged for the desktop target on Electron 43.8.6 starts to its first frame in 373 ms, against the 380 recorded for 43.4.1 in September. Nothing else a consumer installs is different. The repository's own lockfile, which no package ships, takes undici, fast-uri, brace-expansion, ip-address, vite and vitest to their patched versions inside the ranges already declared. Two moderate advisories stay, against `glob` below 14 and `minimatch` below 11, because they arrive only through electron-builder and through `@kmamal/gpu`'s build chain, and no release of either takes the fixed major."
+      }
+    ]
+  },
   {
     "version": "4.14.0",
     "date": "2026-10-18",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@driftengine/core",
-  "version": "4.14.0",
+  "version": "4.14.2",
   "description": "The runtime of DriftEngine, a WebGPU game engine with a WebGL2 fallback: renderer, loop, input, cameras, scene graph and physics",
   "license": "Apache-2.0",
   "type": "module",
@@ -29,8 +29,8 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@driftengine/drft": "4.14.0",
-    "@driftengine/physics": "4.14.0",
+    "@driftengine/drft": "4.14.2",
+    "@driftengine/physics": "4.14.2",
     "gl-matrix": "^3.4.3"
   },
   "author": "Drift Technologies",
@@ -67,8 +67,8 @@
     "prepack": "node ../../scripts/build.mjs @driftengine/core"
   },
   "devDependencies": {
-    "@driftengine/nav": "4.14.0",
-    "@driftengine/network": "4.14.0",
-    "@driftengine/texture": "4.14.0"
+    "@driftengine/nav": "4.14.2",
+    "@driftengine/network": "4.14.2",
+    "@driftengine/texture": "4.14.2"
   }
 }