joeyr
released this
2026-07-20 18:42:33 -05:00
| 43 commits to main since this release
Security
- The Riot API key is now encrypted at rest. It was stored in plaintext in
<userData>/settings.json; it is now sealed with the OS keystore via Electron's safeStorage (DPAPI on Windows) before it touches disk — stored as a tagged enc:v1: value and decrypted back to plaintext only in memory for the scout / harvest clients. A key written by an older build is read as-is and re-encrypted on the next settings save (transparent migration); a blob that can't be decrypted — e.g. settings.json copied to another OS user or machine — is dropped with a warning instead of crashing.
- Hardened the renderer Content-Security-Policy on all three windows with
base-uri 'none', form-action 'none', object-src 'none', and frame-src 'none' — directives default-src does not fall back to — closing the <base>-injection and form-exfiltration gaps. img-src https: is unchanged (op.gg serves the rune/item icons from its own CDN).
Changed
- CI now audits shipped dependencies (
npm audit --omit=dev --audit-level=high) as a gate step, so a known high/critical advisory in a production (runtime) package fails the build instead of landing silently. Scoped to production deps: build/dev tooling runs only on trusted CI/dev machines and never reaches a user.
Fixed
- Corrected a stale code comment on the
lol-item-sets write-allowlist rule ("future items phase" → the item build import that shipped in 3.5.0).
Downloads