31.4.5

Release Notes for 31.4.5

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

ChangeLog:

• Drops files the packaged app never reads, which makes the downloads 7 to 14 MB smaller depending on the package
• Sandboxes the renderer of the progress window shown while an update downloads
• Enables auto-update for Windows arm64 builds, which were previously published with updates disabled because both architectures wrote the same update manifest. Existing arm64 users need to install this build manually once, after which updates arrive in the app as usual [#2197]
• Updates to draw.io core 31.4.5. All changes from 31.4.4 to 31.4.5 are added in this build.

Testing:

Verified against the packaged, signed macOS build. The Windows arm64 update channel was verified from the build configuration, the produced update manifest and unit tests, rather than from a running Windows build.

Base checks

• Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste, save, insert, rename and delete pages, and zoom
• Export to PNG, SVG and PDF from the app and from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page against the default --size diagram
• Diagram round trip in an exported PDF, including reopening the exported PDF and recovering both pages and their contents
• Mermaid and CSV import and the --layout option from the command line
• Shape search, the export dialog and the print preview
• Quick Look preview on macOS is registered for this build and loads without error
• The macOS bundle is signed with a Developer ID certificate under the hardened runtime, is notarised and stapled, and the Quick Look app extension is sandboxed and separately signed
• The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
• 158 unit tests pass

Files dropped from the package

• All 204 stencil files are present in the embedded stencil bundle, matching the source tree exactly, and every one of them parses at runtime without a single request reaching a removed file
• Of the 2866 shape names referenced by the shipped bundles, the same number resolve as on a reference build made from the same source, so nothing that used to render has been lost
• Startup produces no failed loads and no console errors
• Shapes backed by stencils, by the compiled shape bundle and by images all render, both in the app and in command line exports
• PDF export still works, which is the path that resolves the PDF library build kept in the package
• Starting a packaged build with DRAWIO_ENV=dev now keeps the minified bundles instead of opening a blank window

Progress window sandbox

• The progress window renderer runs sandboxed, confirmed against a control window built without the sandbox
• Its text, detail line and bar position still update, the completion event still fires and the window still closes
• The window does not stay on top of the editor [#2516]

Checks around the changes

• Reads, stats and watches of paths the user has not authorised are still refused, and so are writes, while an authorised file still reads and saves [GHSA-fjgc-8xgj-rvh4]
• Only http, https, mailto, tel and callto links are opened externally
• Libraries opened from a file still load, and saving one repeatedly still writes each time without reopening the save dialog [#2518] [#2521]
• Opening a file from the command line, saving it without a dialog and reopening it round trips with both pages intact

31.4.4

Release Notes for 31.4.4

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

ChangeLog:

• Uses electron 44.2.0
• Restricts renderer file reads to paths the user has authorised, so opening and exporting a crafted diagram can no longer read arbitrary local files through the file IPC [GHSA-fjgc-8xgj-rvh4]
• Corrects the AppImage compression method, so AppImageLauncher and other tools that expect gzip can read the image again [#2538]
• Updates to draw.io core 31.4.4. All changes from 31.4.2 to 31.4.4 are added in this build.

Testing:

Verified against the packaged, signed macOS build. Linux and Windows packaging changes were verified from the produced release artifacts.

Base checks

• Launch, open a file passed on the command line, add and edit shapes, undo and redo, save, insert and delete pages
• Copy and paste through the system clipboard, which changed with Electron 44
• Export to PNG, SVG and PDF from the app and from the command line
• Diagram round trip in exported PNG, SVG and PDF, including reopening an exported PDF
• Command line page selection with -p, and --size page against the default --size diagram
• Quick Look preview on macOS renders the diagram
• The macOS bundle is signed with a Developer ID certificate under the hardened runtime and is notarised, and the Quick Look app extension is sandboxed and separately signed
• The x86_64 and arm64 AppImages are gzip compressed
• 153 unit tests pass

Read authorisation [GHSA-fjgc-8xgj-rvh4]

• readFile, fileStat, isFileWritable, watchFile, getFileDrafts, getBkpFile and checkFileExists all refuse paths the user has not authorised, including a symlink planted inside an authorised folder
• A crafted diagram whose font source points at a local file exports with nothing embedded, checked by scanning the export for the file contents in both plain and base64 form
• The font URL check rejects the evasions the URL parser would otherwise strip, being leading spaces, tabs and newlines in the scheme, uppercase schemes, and absolute, UNC and protocol relative paths, while still accepting http(s), data: and relative URLs

Checks around the read authorisation change

• Libraries and templates declared in the configuration still load, and their shapes still appear in the sidebar
• The configuration widens what may be read and not what may be written, checked by a write to a configured path being refused
• Custom libraries added in earlier versions keep working after upgrading to this build
• Drafts, backups, external change detection and the save conflict check still work
• Authorisations survive a restart, so Recent Files keeps working
• Saving a shape library opened from a file still writes without reopening the save dialog [#2518] [#2521]

31.4.2

Release Notes for 31.4.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

ChangeLog:

• Uses electron 44.1.1
• Requires macOS 13 (Ventura) or later and drops the 32-bit Windows build, following Electron 44 dropping support for both [#2476]
• Switches the AppImage to a static runtime, removing the libfuse2 dependency [#2527]
• Updates to draw.io core 31.4.2. All changes from 31.3.2 to 31.4.2 are added in this build.

31.3.2

Releases Notes for 31.3.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Fixes the save dialog reopening endlessly without ever saving when saving a new or imported shape library [#2518]
• Stops saving changes to a library opened from file asking for a save location on every save [#2521]
• Fixes saving a library disabling external change detection for the open diagram
• Updates to draw.io core 31.3.2.

31.3.1

Releases Notes for 31.3.1

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.9.3
• Signs the bundled Electron DLLs on Windows, so Windows Defender ASR ransomware protection no longer blocks the app after installs and updates [#2509]
• Builds the Windows no-installer zip with the full signed and fused configuration [#2509]
• Stops the update download window staying on top of other applications and covering the install prompt [#2516]
• Stops repeated manual update checks producing duplicate update dialogs
• Fixes opening multi-page PDFs exported by releases before 30.3.6, where the diagram is embedded as a PDF file attachment
• Updates to draw.io core 31.3.1.

31.1.8

Releases Notes for 31.1.8

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.8.1
• Updates to draw.io core 31.1.8.

31.1.5

Releases Notes for 31.1.5

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.8.0
• Removes plugin system #2499
• #2500 , #2481
• Updates to draw.io core 31.1.5.

31.0.2

Releases Notes for 31.0.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.7.0
• #2421 , #2365 , #2161 , #2219
• Updates to draw.io core 31.0.2.

30.4.1

Releases Notes for 30.4.1

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.7.0
• #2132 , #2219
• Updates to draw.io core 30.4.1.

30.3.14

Releases Notes for 30.3.14

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.7.0
• #2235 , #1026 , #1278 , #2312 , #1245
• Updates to draw.io core 30.3.14.