LuminalShine 26.11.0

LuminalShine 26.11.0 is a security and reliability update covering changes since 26.10.1, commit dba21a9ef69222b40a18227c2783853b954dfdf7. Alongside the security fixes, it addresses a display-watchdog teardown failure and adds host identity and build information for clients. The virtual-display application routing and OLED Protection fixes from 26.10.1 remain included.

Security fixes

Crash diagnostics and sensitive process memory

GHSA-p77f-xj3v-8g52 — crash dumps and diagnostic bundles could expose sensitive host memory, including TLS private-key material and Web UI session tokens.

• Host crash dumps now capture thread stacks and diagnostic metadata instead of following stack pointers into heap memory. The terminate-message buffer is included only for a terminate exception.
• The crash-dump directory is restricted to SYSTEM and Administrators. If those permissions cannot be applied, the host disables its own crash dumps for that run.
• Diagnostic bundles accept eligible stack-focused host dumps from the crash-handler directory. Older heap-inclusive host dumps and host-process WER/LocalDumps files are excluded. Helper-process dump collection is unchanged.

These changes reduce exposure; they do not make diagnostic bundles safe to share indiscriminately. Thread stacks and exception messages may still contain sensitive information. Unelevated runs may no longer produce host crash dumps, and older host dumps will no longer appear in exported bundles.

Independent pending pairing exchanges

GHSA-93x7-m86q-pc53 — an unauthenticated peer could occupy the pending pairing exchange used by clients sharing the same client ID, preventing those clients from pairing.

• Pending exchanges are now separated by client ID and peer address, allowing devices on different addresses to pair independently even when their clients send the same ID.
• Each source address can hold at most two pending exchanges. Retries of an existing exchange do not consume another slot.
• PIN submissions, later pairing phases, failures, and cleanup remain attached to the intended exchange. One peer's invalid request cannot remove another address's pending exchange.

The existing global limit remains in place; this is not complete protection against multi-address denial of service. Clients behind one NAT or proxy share the per-address limit, and same-ID clients behind that address can still conflict. Existing paired-client authorization and streaming protocols are unchanged.

Streaming reliability

• Prevent display-watchdog self-join during session teardown. The watchdog now observes the session count without reaping stopped sessions on its own thread. It leaves session reaping to other callers, avoiding a teardown path that could make it attempt to join itself. (PR #243)

Host discovery and build information

• Expose LuminalShine identity, release classification, and build timestamp through /serverinfo. These fields are additive; existing GameStream compatibility fields are retained. Clients can identify the host and distinguish stable releases, prereleases, and development builds without inferring that information from compatibility version strings. (PR #247)
• Release CI supplies stable-release metadata and keeps the build timestamp fixed through signing and packaging.

LuminalVGD driver

The bundled virtual display driver is unchanged:

Build 27 retains the D3D12 timeline-fence transport and teardown/drain protections. Upgrading from 26.10.1 does not normally require replacing this display driver. The separate VHF virtual gamepad package also remains unchanged: v0.1.0-beta.9, driver 0.1.0.53, protocol 2.

Project, tests and release engineering

• Added regression coverage for concurrent same-ID pairing, targeted PIN delivery, per-address limits, retries, and cross-peer isolation.
• Added Windows crash-dump tests covering dump contents, restricted directory permissions, and diagnostic-bundle selection.
• Combined both security test groups into the blocking Windows connection-path gate so neither is overwritten by a second test filter. (PR #248)
• Added server-discovery metadata tests and build-time metadata validation.
• Preserved Authenticode signatures in the portable ZIP and added a release gate that verifies the packaged executable signatures and hashes.

Release validation: Windows release build passed the 181-test connection/security gate, all 4 server-metadata tests, all 5 configuration-consistency tests, MSI upgrade/invariant checks, and final signature checks. The portable ZIP gate verified 8 signed executables against their pre-packaging hashes. Downloaded installer and portable-host signatures and the host's 26.11.0 version were independently verified.

The broader advisory suite completed with 868 passes, 12 failures, and 10 skips; the 12 failure names match the 26.10.1 baseline. A physical Moonlight client streaming session was not performed for this release validation.

Upgrading

• Install LuminalShine 26.11.0 as soon as possible. Use the installer to upgrade the existing installation. Settings and pairings are retained; an active stream ends during the upgrade and can be restarted after the service returns.
• Hard-refresh Mission Control (Ctrl+F5) if old assets remain cached. Use Changelog in navigation to reopen these notes.
• When more than one client is waiting to pair, select the intended request in the Web UI before entering its PIN. Pair clients sequentially if they share a NAT or proxy address.
• Regular Moonlight sessions, Borealis compatibility, the browser Play page, and opt-in PyroWave support retain their existing connection paths. Automated validation does not replace testing on every client and display configuration.

Checksums

bd656cf0e98d463922e5c924450c08ce8ca6d652960e323a88d6920c33ede2e9  LuminalShine_x64-debuginfo.7z
f8710c2c69d90daaa6a39942e536f129fa947dc1123a44ed0c6ea616047b52aa  LuminalShine_x64-installer.exe
6cf638022613249a9e8eb37cefd009aeb61a7d467590473e2c4bca0fda7edba7  LuminalShine_x64-portable.zip

Full changelog: 26.10.1…26.11.0