Release Notes for 32.6.1
Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
ChangeLog:
- Uses electron 44.9.3
- Includes the Electron mitigation for the compromised eMudhra intermediate certificates [GHSA-jr5w-w6x2-84p9]
- Updates to draw.io core 32.6.1. All changes from 32.5.5 to 32.6.1 are added in this build.
Testing:
Verified against the packaged, signed macOS build. Windows and Linux packages were verified from the produced release artifacts, their sizes and update manifests, rather than by running them.
Base checks
- Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste through the system clipboard, save, reopen, insert, rename and delete pages, and zoom
- Export to PNG, JPEG, SVG, PDF, XML and HTML from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page, and PNG and PDF export from the app
- Diagram round trip in exported PNG, SVG and PDF files, including reopening an exported PDF and recovering both pages
- Mermaid and CSV import and the --layout and --normalize options from the command line
- Shape search, the stencils and shape palettes, the export dialogs and the print dialog
- Settings and the window position are kept after a restart
- Quick Look preview on macOS is registered for this build, and the Quick Look app extension is sandboxed and separately signed
- The macOS bundle is a universal binary signed with a Developer ID certificate under the hardened runtime, notarised and stapled
- The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
- 286 unit tests pass
Electron 44.9.3
- The app runs on Electron 44.9.3 with Chromium 152.0.7977.167; Electron lists 44.9.1 and later as patched for [GHSA-jr5w-w6x2-84p9]
- Local fonts are listed, and PDF and PNG export through the main process work on the new runtime
Checks around the changes
- Links that start with a slash are kept as they are in SVG exports from the app and from the command line, instead of becoming file:// links [jgraph/drawio#5809]
- Other links in SVG exports are written as before, and javascript: links are still not exported as runnable links
- The updated Citrix 2 shapes render, with no two connection points closer than 8 % of the shape
- The zoom, fit and close buttons of presentation mode respond to mouse clicks
- Reads, stats and writes of paths the user has not authorised are still refused, while an authorised file still reads and saves
- file: and javascript: links are still refused when a link is opened externally
- All update manifests name 32.6.1, with the Windows x64 and arm64 installers in separate manifests