Release UnrealLauncher v2.2.5 · NeelFrostrain/UnrealLauncher

[2.2.5] - 2026-05-24 — `hotfix`

Path traversal vulnerability in protocol handler — Eliminated critical security vulnerability by adding directory whitelist validation to the local-asset:// protocol handler. All file access is now restricted to resources/ and out/renderer/ directories. Unauthorized access attempts return 403 Forbidden with security logging.
Unvalidated Discord webhook URLs — Added URL validation for Discord webhooks. Validates protocol (HTTPS), hostname (discord.com), and path structure. Prevents sending webhooks to malicious URLs.
Path traversal protection refinement — Normalized path separators to forward slashes for consistent validation. Now correctly allows legitimate files (project thumbnails, plugin icons) while blocking malicious access attempts.

Engine plugins tab freeze — Fixed CRITICAL UI freeze when navigating to Engines → Plugins tab. Converted synchronous plugin scanning to async using fs.promises with event loop yields. Main thread no longer blocks during plugin directory traversal.
Engine plugin icons not loading — Fixed path traversal protection blocking plugin icons at Engine/Plugins/*/Resources/Icon128.png. Icons now display correctly.
Project thumbnails not loading — Fixed path traversal protection blocking project thumbnails at Saved/AutoScreenshot.png and Saved/Thumbnail.png. All project cards now display thumbnails.

Git status cache memory leak — Added AbortController for in-flight git status requests. Requests are now properly cancelled when cache is cleared, preventing memory accumulation.
Memory leak in Discord Rich Presence — Added clearReconnectTimer() cleanup in resetConnectionState(). Reconnect timers are now properly cleaned up on disconnect.
Unbounded toast history memory leak — Added timeout tracking with Map. Timeouts are cleared on component unmount and manual removal. Limited to 5 toasts maximum.
Missing cleanup in useTracerSettings hook — Added timeout tracking with useRef. All pending timeouts are cleared before adding new ones and on unmount.
Missing cleanup in useProjectActions — Added timeout tracking in handleAddProject() to prevent leaks during folder selection.
Missing cleanup in useEngineActions — Added timeout tracking in handleAddEngine() to prevent leaks during engine folder selection.

Inefficient project deduplication — Optimized from O(n²) to O(n) using Map-based approach. Projects with 100+ items now deduplicate 50-70% faster.
Synchronous file operations blocking main thread — Converted isProcessRunning() and killProcess() to async using execFile. Process checks no longer freeze the UI. Added 5-second timeout.
Reduced memory allocations — Optimized store operations and project list handling for faster startup.

Race condition in concurrent project scans — Replaced mutable property flag with promise-based approach. Concurrent scan requests now return the existing promise, preventing data corruption.
Silent failures in store operations — Added comprehensive error logging to saveEngines(), saveProjects(), and saveMainSettings(). Errors are now captured and logged for debugging.
Child processes not tracked — Added tracking of all spawned child processes (registry updates, tasklist checks, tracer). All processes are properly killed on app quit.
Unhandled promise rejections in useTracerSettings — Added .catch() handlers to all IPC calls. Gracefully handles IPC failures without crashing.
Missing error handling in useEngineActions — Added error logging to handleDelete() and handleAddEngine() for better debugging.