Launcher v2.2.1

What's changed

• Migrating from Ballista no longer removes the Ballista config. The legacy ballista-data.json (or catapult-data.json) is copied instead of moved, so Ballista keeps working side by side with Launcher. (#22, fixes #20)
• launcher-data.json is tightened to owner-only permissions (0600) at startup. Configs migrated from legacy launchers carried the legacy file's looser permissions; startup now corrects that, including for installs migrated by older versions. (#27, fixes #26)
• August dependency update across the Rust and JS trees, clearing all published advisories (h2, Nuxt, PostCSS, tar, nanoid, and others). (#19)
• CI's cargo audit now runs with no advisory ignores; the quick-xml version that required them is gone from the tree. (#23, closes #10)

Thanks

• @edthri for the dependency update (#19) and the config migration fix (#22)
• @jonbartels for reporting the Ballista config removal (#20)

Downloads

File	Platform
Launcher_2.2.1_universal.dmg	macOS (Intel & Apple Silicon)
Launcher_universal.app.tar.gz	macOS app bundle (Intel & Apple Silicon)
Launcher_2.2.1_x64-setup.exe	Windows x64 installer
Launcher_2.2.1_x64_en-US.msi	Windows x64 MSI
Launcher_2.2.1_arm64-setup.exe	Windows ARM64 installer
Launcher_2.2.1_arm64_en-US.msi	Windows ARM64 MSI
Launcher_2.2.1_amd64.AppImage	Linux x86_64 AppImage
Launcher_2.2.1_amd64.deb	Linux x86_64 deb
Launcher-2.2.1-1.x86_64.rpm	Linux x86_64 rpm
Launcher_2.2.1_aarch64.AppImage	Linux ARM64 AppImage
Launcher_2.2.1_arm64.deb	Linux ARM64 deb
Launcher-2.2.1-1.aarch64.rpm	Linux ARM64 rpm

Launcher v2.2.0

What's new in v2.2.0

Fixes

• Mirth 4.7.x administrators now launch. The launcher preserves the JNLP-declared jar order when building the classpath, so Mirth's patched overlay jars load ahead of their stock counterparts. This fixes the IllegalAccessError on org.mozilla.javascript.NativeDate that broke login on 4.7.x. (#12)

Features

• Cache-collision warning. If two connections share an engine type and version but point at different engines, they share one cache directory. The launcher now detects when the cached jars don't match what the server sent and asks before overwriting, instead of silently mixing a foreign engine's jars into the classpath. (#14)

Security hardening

• Added a restrictive Content-Security-Policy to the app windows, and bundled the icons locally so nothing is fetched from the internet at runtime. (#13)
• The connections file (which holds saved passwords) and the .launcher directory are now created owner-only (0600 / 0700) on macOS and Linux. (#13)
• A console window can no longer subscribe to another console's output. (#13)
• Dependency security updates: tauri, quinn-proto, bytes, rustls-webpki on the Rust side, plus the July npm-audit sweep (esbuild, vite, h3, node-forge, tar, ws, and more). (#5, #7)

Internal

• CI now runs cargo audit and npm audit, gates merges on an aggregating check, and cuts releases from a pushed version tag instead of on every push to master. Added a RELEASING.md. (#11, #15, #16)

Thanks

• @edthri for the July dependency and security updates (#5, #7).

---

See the assets below to download and install this version.

File	Platform
Launcher_2.2.0_universal.dmg	macOS (Intel & Apple Silicon)
Launcher_2.2.0_x64-setup.exe / _x64_en-US.msi	Windows x64
Launcher_2.2.0_arm64-setup.exe / _arm64_en-US.msi	Windows ARM64
Launcher_2.2.0_amd64.AppImage / _amd64.deb / .x86_64.rpm	Linux x86_64
Launcher_2.2.0_aarch64.AppImage / _arm64.deb / .aarch64.rpm	Linux ARM64

Launcher v2.1.0

The v2.1.0 binaries were removed. This release is superseded by v2.2.0, which includes all of its fixes. See the latest release for downloads.

Launcher v2.0.2

The v2.0.2 binaries were removed as part of release-asset cleanup. Superseded by v2.2.0; see the latest release for downloads.