WorldScript Studio v1.21.0 — Integrity & Hardening

StoryCraft Studio v1.21.0 — Integrity & Hardening

An integrity & hardening release closing all nine findings (F-1…F-9) of the 2026-06-09 deep audit, plus the post-v1.20.0 feature work.

Highlights

• Security — CSP: connect-src resolved to a documented BYOK tradeoff (ADR-0004) with a regression test; native Tauri CSP stays strict.
• AI: @huggingface/transformers 4.2.0 verified against the ai-core/voice stack; Whisper WASM model-download flow + VAD→Whisper bridge ship.
• Quality gates: new suppression-debt ratchet in CI (baseline 159; 22 noExplicitAny paid down) and a single-source bundle-budget; new docs/COVERAGE-POLICY.md + VENDOR-FORKS.md CVE/OSV process.
• UX / i18n: Sepia "Candlelit Manuscript" dark theme; Chinese (zh) + pt/el Beta locales under the 5% placeholder target (11 locales × 2 357 keys).
• Testing: deep E2E coverage layer (feature-flag matrix + error paths).

Full per-change detail: CHANGELOG [1.21.0].

Desktop installers (macOS .dmg, Windows .exe/.msi, Linux .AppImage/.deb/.rpm) are attached below.

---

What's Changed

• fix: LanguageSelector dropdown z-index stacking context for Settings … by @qnbs in #86
• feat: Native File Associations (.storycraft/.scst) and Single-Instance behavior by @qnbs in #87
• Deep Audit Correction v1.21: pt/el Translations + Whisper WASM STT Download by @qnbs in #89
• build(deps): bump @mlc-ai/web-llm from 0.2.83 to 0.2.84 by @dependabot[bot] in #101
• build(deps-dev): bump wrangler from 4.94.0 to 4.98.0 by @dependabot[bot] in #99
• build(deps): bump @ai-sdk/openai from 3.0.65 to 3.0.68 by @dependabot[bot] in #97
• build(deps-dev): bump vite from 8.0.14 to 8.0.16 by @dependabot[bot] in #96
• build(deps): bump @tanstack/react-virtual from 3.13.26 to 3.14.2 by @dependabot[bot] in #95
• build(deps): bump @google/genai from 2.6.0 to 2.8.0 by @dependabot[bot] in #94
• build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @dependabot[bot] in #91
• build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #90
• build(deps-dev): bump @biomejs/biome from 2.4.15 to 2.4.16 by @dependabot[bot] in #98
• build(deps): bump @huggingface/transformers from 3.8.1 to 4.2.0 by @dependabot[bot] in #100
• build(deps-dev): bump tsx from 4.22.3 to 4.22.4 by @dependabot[bot] in #93
• build(deps-dev): bump @types/react from 19.2.15 to 19.2.17 in the react group across 1 directory by @dependabot[bot] in #92
• feat(deep-audit-v1.21): CSP hardening + zh locale + coverage batches + VAD→Whisper WASM bridge by @qnbs in #102
• test(e2e): deep coverage — feature-flag matrix, error paths, Stryker CI-only guard by @qnbs in #103
• chore: v1.21.0 Integrity & Hardening Cycle (F-1…F-9) by @qnbs in #104
• chore(release): v1.21.0 by @qnbs in #105

Full Changelog: v1.5.0...v1.21.0