A `trailer` marker inside an unreferenced stream followed by `(` and more
than 4 KiB of text made the lexer stop at the window's end, so a later
`/Encrypt` name anywhere in the file refused a plain file. The unbounded
scan read a string there and opened it. The past-the-window fallback now
applies only when no object starts in the window or the first one opens
a dictionary (`<<`, including one split by the window's end).
Regression test with `trailer(` and `trailer[` in a stream and a later
Encrypt name.
The pre-scan window could end inside a trailer key, so a decoy like
`/Encrypted` cut right after `/Encrypt` was taken for the Encrypt key
and an unencrypted file was refused. A window that ends mid-token now
ends before that token instead, and the past-the-window fallback reads
the name whole (a real `/Encrypt` cut as `/Encryp|t` is still refused).
Tests for that boundary, for a trailer with a long /ID, and for `#`
without two hex digits staying as written in a name.
The fallback searched for the literal bytes `/Encrypt`, so a long trailer
with the key written as `/Encr#79pt` (or any other #-escaped spelling) got
past it. It now finds the last name token that decodes to `Encrypt`, with
the lexer's own name decoding, and checks whether that token ends past the
window. It is still one linear pass per file. Longer names that only start
with `Encrypt` (`/Encrypted`) no longer count.
The pre-scan lexed one object after every `trailer` marker over the rest of
the file, so an unterminated string or dictionary after each of many markers
made opening a crafted PDF quadratic. Each lex now gets a 4 KiB window; when
it runs out, the file is refused if `/Encrypt` appears past the window (one
search per file), so long trailers can't hide the key.
#1339 was written before ui-egui's integration tests became modules of one binary
(`tests/it/main.rs`), so its six test files landed at the top of `tests/`, each its own crate
and link. They move into `tests/it/` as modules; the a11y module's doc names the new path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Since #2204, ci.yml runs `cargo xtask ci` through craft-common-actions' shared gate on every
pull request and push to main; gaps.md still listed "No CI gate on pull requests" as gap 4 and
in the Stability row.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
File ▸ Export ▸ Adobe Premiere Pro Project… pre-rendered every layer Premiere can't show to
ProRes 4444 with the window waiting: minutes on a large comp, which Windows reports as not
responding. The export now runs as a job (Window ▸ Progress, cancellable, with per-layer
progress) when started from its dialog (`background: true`); without it, the command still
waits and returns the same result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
UPDATE_APP gains our accent (#e0368f, our colour in ArtCraft Launcher). The prompt draws it
on the UPDATE chip, the buttons and the What's new underline, and says "by ArtCraft"
(craft-update's default developer); #2646 gave it our icon.
craft-update is pinned to storytold/craft-libs main at 1065653e7 (#434).
A slip on a layer with no source handles succeeded with `delta: 0` and nothing else, which
read like a no-op bug. The result now carries `requested` (seconds) and, per layer, `clamped`
when the source could not move that far.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Timeline and Effect Controls value editors sent every write with the property's scrub merge
key, so two separate picks from a drop-down (or two check box toggles) on the same property
folded into one undo step. Drop-down, check box, layer and mask picks now record their own
step; scrubs and typed numbers still merge as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Main routes viewer scrolling through viewer_scroll, so a raw-event scrub fought the wheel zoom. With general.viewerWheelScrubbing on, an unmodified wheel steps frames and the rest of that notch does not zoom or pan. The preference stays off, so the wheel still zooms.
- ui_accessibility_audit: main's new Character panel controls (stroke width presets, line
join, stroke order) raise Character:default to 46 findings (22 unnamed); the ratchet entry
follows, since that panel is not yet audited. The control filter is written as clippy's
nonminimal_bool asks.
- ui_timeline_shapes (main's #2513 test): this PR names the Properties panel's Position row,
so "Position" is no longer unique; the test takes the Animate menu's new entry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
becauseno7