Commit Graph
2518 Commits
Author SHA1 Message Date
Dylan M. Taylor 645b683a77 Merge pull request #2061 from storytold/sonar-fix/js-csprng
security: use crypto.randomUUID for temp file suffix (SonarCloud S2245)
2026-10-22 19:27:53 -04:00
Dylan M. Taylor ec0cc83a29 fix(web): fall back to network when caches.open fails in service worker 2026-10-22 19:19:20 -04:00
Dylan M. Taylor 6871aa2236 security: check crypto.randomUUID availability in canMove 2026-10-22 19:19:19 -04:00
Anubhav-RaiandClaude Opus 5 6e3b5eb3e3 engine: deleting a layer clears the references to it (#2153)
Nothing cleared a `Value::Layer` reference when its layer was deleted, so the id stayed behind:
`env_pixels` resolved it to nothing and rendered no environment at all, while the UI showed "None",
which is documented as "fall back to the comp's Environment Layer". The delete path already
unparents children and drops a track matte that pointed at a deleted layer; a layer reference now
goes the same way, in the same history step, so undo restores the layer and the reference together.

This covers every layer-reference property, not only an Environment light's Source: 73 of them
across the effects (Clone Source, Set Matte, Back Layer, Water Surface, Sky, Ground…). Keyframes
carry the same value kind as the property, as in `essential.rs`, and are fixed too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-10-23 04:41:11 +05:30
Anubhav-RaiandClaude Opus 5 88045641f3 script: comp.width and comp.height resize the frame without moving the layers (#1942)
The setters go through `comp.settings`, which defaults to the Composition Settings dialog's
centre anchor, so `comp.width = 800` on a 400-wide comp shifted every unparented layer — and
all of its position keys — by 200 px. A script that resized a precomp then found its pixel
coordinates had moved under it.

After Effects' width and height setters only change the frame; moving the contents is what
"resize from centre" scripts do for themselves. The setters now pass `anchor: 0` (top left).
The dialog, which is where the anchor belongs, is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-10-23 02:48:28 +05:30
zitann2020andDeepSeek V4.1 Flash 0cf7324d7c i18n(ja): AE says 縦横比, not アスペクト比
The Composition Settings dialog draws 「ピクセル縦横比」 and 「フレーム縦横比」, and its checkbox reads
「縦横比を 1:1 (1.00) に固定」. Three existing rows said アスペクト比.

Co-Authored-By: DeepSeek V4.1 Flash <noreply@deepseek.com>
2026-10-23 05:10:29 +09:00
Brandon ThomasandClaude Opus 5.5 15b8a916c5 Release 0.15.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v0.15.0
2026-10-22 15:39:32 -04:00
MarekSpodBiedry a07eb51dbf Fix u32 overflows in PDF CID width tables and CMap ranges (#2147) 2026-10-22 21:10:05 +02:00
Barzabel 210af24abf svg: allocate a CSS block only for accepted selectors; charge class tokens (#2140) 2026-10-22 21:24:33 +03:00
Christopher Linnett 174f401fe1 timeline: pick layer-valued properties from a layer drop-down (#2093)
The Timeline drew a layer-valued property (an Environment light's Source, a
Displacement Map's layer parameter) as read-only text holding the raw layer
id, so a light's Source could not be chosen in the UI at all - only through
prop.set from the command line, scripting or MCP. Effect Controls already
had a working drop-down for exactly these values: extract it into one shared
widgets::layer_picker (the current entry, "None" first, then "N. name" for
every layer of the comp, the list built only while the popup is open) and
draw it from both panels.

In the Timeline the pick writes through the same set closure as every other
value arm - an undoable prop.set (layer id, or null for None) - and
registers timeline.prop.<uid>.value like its neighbours, so the row names
the layer instead of exposing its id. Effect Controls keeps its rect,
automation id and write; its closed dropdown's "None", previously a
hardcoded literal, now follows the interface language. The dead "Layer {n}"
id text leaves the i18n catalogs with it.

ui_layer_source_picker drives both panels headlessly (open, pick, undo,
dismiss, current-entry highlight, translated None, picking None to clear a
set value), and an ignored wgpu snapshot test keeps the visual record
reproducible.
2026-10-23 01:47:55 +08:00
Barzabel ee13586814 svg: share CSS declaration blocks and cap <style> work (#2140)
Every selector of a comma list cloned the whole declaration block, and every
element scanned every rule, so a sub-megabyte <style> could demand billions of
string pairs. Selectors now index one shared block, the sheets are capped at
20 000 selectors and 50 000 declarations, rules are bucketed by id/class/type
so an element checks only candidates, and matching work over all elements is
charged against a 50M-step budget that fails the import instead of doing it.
2026-10-22 20:28:49 +03:00
NetterSilverandClaude Haiku 5.5 ed532afe72 Return None from Mat4::inverse for non-finite input
Found while testing crates/geom/src/lib.rs:362-390 (pivot check at line 367)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-22 19:12:38 +02:00
NetterSilverandClaude Haiku 5.5 fdfa286079 Keep rgb_to_hsv and rgb_to_hsl hue within 0..1
Found while testing crates/color/src/lib.rs:133 (rgb_to_hsv) and :96 (rgb_to_hsl)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-22 16:14:46 +02:00
NetterSilverandClaude Haiku 5.5 52bfb9c4bb Reject non-hex characters such as '+' in Rgba::from_hex
Found while testing crates/color/src/lib.rs:40-47

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-22 16:06:19 +02:00
skylar taylor-barrick b55cb5bc15 Merge pull request #1363 from DWAA1660/fix/1237-comp-contains-cycles
Project: comp_contains walks precomps with a visited set, not recursion (#1237)
2026-10-22 07:52:56 -06:00
skylar taylor-barrick 571aebd854 Merge pull request #1957 from Anubhav-Rai/script-value-dims
script: setValue rejects an array of the wrong dimension (#1936)
2026-10-22 07:52:51 -06:00
skylar taylor-barrick 831e719fa2 Merge pull request #1855 from CharlesBaumer/fix/doc-path-stills-windows
Windows: two fixes so cargo xtask ci gets past clippy and the media tests
2026-10-22 07:52:46 -06:00
skylar taylor-barrick 70763d74c0 Merge pull request #1966 from Silvertree2010/fix/h930-deleting-the-first-vertex-of-a-c
Fix feather points when deleting first vertex of a closed mask path
2026-10-22 07:52:39 -06:00
skylar taylor-barrick be4d2d7bb8 Merge pull request #1992 from Silvertree2010/fix/h1142-sampleimage-panics-with-integer
Fix integer overflow in sampleImage for huge sample points
2026-10-22 07:52:31 -06:00
skylar taylor-barrick a9c2bfa6eb Merge pull request #1902 from Silvertree2010/fix/h704-hsv-to-rgb-returns-magenta-for-a
Fix hsv_to_rgb returning magenta for tiny negative hues
2026-10-22 07:52:17 -06:00
skylar taylor-barrick 1348621007 Merge pull request #1989 from Silvertree2010/fix/h1084-path-rect-panics-when-both-size
Fix panic in path::rect when both size components are NaN
2026-10-22 07:52:11 -06:00
Madhav Agarwal 3306bf2296 ui: Spacebar hand pans timeline rows vertically (#2083) 2026-10-22 19:15:34 +05:30
Madhav Agarwal 7fe0513894 engine: split layers above the original by default (#2083) 2026-10-22 19:13:36 +05:30
Madhav Agarwal ffe3c913e1 ui: scrub hot text from the slider range (#2097) 2026-10-22 19:05:30 +05:30
Madhav Agarwal 963f489eab engine: resolve effect match-name paths in prop_ref (#2064) 2026-10-22 18:47:59 +05:30
Madhav Agarwal 3f4ffdc0fc engine: a keyframe on the out point no longer warns (#2084) 2026-10-22 18:41:26 +05:30
Egon 5000 a59e7ad67f Timeline: assert the full search-row hierarchy for the elided Contents, add docstrings
The search test now pins every row (layer, Contents, group, path/fill/
Transform) so a future regression that re-adds the inner Contents row or
reorders the flattening fails loudly. Docstrings cover the functions the
diff touches (group_row, all, rec, push_group) for CodeRabbit's
docstring-coverage pre-merge check.
2026-10-22 14:59:25 +02:00
BFlat 9a51a05e1b Merge pull request #2099 from storytold/readme/app-icon
README: the app icon above the title
2026-10-22 18:01:35 +07:00
bflatastic 7d68a74ffc README: the app icon above the title 2026-10-22 17:57:40 +07:00
Dylan M. Taylor f37f20ffd0 Merge pull request #2059 from storytold/sonar-fix/enforce-https
security: enforce HTTPS on curl downloads (SonarCloud S6506)
2026-10-21 20:13:41 -04:00
Dylan M. Taylor 7983396692 fix: JS reliability bugs (SonarCloud S1764, S9383, S4275)
- scriptui.js: replace the self-comparison NaN check (o.max === o.max) with
  the explicit Number.isNaN(o.max) (S1764).
- sw.js: mark the fire-and-forget cache.put() with void and a .catch() so the
  promise rejection is handled (S9383).
- prelude.js: return __err(...) from the activeCamera getter so every path
  yields a value (S4275); __err always throws, so behavior is unchanged.
2026-10-21 17:20:35 -04:00
Dylan M. Taylor 887fe3a3a8 security: use crypto.randomUUID for temp file suffix (SonarCloud S2245)
Replace Math.random() with crypto.randomUUID() when generating the unique
suffix for the atomic write-then-move temp file. The value isn't security-
sensitive, but a CSPRNG gives a stronger uniqueness guarantee and resolves
SonarCloud javascript:S2245.
2026-10-21 17:14:27 -04:00
Dylan M. Taylor 5003351186 security: enforce HTTPS on curl downloads (SonarCloud S6506)
Add --proto '=https' to curl invocations so redirects cannot downgrade to
plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions).
2026-10-21 17:06:49 -04:00
Dylan M. Taylor cee4c16c8a ci: add sonar-project.properties for CI-based analysis
Marks the project ineligible for SonarCloud Automatic Analysis, resolving the
CI-vs-automatic-analysis conflict so the SonarCloud workflow succeeds.
2026-10-21 16:00:34 -04:00
Dylan M. Taylor 714b6c29b0 ci: add SonarCloud scan via shared reusable workflow
Calls storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
with secrets: inherit. Adds SonarCloud badge to README where missing and
removes the redundant sonar-project.properties (config now passed by the
reusable workflow).
2026-10-21 15:46:55 -04:00
tylerjenningsw c601829be1 3D: drop the NewPrimitive variant's doc comment (#1734) 2026-10-21 14:57:06 -04:00
tylerjenningsw c21210a63a 3D: close the New 3D Primitive dialog when its project or comp changes; untouched dimensions take the type's defaults (#1734)
The draft records the project epoch and comp it was opened for. A script or the
control channel opening a project or activating another comp while it is open
closed nothing before, and OK added the primitive (and switched to Advanced 3D)
in whatever comp was active then, even in a new project reusing the comp id.
2026-10-21 14:51:41 -04:00
Brandon ThomasandClaude Opus 5.5 26b40199b7 Release 0.14.0
FreeBSD aarch64: build with 16 codegen units and no LTO in the emulated release VM, which ran past
the job's 5-hour limit with the single-unit thin-LTO profile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v0.14.0
2026-10-21 14:04:43 -04:00
Dylan M. Taylor ec2d51a17a ci: add SonarCloud scan workflow and config 2026-10-21 13:55:18 -04:00
tylerjenningsw cb561a6a3d 3D: test the New 3D Primitive dialog from a blank comp (#1734) 2026-10-21 13:31:59 -04:00
tylerjenningsw f14a57fb3e 3D: Layer > New > 3D Primitive... dialog for a primitive's type, name and dimensions (#1734)
OK runs layer.newPrimitive, which switches a Classic 3D comp to Advanced 3D in the same undo step. The dimension fields are the Geometry Options the engine builds for the chosen type.
2026-10-21 13:31:58 -04:00
tylerjenningsw 83cd74c730 Light Settings: test which options each light type shows, and undoing Environment to Spot (#1588) 2026-10-21 13:14:46 -04:00
tylerjenningsw b9929c2d71 Light Settings: test Environment lights and the other types through the dialog (#1588) 2026-10-21 12:41:50 -04:00
tylerjenningsw 17d57a6705 Light Settings: list Environment and keep an existing light's type (#1588)
The dialog offered four hard-coded light types and reopened an Environment light as Spot, so OK turned it into one. It now lists every light type the engine has, keeps the light's own type, and shows Falloff and Shadows only for lights that have them.
2026-10-21 12:41:50 -04:00
arnav-hiwarkarandClaude Opus 5.5 506a5b327f Timeline: the disk-cache bar checks only the visible frames
- `Frames::disk_frames` takes a frame range instead of a frame count, still clamped to the existing 100,000-frame limit.
- The Timeline passes the visible range (`disk_bar_range`), including frames only partly in view, and clips the blue bar to the work-area row.
- Membership stays live: nothing is cached, so the bar updates as before when frames are written, evicted or promoted to RAM.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 21:47:18 +05:30
arnav-hiwarkarandClaude Opus 5.5 b48a77cf70 Preview: a zoom or resolution change evicts the other sizes' frames first
`crates/ui-egui/src/frames.rs`:

- The cache remembers the scale of the frame on screen (the active viewer's urgent request). Prefetch and passive viewers don't change it, so a second viewer at another zoom can't evict the active viewer's frames.
- RAM and GPU eviction take frames of other scales first, then fall back to the existing playhead-aware order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 21:46:39 +05:30
arnav-hiwarkarandClaude Opus 5.5 2b3732153b GPU: devices favour memory use, so Purge and Close give video memory back
Both devices EffectCraft creates now ask for `MemoryHints::MemoryUsage`:

- the window device (`apps/effectcraft/src/main.rs`, through a new `device_descriptor` helper);
- the headless compositor device (`crates/gpu/src/context.rs`).

The limits, labels, features and error paths are unchanged. The devices tests create stay as they were.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 21:45:28 +05:30
arnav-hiwarkarandClaude Opus 5.5 c9323afe1d Save: check the file's values without reparsing it in release builds
- New `crates/project/src/file_check.rs`: a no-output `Serializer` that walks the value once. It refuses non-finite numbers and nesting past 127 levels, and it allocates only on error.
- `to_file_json_with_view` runs that check, then writes the file. It also refuses a project schema newer than this build, the remaining thing `from_json` would reject in a file we wrote.
- **Debug builds still reparse the text as well**, so a new kind of mismatch still shows up in tests.

The bytes written are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 21:34:59 +05:30
arnav-hiwarkarandClaude Opus 5.5 ca88af2b5f Fractal Noise: resolve the Blending Mode once per layer, not per pixel
`crates/effects/src/noise3.rs` only:

- a `blend_mode(u32) -> Option<BlendMode>` helper, which the CPU and GPU paths now share;
- the CPU `render` resolves the mode once and passes `Option<BlendMode>` to the per-pixel `composite`.

The semantics are unchanged: None means the noise alone, and an unknown index means Normal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 21:34:45 +05:30
Madhav Agarwal 5668196288 docs: escape the backtick in the twirlSelected shortcut (#2025) 2026-10-21 20:57:08 +05:30