The primary item and the selected thumbnail are scanned before Context::grid rebuilds their descriptors, every tile reference is counted (repeats included) before the size check dedupes them, and the Exif and XMP items are scanned before they are read.
XMP flattening, sparse-focus EXIF decode (plus the maker-note and TIFF value
budgets), lossy-DNG chunk staging, panorama stitch frames, the reference ONNX
executor's tensors and the denoise product reader all now reject or cap what a
malformed file can make them allocate: each result is checked before the
memory behind it is reserved, every regression carrying a test that fails
without its bound.
Sparse walkers, truncated MEF/lossy-JPEG strips, embedded JPEG sizes, the
CR3 preview marker walk, OpcodeList3 full-image passes and caller-supplied
Deflate tile edges each let a small file or one bad argument multiply
allocations or CPU work thousands of times. Each path now is bounded,
every fix with a regression test that failed (or blew up) before it, plus
a tiff::image single_chunk helper so preview extraction never builds a
descriptor vector for a hostile multi-strip layout.
heic-rs has no aggregate work budget in container parsing: ipma
association entries rescan earlier item ids after each other and an
iloc construction-method-2 extent rebuilds its source item afresh. Cap
the ipma/iloc boxes before heic-rs reads them, and stop probe paying
for a reconstruction heft beyond the file's own size. decode: refuse
files carrying more than 12 container transforms (each would re-copy
the full picture; CodeRabbit row #44), check a grid's payload canvas
against the pixel limit before allocating for it (#48), and to_rgb16
refuses an oversized w*h*ch rather than asking for a multi-gigabyte
buffer.
Wake the UI when a manual check is queued from a menu callback; the update prompt owns the keyboard while it is open (LightCraft); Download opens through the desktop URL hook (FilmCraft); the Help menu dispatches through menus::invoke (FigCraft); print jobs and comment drafts hold an install back (WordCraft); Check for Updates is a registered command (GridCraft); an install holds back while documents are unsaved.
The update flow (check at start or on request, the startup prompt, the self-update worker) is craft-update's Updater; the app only supplies the suite, its close path and its status window. The check at start is opt-in for the desktop app, and the Windows update helper runs before argument parsing.
Ref: storytold/craft-libs#319
* LR-PREF-SHORTCUTS: the shortcuts panel's Fixed keys ignore keys saved for unknown commands
* KEYC-METADATA: an Add Keywords request the Keywords panel can't take in time expires
* LR-META-INFO: Target Photo saves an Info edit to the photo it shows
Preserve current main, adapt frame/input and IME handling, and keep library
check results stable across layout passes. Include the matching Nix font lock
and reviewed attribution changes.
When a hidden panel's anchor is neither shown nor hidden, craft-ui falls
back to the given anchor's tabs. The photo view is that anchor and takes no
tabs, so the panel opens beside it on its default side instead of at the
right edge. Test: Library anchored on an absent Presets opens to the left
of the photo.
Lightroom Classic's keyboard shortcut page lists Command+K (Ctrl+K on
Windows) for Add keywords. LightCraft had no key for it.
Add Keywords (panel.addKeywords, Cmd+K) shows the Keywords panel,
opens its Keywording section when it is folded shut, and puts the
cursor in the Add keyword box, so the next keywords typed go to the
selected photos. Pressed again, it leaves the panel open. With no photo
selected the panel shows its note, and selecting photos later does not
move the cursor into the box.
The command label has a row in every catalog. The KEYC-METADATA row,
docs/ui-parity.md and docs/library-shortcuts.md list the key. The
KEYC-METADATA row also lists the existing Alt+1 to Alt+9 keyword set
keys in place of "no keyword sets".
Dylan M. Taylor