3 people 6b0df68cc6 Security: EPS and legacy Illustrator bounds (operator recursion, bind, copy, cvn, previews, writer output, ink name) (#3883) ...

* Audit: EPS interpreter and import bounds

* Audit: EPS writer stops expanding at 256 MB of body

* fix(eps): enforce MAX_BODY budget before committing node and image output

* chore(text): use is_some_and instead of unnecessary map_or (clippy)

* Fix clippy unnecessary_map_or false-default in ITXT compression flag scan

* Reject EPSI previews with an odd number of hex digits

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Dylan Taylor <dylan@craftmaker.dev>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-25 12:32:14 -04:00

..

affinity

style: keep paint.rs spot-colour chain under rustfmt's max width (#3940)

2026-10-24 02:03:48 -04:00

brush

style: keep paint.rs spot-colour chain under rustfmt's max width (#3940)

2026-10-24 02:03:48 -04:00

cad

Keep escaped backslash literal before U+XXXX in DXF MTEXT

2026-10-24 20:54:42 +07:00

color

Color management: loading the working RGB profile again under its name takes effect at once

2026-10-24 19:36:34 +02:00

doc

Merge pull request #4070 from marcoarnulfo/fix/direct-select-type-on-path

2026-10-25 10:56:10 -04:00

effects

Fix #3964: Create Outlines, EPS, EMF/WMF and legacy .ai keep the ruby where the canvas draws it

2026-10-24 17:29:32 +07:00

engine

Merge pull request #4070 from marcoarnulfo/fix/direct-select-type-on-path

2026-10-25 10:56:10 -04:00

eps

Security: EPS and legacy Illustrator bounds (operator recursion, bind, copy, cvn, previews, writer output, ink name) (#3883)

2026-10-25 12:32:14 -04:00

format

Reject misplaced or excess '=' padding in base64_decode

2026-10-25 12:00:58 +00:00

geom

Security: bounded flattening, plug-in budgets and caches, loaded textures, Revolve paint copies, color book names and ICC names

2026-10-24 17:19:54 +07:00

mcp

Merge pull request #4068 from dotCooCoo/fix/eps-no-art-central-file-text

2026-10-25 10:38:12 -04:00

metafile

Fix #3964: Create Outlines, EPS, EMF/WMF and legacy .ai keep the ruby where the canvas draws it

2026-10-24 17:29:32 +07:00

pathops

G11: Shape Builder's edge-source index is a grid, so diagonal hatches are no longer quadratic

2026-10-24 20:39:53 +07:00

pdf

Fix #3621: bound function-based shading reads per import

2026-10-24 19:27:44 +07:00

plugins

Security: bounded flattening, plug-in budgets and caches, loaded textures, Revolve paint copies, color book names and ICC names

2026-10-24 17:19:54 +07:00

render

Renderer tests: the Arabic alternate-glyph tests take the font lock

2026-10-24 23:49:34 +07:00

scriptcheck

fix(scriptcheck): settle what variables hold without a loader too

2026-10-24 21:10:06 +07:00

svg

Require two hex digits in SVG href percent escapes

2026-10-24 23:32:52 +07:00

testkit

Main's CI: an unnecessary map_or, testkit's Unix-only mut, and a temp-dir probe that tests running alongside removed

2026-10-24 09:26:06 +07:00

text

Type: threaded frames do not repeat a continued paragraph's first-line indent or list marker

2026-10-24 21:43:44 +07:00

three-d

3D and Materials: Extrude & Bevel and Inflate build a solid from each stroke's outline

2026-10-19 21:51:26 +07:00

tools

Merge pull request #4070 from marcoarnulfo/fix/direct-select-type-on-path

2026-10-25 10:56:10 -04:00

trace

Merge pull request #4077 from dotCooCoo/fix/trace-palette-drops-unused-colors

2026-10-25 10:38:08 -04:00

ui-egui

Merge pull request #4090 from marcoarnulfo/feat/recolor-picker

2026-10-25 10:56:13 -04:00