* PPTX: evaluate a custom geometry's guide lists once per coordinate space
* address review: exempt guide-free geometries from the space cap
* address review: budget guide-name bytes cached across coordinate spaces
* Apply review fixes
- crates/pptx/src/custgeom.rs
* fix(pptx): warn when custom geometry paths are left out for the guide-cache limits
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
Review fixes: an entry's size, weight and colour are read from its
paragraph (a:p) first and from a:lstStyle only where the paragraph
sets none, as DrawingML inherits them; the writer keeps sizes to the
reader's 1-400 pt, so a size reads back as written; and the legend
draws an entry at its own size up to 400 pt rather than up to 8 times
the legend's.
A c:legendEntry can give one legend entry its own text (c:txPr), as
decks do to make legend text white on a dark chart. It was never read,
so every entry drew in the legend's text. The chart model keeps each
entry's size, bold and colour (Chart::legend_entries); the reader
takes them from the entry's c:txPr, the legend draws each name, key
and row at its entry's size and in its weight and colour, and a chart
rebuilt after an edit writes them back before c:overlay, in schema
order. Entries that set none of the three are not kept.
Fixes#2067
A slide picture with an empty p:spPr in a layout picture placeholder
that sets a fill drew only its pixels: the picture path drew a fill
only when the picture set its own, so the beige frame the layout gives
the placeholder never showed behind a transparent image. A picture
that sets neither a fill nor a style now draws the explicit fill its
layout or master placeholder sets, in the placeholder's geometry. Its
own fill (a:noFill included) and its own style decide as before, and a
style fill alone, inherited or not, stays undrawn.
Fixes#2068
Ctrl+[ (and Cmd+Shift+,) shrank any size above 66 straight to 66: the
step list stopped at 66, so the largest list size below 120 was 66.
The list now holds PowerPoint's sizes up to 96, as the Font Size box
already listed them, and above 96 shrink steps back 8 points at a
time, as grow steps up: 120 -> 112 -> 104 -> 96 -> 88 -> 80 -> 72 ->
66. The Font Size box lists the same SIZES instead of adding its own
tail.
Fixes#2059
* Video: decode H.264, HEVC, VP9 and AV1 with craft-video; delete crates/h264, hevc, vp9, av1 and bitstream
* Video: pin craft-libs main with the DeckCraft decoder fixes; architecture notes
* Video: pin shared decoders to current craft-libs main
release.yml also runs nightly on main with craft-common-actions' dry-run: every release build
except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits
(riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release
day, as it did on 11 Nov 2026.
* Video decoders: budget repeated-frame and queued output pictures, drop a failed VP9 sample's outputs
* address review: size AV1 repeats by the reference format and after layer selection, budget HEVC queued frames at their own size
* address review: charge the larger of the output queue and the in-flight reservation, not both
* address review: count frames held by the old DPB at their own size in the budget check
* address review: charge queued frames outside the DPB and the in-flight set separately
* PPTX export: stop adding chart series once a group's caches pass a point budget
* address review: size chart exports from the caches each group writes
* address review: cut each chart data cache at a cap far above Excel's 32,000 points per series, so the first series is bounded without failing export
* engine: apply the photo album limits when reopening an album
* address review: refuse an album Update when the editor seed omitted items, instead of deleting them
* Apply review fixes
- crates/engine/src/cmd/insert/album.rs
* address review: refuse an album replace when a slide past the item limit holds other content
* address review: notes and comments on a shapeless slide past the item limit block an album replace
* address review: slide background, transition, animations, colour map and tags count as slide content
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
* Metafile: stop shading on a full canvas, charge nested pictures and clip regions to the budgets
* address review: count shared tiles once, include text advances, check clip region before keeping an item
* address review: count EMF+ object bytes against the canvas byte budget
* Apply review fixes
- crates/metafile/src/canvas.rs
- crates/metafile/src/tests.rs
* Apply review fixes
- crates/metafile/src/canvas.rs
* address review: count pieces of a continued EMF+ object against the shared byte budget
* Apply review fixes
- crates/metafile/src/canvas.rs
* address review: count the current and saved clips against the shared byte budget
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
DeckCraft kept its own Opus decoder (crates/opus) and Ogg demuxer
(crates/ogg), and two crates that only re-exported craft-media
(crates/isobmff, crates/matroska). craft-libs has all four: craft-audio's
opus module and craft-media's ogg, isobmff and matroska modules. The four
crates are removed and crates/media depends on craft-audio and craft-media
directly.
craft-media and craft-audio are pinned at 113f2360, the head of craft-libs
#810, which carries the two Ogg fixes DeckCraft made to its own copy
(51d19baa, 9d36b593). The pin moves to craft-libs main once #810 merges.
craft-pdf, craft-update and craft-ui keep their pins.
One API difference: craft-media's OpusTiming::of saturates on a hostile
granule position instead of returning an error. The end-trim product in
the Ogg Opus decode now saturates as well; a test with a three-channel
file and the largest granule panicked on it without that.
crates/bitstream stays: it also holds the video decoders' memory budget,
which craft-libs does not have.
* PPTX: charge repeated chart decodes and sidecar copies to presentation-wide budgets
* address review: count all chart vectors and relationship strings; reject a chart that crosses the presentation limit
* address review: charge chart part names/content types, roll back rejected capture
* address review: bound chart decode work across rejected and repeated references, cache refused sidecar captures
* address review: keep a chart past the presentation chart limits as its original part and closure, so a save writes it back
* UI: cap live video decoders and bound slide-show grid thumbnail height
* address review: retry video feed creation when playback resumes
* address review: reclaim the decoder of ended videos when the feed cap is reached
* test: cover the video decoder cap and its retry
* address review: seeking a video without a decoder retries the bounded decoder allocation
* Render: bound bevel edge work, shape-gradient flattening and colour-glyph fills
* address review: skip shape gradient fill when the outline is over the point limit
* address review: keep every contour of a compound bevel or shape gradient at a coarser raster, bound cubic subdivision before flattening
* Apply review fixes
- crates/render/src/pathgrad.rs
* Apply review fixes
- crates/render/src/pathgrad.rs
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
* Fonts: honor the disabled system fallback for symbol and script family loads
* address review: no catalog loading for loaded families when system fallback is off
* test: cascades load no installed family when system fallback is off
* pdf: gather a paragraph's text once, keep note line widths, count handout rules
* pdf: spell the rule-count check without a negated comparison
* address review: use a narrow tall page in the bounded-work test
* address review: require the huge-paper export to succeed
* Apply review fixes
- crates/pdf/src/lib.rs
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* mcp: bound a batch's entries and the bytes of results it gathers
* address review: charge the escaped batch reply against the budget
* address review: charge batch error entries against the byte budget
* address review: truncate id in batch limit entry
* address review: count the pretty-printed batch reply against the byte cap
* engine: check the automation write roots before appending to the user dictionary
* address review: check the original Path for the dictionary write; isolate the confinement test
* pptx: preserve SmartArt node text when dgm:cxnLst has no parent-child connections
* fix(pptx): apply unconnected-point SmartArt outline fallback when type="doc" point is absent
* fix(pptx): restrict SmartArt pt_order fallback to empty parOf graphs and preserve cached Picture/Connector children
* fix(pptx): convert default rect geometry to line for connectors in diagram drawings
* docs(pptx): note flat ptLst order fallback on dgm::outline
Adds step-security/harden-runner (audit, pinned to v2.22.4 like
craft-common-actions) as the first step of each job that did not have it,
so every workflow in the org's public repos reports its egress to
StepSecurity. Audit, not block: block-mode allow lists come from each
job's observed traffic.
* Spelling: stop an affix header's count at the end of the file, share aliased dictionaries
* address review: share the first inserted dictionary on a concurrent load
* engine: edit each target shape once and read its box without copying it
* engine: check the fill colour field in the repeated-ids test
* Apply review fixes
- crates/engine/src/tests.rs
* address review: shape.lock skips targets inside a targeted group
* address review: dedupe shape.lock targets before walking groups
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* engine: count a slide's notes, comments and tags in the undo memory budget
* engine: drive the undo-budget test through slide.rename
* address review: size text cost by the Paragraph and Run struct sizes
* metafile: bound clipping work across all subpaths of one drawn item
* address review: charge fill clipping as polygons grow, one budget per item
* address review: charge actual clip work instead of projected polygon growth
* address review: share one clip-work allowance between fill and stroke
* address review: share one clip-work budget across fill and stroke, give region intersection its own budget
* media: check an MP4 for oversized sample tables where symphonia will start reading it
* address review: run MP4 table guard only for MP4 or unknown containers
* Apply review fixes
- crates/media/src/probe.rs
- crates/media/src/mp4guard.rs
- crates/media/src/audio.rs
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* H.264: bound decoder work from overlapping slices, gaps and queued output
- A macroblock that an earlier slice of the same picture already decoded is
refused, so overlapping slices cannot redo the picture's reconstruction
once per slice.
- The memory budget check counts pictures waiting in the output queue that
have left the DPB (one decode call may carry many access units) and the
DPB's actual size, counting shared buffers once.
- frame_num gap concealment advances the POC state across the skipped run in
constant time instead of once per missing frame_num.
- Storing a reference picture evicts until the DPB is under capacity, rather
than evicting one picture and inserting regardless.
* address review: charge pictures already held at their own size in the decoder budget
* address review: keep the h264 output-queue byte total incrementally
* engine: extend an ink stroke in place and cap a gesture's samples
* engine: move the ink extension out of drag
* address review: close scribbles at the release point; keep vertices when a capped press adds none
* Apply review fixes
- crates/engine/src/tools/pointer.rs
* raise ink gesture cap to 100000 points
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
Dylan M. Taylor
Hamza
Hamza Naveed
FredApps
neilcawse