save deflated every asset that isn't PNG, JPEG, GIF or WebP, with no size
cap, while opening refuses a deflated asset over 1 GiB or deflated entries
over 4 GiB together. An asset past either cap is now stored as is, which
opening reads at any size. Smaller assets are deflated as before, and the
zip bomb guard on load is unchanged.
* Automation roots: refuse COM¹ to LPT³ and a device name before a colon
is_device_name missed COM¹, COM², COM³ and LPT¹, LPT², LPT³, which Windows reserves as it does COM1.
It also cut the name only at a period, so COM1: and NUL:x were not seen as device names.
* Credit my name in the About window
* Automation roots: document the device-name tests
CodeRabbit's docstring check counts the touched tests. same_component stays without a doc comment, because #2205 deletes that function and a doc line above it conflicts.
* Automation roots: record the device-name refusal
The MCP roots description and the roadmap now name COM¹ to LPT³ and a device name before a colon.
* fix(engine): index lookups that were quadratic in a document's styles, tags, swatches and runs
* address review: first swatch per name in book sync; bound spelling input before collecting
* address review: keep the last source style per name in book sync; bound GREP replacement bytes while generating them
* address review: write GREP replacements into a byte-bounded buffer; gate keep_last test off wasm
* merge main into fix/sec-engine-linear-lookups
* address review: make the suggestion length-cap test deterministic
* fix(export): leave out text hidden by inherited conditions or deletion in every exporter
* address review: skip hidden frames in page text and hidden article items; first visible paragraph as nav label; read table anchor's own format
* address review: skip nonprinting frames and non-printable layers in fixed-layout page text
* Apply review fixes
- crates/epub/src/html.rs
- crates/engine/src/cmd/export/formats.rs
* Apply review fixes
- crates/epub/src/html.rs
- crates/engine/src/cmd/export/formats.rs
* address review: fixed-layout page text skips frames in inactive object states
* address review: place a threaded story at its first shown frame; skip it only when every frame is hidden
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
* format: bytes a failed entry read inflated count against the archive budget
* address review: mutate the payload bytes explicitly in the checksum test
* address review: charge a failed read to the budget it belongs to (stored vs deflated)
* idml: story runs and marker offsets found once, object-style overlay by position, embedded image budget
* address review: saturating embedded-bytes counter
* address review: IDML export past the embed limit succeeds and warns for each image written as a link
* address review: an unlinked image is always embedded, only linked ones fall back to their link
* xtask: refuse a corpus archive that expands past the cap before extracting it
* address review: a within-cap answer needs tar to exit successfully
* Apply review fixes
- xtask/src/main.rs
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
With more render threads than bands of 32 rows fit evenly, the rows split
into fewer bands than requested, and the returned count was the requested
one. It is now the number of bands converted.
Center, Bottom and Justify moved the lines of a shaped frame without
testing them against the outline, so in a frame that narrows towards the
bottom a line set in a wide band ended up crossing the outline. Each moved
line's slot is now tested against the outline over its new band, as when
the line was fitted, and the text goes only as far down as every slot
fits. In a frame that narrows and widens again, the search scans the
rooms from the most down (every point, at most 512 steps) before halving,
so the text can still reach a lower part past a narrow waist.
- The status bar and the Preflight panel show a gray light and "Checking" until the active
document's first check ends, instead of a green "No errors".
- The cross-reference and running-header indexes are keyed on the baseline grid and the font
scope as well, so a change to either builds them again, in a cache and in a cache over it.
- The test helper that waits for the preflight worker fails when the worker ends without a result.
Follows #2645. Its test said a misspelled key used to apply Align Left.
Only empty params and a bare string did; the parameter check already
refused a misspelled key, and the value parser refused an unknown
value. Each case now asserts the refusal message it gets.
The Auto Leading field shows whole percents, and it now stores the
whole percent it shows, so a typed 500.4% (shown as 500%) is accepted
as 500% instead of being refused. Picking the Single Word
Justification the paragraphs already have is no longer an edit, so OK
adds no undo step for it.
Type > Justification and Paragraph Style Options > Justification now show
Auto Leading (0% to 500% of the type size) and Single Word Justification
(Align Left, Align Center, Align Right, Full Justify). Both fields show the
selected paragraphs' values, or blank where they differ, and OK writes
autoLeading and singleWordJustify only when they were edited. An Auto
Leading outside 0% to 500% keeps the dialog open with the reason.
In the CMYK blend space view (Proof Colors off) every render converted
each pixel of the ink passes' area from the blended inks to a screen colour
on the calling thread, through a 16-entry lookup per pixel. With render
threads it now converts bands of rows on that many threads at once, at
least 32 rows a band. The colours are the same; the Wasm build and
single-threaded renders convert on one thread as before.
The worker checks the document state it was given, which is often one
edit behind the interface. It composed that older state into the shared
composition cache, replacing the interface thread's composition of the
current state, so the next frame composed the edited story again (about
14 ms per edit for a 10-page story).
Cache::over makes a cache that uses another cache's compositions of the
same state and keeps whatever it composes to itself. The worker checks
with one over the interface thread's cache, keeps it for the next check
of the same document, and drops it after a minute without jobs.
With no active document, the job waiting for a busy worker is dropped,
so it no longer keeps a closed document in memory until another
document opens.
The status bar's error count ran the whole-document preflight check on
the interface thread for every new state of the document, so every drag
step and every typed character waited for it. The Preflight panel ran
the same check on every frame. The check composes every story and asks
the file system about every linked graphic, so its cost grows with the
document: on a 300-page document with 900 placed images it took 137 ms
on a fast machine, and moving or resizing a frame and typing became
unusable on large documents.
The check now runs on a worker thread that takes the newest state of
the document; the issues last found stay shown until it answers. An
unchanged document is checked again every few seconds for linked files
changed outside the app, a save under a new path or a font reload is
checked again, and a check blocked on another document's linked file
is handed off to a fresh worker after 200 ms. Tests and the web build
check on the interface thread, once per state of the document.
preflight::check_document takes the document, the composition cache and
the save path, so the worker needs no session.
object.textFrameOptions refuses a gutter outside 0 to 15552 pt, a column
count outside 1 to 40 (it was clamped) and an on/off option that is not
true or false (it was skipped). The Control bar's Columns field stops at
40, as the other column fields do. The params text gives the ranges and
lists flexibleWidth.
type.para and paragraph style create and edit refuse left and right
indents outside 0 to 15552 pt and first and last line indents outside
-15552 to 15552 pt. A style made from the selection is checked with the
values it takes from the selection.
style.paragraph.apply and style.paragraph.redefine check that Minimum,
Desired and Maximum stay in order in each justification row they change,
over the overrides paragraphs keep, and refuse the change otherwise.
Bottom and Justify now put the last baseline on the bottom inset in a
frame with a corner radius as in a rectangular one, so a radius no longer
moves the text when the bottom inset is above 0. Center puts the last
baseline halfway between where Top sets it and the bottom inset even when
the frame is too short for the descenders under it, so Cap Height text in
a tight frame is centered. The last line's descenders hang below its
baseline, into the bottom inset and past the frame's edge when the inset
is smaller than the descent. An earlier line whose descenders reach below
the last baseline (tight leading) is not moved past the text area. Above
footnotes and in vertical frames the descenders still stay inside the
text area.
type.para, style.paragraph.create and style.paragraph.edit accepted any
number for paragraph spacing and justification. They now refuse Space
Before, Space After and same-style spacing outside 0 to 15552 pt, word
spacing outside 0% to 1000%, letter spacing outside -100% to 500%, glyph
scaling outside 50% to 200%, Auto Leading outside 0% to 500%, and a
Single Word Justification other than left, center, right or
fullyJustified. Each justification row needs Minimum <= Desired <=
Maximum over the values the paragraph or style resolves to after the
change, including the styles based on an edited style and the
paragraphs, table cells and notes that use them.
object.textFrameOptions refuses an inset outside 0 to 15552 pt or a list
that is not four sides, and a verticalJustification, firstBaseline,
autoSize or columnsKind that is not one of its names. These were applied
or skipped without an error before. IDML import reads these values as
before.
Vertical justification measured the free space down to the bottom of the
last line's descenders, so Center set text too high (most visibly with a
Cap Height first baseline) and Bottom and Justify left the descender depth
empty. The last baseline is now the bottom of the text: Bottom and Justify
put it on the bottom inset, and Center leaves as much room below it as
above the first line. The descenders may reach into the bottom inset but
not past the frame's edge; above footnotes, in vertical frames and in
shaped frames they stay inside the text area. Tables keep their bottom.
A shaped frame no longer tests the part of a line above its text area
against the outline, so a small corner radius leaves a Cap Height first
line where a rectangular frame puts it.
Fixes#1999
type.align with no `align` key applied Align Left, so a call that
misspelled the key, or passed a bare string, changed the paragraphs to
left alignment instead of failing. The command now returns an error,
leaves the text unchanged and records no undo step. A named value still
applies, and `align: null` still removes the override.
* Render: a blur size is clamped to 1,000,000 pt before the filter planner squares it
* address review: bound effect extents and sigma before spread, padding and reach arithmetic
release.yml also runs nightly on main with craft-common-actions' dry-run: every release build
except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits
(riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release
day, as it did on 11 Nov 2026.
* fix: index style, font, class and layer name lookups in exporters and importers
* Apply review fixes
- crates/epub/src/css.rs
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* fix(engine): whole-file reads take regular files only, up to the format limit
* Apply review fixes
- crates/engine/src/io.rs
* Apply review fixes
- crates/engine/src/io.rs
* Fix failing CI check
- crates/engine/src/io.rs
* address review: refuse to save an encoded document longer than the open limit
* address review: open files for reading without blocking (FIFOs, stream-backed pseudo-files)
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* fix(engine): package fonts from their loaded bytes under the read roots
* address review: a font's own file is neither overwritten nor packaged when it changed since loading
* Apply review fixes
- crates/engine/src/cmd/package.rs
* address review: compare packaged font file in fixed-size chunks
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* Strokes: cap the points a wavy or hashed stroke places along a path
* address review: zero-length quadratic contributes no length in stroke samples
* Fix failing CI check
- crates/geom/src/stroke_style.rs
* Fix failing CI check
- crates/geom/src/stroke_style.rs
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
* engine: Erase/Smooth look at each distinct drag sample once, thinned past 4096
* Apply review fixes
- crates/engine/src/cmd/anchors.rs
* address review: decide whether a drag touched the path on every distinct sample, then thin
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
* doc: appending to a story extends the last run, no scans
* Apply review fixes
- crates/doc/src/story.rs
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
FredApps
Dylan M. Taylor
jayzed80
Adithya Shankaran
autocraft-bot[bot]
dotCooCoo