Dylan M. Taylor 02db900cc8 fix(engine): keep plugins out of branches, saved versions and library links ...

A read-only plugin could archive, merge, create or update a branch: branch
state lives beside the document, so neither the command's history flag nor
the document Arc check saw the write. Any plugin could read a saved version
through dev.compare's version parameter although version.* is denied, and
library.list handed plugins each library's path, which for a server library
is the share link with its token.

2026-11-03 15:46:13 +00:00

..

src

fix(engine): keep plugins out of branches, saved versions and library links

2026-11-03 15:46:13 +00:00

tests/it

Resolve stored variable ids by exact id, not by variable name

2026-10-29 14:11:48 +01:00

Cargo.toml

M7: download a missing free font from the Missing fonts window (#754) (#1510)

2026-10-29 16:41:31 +07:00

clippy.toml

M8: every file a command reads by path is a regular file within a cap (#1114) (#1625)

2026-10-30 13:48:26 +07:00