What's Changed
- fix(psd): keep pattern budget charges on parse failure by @dylanmtaylor in #8767
- fix(algo): avoid repeated copies of duplicate EXIF text by @dylanmtaylor in #8771
- fix(paint): validate gray tile dimensions safely by @dylanmtaylor in #8772
- fix(text): bound untrusted font and PSD text processing by @dylanmtaylor in #8768
- Select and Mask: tool edits as select.refineEdge params (engine, part 1 of 2) by @wanikhawar in #8783
- fix(cms): confirm ICC profile identity by bytes, not the 64-bit hash … by @jturnbach in #8863
- fix(vector): bound hostile geometry and raster work by @dylanmtaylor in #8769
- fix: restrict droplet shim permissions, explain test range (SonarCloud) by @dylanmtaylor in #8870
- Linked files: resolve stored paths with craft-docpath's resolve_absolute by @aiongg in #8032
- CI: no debug info for dependencies, nextest in xtask ci, long sweeps spread over days by @aiongg in #8915
- security(affinity): bound shared-object expansion work and metadata by @dylanmtaylor in #8938
- release: the git-sources gate moves into craft-common-actions (storytold/craft-common-actions#78) by @dylanmtaylor in #8952
- packaging: use [[ for bash conditional tests (SonarCloud S7688) by @dylanmtaylor in https://github.com//pull/8914
- CI: the Linux gate runs through the suite's shared gate workflow by @aiongg in #8951
- security(raster,doc): tile counts, shared rebuilt tiles, slice merge index by @dylanmtaylor in #8953
- security(ipp): total reply deadline, resumable chunk walk by @dylanmtaylor in #8956
- security: bisect table/stop lookups; charge ICC curves; bound PSD/RAW buffers by @dylanmtaylor in #8959
- security(algo): bound working sets sized by caller-controlled extents by @dylanmtaylor in #8946
- security(compose): bound dense working sets and nested Blend If evaluation by @dylanmtaylor in #8949
- Tests: missing translations don't fail; xtask ci lists them by @aiongg in #8964
- security(codecs): bound truncated JPEG recovery; count WebP frame ICC copies by @dylanmtaylor in #8947
- security(plugins): host keys, band count, start fuel, FIFO open by @dylanmtaylor in #8958
- security(gpu,ui-egui): bound clipped group planning; pattern swatch sampling by @dylanmtaylor in #8960
- CI: cargo xtask ci is the gate, and the workflow runs it by @aiongg in #8970
- xtask: the panic hunt without nextest builds with the HEIF decoder by @aiongg in #8980
- ci(sonar): stop cancelling main-branch runs so coverage is published by @dylanmtaylor in #8990
- deps: roxmltree 0.21 in photocraft-io and photocraft-engine by @dylanmtaylor in #8973
- packaging(macos): retry stapling when Apple's ticket lookup drops by @echelon in #8995
Full Changelog: v0.14.0...v0.15.1