Shkarko PicFetch 1.1.4

What's Changed
New Features
trane security superhero
- Security fixes and hardening
This release includes several security fixes and hardening improvements to make
PicFetch more resilient when handling malformed images and large collections.
Stronger validation and resource limits reduce the risk of excessive memory and
CPU use, while additional safeguards protect file saves, strengthen update
integrity, and tighten permissions in release workflows.
- Add Settings -> Limits -> Similarity Explorer with persisted 512 MB map-data
and 10,000-item defaults, configurable for larger libraries. Resource-limit
errors show wrapped toasts naming the setting location. Stream map snapshots
in bounded chunks with aggregate accounting instead of one large JSON event.
Bugfix
- Fix Linux clipboard copies staying busy after the helper forks its clipboard
owner, which also blocked Copy Image Path. Complete on launcher exit while
preserving bounded failure diagnostics and the running clipboard owner.
- Restore JPEG metadata removal for common EXIF/ICC color declarations and camera
chroma settings. Keep orientation and encoded image data without recompression,
while retaining structural validation, privacy checks and memory limits. Qualify
the standard optional sRGB profile fields found in the supplied camera JPEG.
- Bound RAW fallback JPEG parsing with one input-sized budget shared by header,
marker-fill and entropy traversal. Preserve ordinary multi-preview selection
and replace timing-dependent coverage with deterministic budget checks.
- Reject Save Changes through symlink leaves, preserving both the link and target
without copying image content into a different directory. Keep regular writes
at the selected filename and serialize parent-directory aliases.
- Authenticate staged updates with process-local seals, derive payload hashes
from verified archive bytes, and retain a write-denying Windows source handle
through installation.
- Bound ICO and SVG input processing, enforce WASM AVIF builds, and account for
GIF frame overhead before animation decoding; preserve static GIF fallback.
- Bound comparison decodes to half the shared image budget per pane and avoid
retaining animation frames that comparison never displays. Include 16-bit
pixel admission, actual cached-frame weights, localized refusals and the
corrected UI shard assignment.
- Bound Visual Similarity Explorer collection work and worker event decoding to
prevent attacker-controlled collections from exhausting CPU or viewer memory.
Internal
- Pin the TUF-root workflow's checkout/setup-go actions to verified v7 commits,
disable checkout credential persistence, and configure GitHub CLI authentication
before pushing. Focused TUF tests and stubbed publication paths pass; the live
scheduled write path is not exercised by PR CI.
- Pin the Qodana action to its reviewed commit, remove source-write permission
and automatic fix pushes, and disable persisted checkout credentials. Retain
PR comments, annotations and the Go linter's required project token.
- Windows signing qualification Completed. The Windows release-signing workflow uses the protected
release-signing environment, retains the verified local installer handoff,
and checks SIMPLYSIGN_INSTALLER_SHA256 and SIMPLYSIGN_SIGNER_THUMBPRINT
before installation.
Full Changelog: v1.1.3...v1.1.4