Security Update: Compromised eMudhra CAs Refused

LichtFeld Studio 0.5.4.2 is a security update. Please update.

The private keys of eight eMudhra intermediate certificate authorities can be recovered from their certificates (disclosed on 2026-10-20). Anyone can therefore forge certificates that chain to these CAs. OpenSSL, which LichtFeld Studio and its Python runtime use, does not apply the operating system's distrust of them, and the previously bundled uv trusted them through its built-in roots. On an intercepted connection, a forged certificate could pass as a download or package server, and an intercepted plugin install could run arbitrary code.

Highlights

• Compromised eMudhra CAs refused. LichtFeld Studio's own downloads and plugin installs now reject certificate chains through the eight compromised CAs, checked against their public keys as Go and Node do, while every other chain is unaffected. The bundled uv moves to 0.13.5, which rejects them as well.
• Security updates of dependencies. OpenSSL 3.6.5, curl 8.23.0, FFmpeg 8.1.2, libarchive 3.8.9, libpng 1.6.59, libtiff 4.7.2, libjpeg-turbo 3.1.4.1, FreeType 2.14.3, expat 2.9.0 and assimp 6.0.5.
• POPSpa sparsification. Optional post-training sparsification removes splats the result does not need.
• Training region of interest from the command line. --cropbox x0,y0,z0,x1,y1,z1 trains with the same crop box the GUI offers; --cropbox-loss-weight 0 ignores every pixel whose ray misses it. The box is saved with the project.
• MRNF at the splat cap. Error-guided growth keeps exchanging splats once the cap is reached; its setting sits with the refinement parameters.
• Interface. Selection outlines for splat objects, vertical category tabs in the right sidebar, a double-click on a setting's label restores its default, configurable arrow-key repeat for browsing camera images, a prompt to enable undistortion or GUT when distorted cameras are detected, comparison of splats and raw PLY point clouds in scene order, and the brand logo opens the Help menu.
• Projects and plugins. An untrained project trains from the file alone, plugins can show scene nodes that are never saved, and GPU plugins default to no hot reload.
• Fixes. Reopening a project with a training checkpoint keeps the viewer out of its degraded mode, the histogram no longer reads the live scene, a shared-memory race in the layer norm kernel, video frame extraction when the container outlasts the video stream, scaled training intervals that rounded to zero steps, enum property defaults, and Windows builds and DLL exports.

What's Changed

• Set the version back to 0.5.5 after the 0.5.4.1 release by @MrNeRF in #3695
• Replace the Help menu label with a clickable brand logo by @jacobvanbeets in #3698
• Let the layout test reach scrub fields through their drag handles by @MrNeRF in #3697
• Keep MRNF's error-guided growth working at the splat cap by @hellguz in #3168
• Keep the histogram worker off the live scene by @MrNeRF in #3700
• Place growth exchange in the refinement parameters by @MrNeRF in #3701
• Add configurable arrow-key repeat for camera image browsing by @shadygm in #3702
• Add optional POPSpa post-training sparsification by @lyehe in #2043
• Compare splats and raw PLY point clouds in scene order by @shadygm in #3681
• Clean up camera key repeat and point selection styling by @MrNeRF in #3706
• fix: enable large MSVC objects across project C++ targets by @francescofugazzi in #3708
• Fix enum property defaults to resolve by value by @francescofugazzi in #3711
• Add optional selection outlines for splat objects by @francescofugazzi in #3689
• Fix a shared-memory race in the layer norm kernel by @MrNeRF in #3718
• Add label double-click reset for settings defaults by @francescofugazzi in #3716
• Use the video stream's duration when the movie outlasts it by @MrNeRF in #3720
• Let plugins show scene nodes that are never saved by @thomas-koch-core11 in #3722
• Write an untrained project that trains from the file alone by @thomas-koch-core11 in #3721
• Add prompt to enable undistortion or GUT when distorted cameras are detected by @IAMSebyi in #3719
• Enforce hot_reload manifest flag policy and default to false for GPU plugins (#1487) by @Ankit-cs in #3682
• Fix Windows build errors and missing visualizer DLL exports by @miriameng in #3727
• Move a resumed project's model into renderer storage before the commit by @MrNeRF in #3729
• Keep scaled training intervals at least one step by @MrNeRF in #3730
• Add vertical category tabs to the right sidebar by @shadygm in #3676
• Refuse the compromised eMudhra CAs and raise vcpkg security pins by @MrNeRF in #3731
• Define the training region of interest from the command line by @MrNeRF in #3732
• LichtFeld Studio 0.5.4.2: security follow-up by @MrNeRF in #3733

New Contributors

• @hellguz made their first contribution in #3168
• @Ankit-cs made their first contribution in #3682

Full Changelog: v0.5.4.1...v0.5.4.2