v1.3.5

1.3.5 (2026-11-05)

This release makes the accessibility tree and the platform adapters
refuse sizes and values they took unchecked: on a 32-bit target some
sizes wrapped and let a copy or a conversion write past its buffer, and
some values an assistive technology client sends were read as others.
It also moves maul-ui-window to Maul Window 0.14.0 and the library to
Maul Unicode 1.1.2. The API and the ABI are those of 1.3.4, and so are
layouts, styles, draw lists, line breaks, shaped text, glyph images,
motion curves and the accessibility tree built from a context.
maul-ui-window follows Maul Window and sits outside the 1.x promise
until Window reaches 1.0.

Changed

• maul-ui-window takes Maul Window 0.14.0, from 0.13.0, and the library
  Maul Unicode 1.1.2, from 1.0.0, as Window 0.14.0 is built on it.
  Window 0.14.0 renames the mwinMouseButton constants, with the same
  values. The glue names none of them and reads a button by its number,
  so what it does is unchanged. Maul Unicode 1.1.2 gives the results
  1.0.0 gave: it now refuses an iterator no init call set up, and Maul
  UI sets up every one it uses. Line breaking costs 1 to 2% more
  (#413).

Fixed

• muiAccessTree_Apply sized its copy of each array a node points at
  as a count times an item's size, unchecked. On a 32-bit target a
  count large enough wrapped that size, so the tree copied a few bytes
  but kept the whole count, and every adapter that walked the array
  read past the copy. Such an update is now refused with
  mui_errorCapacity, as for memory run out, and changes nothing
  (#399).
• On 32-bit Android, the room for the text a client sets on a field
  (ACTION_SET_TEXT), as UTF-8, could wrap for a text past
  1,431,655,764 UTF-16 units, and the conversion wrote past it. Such a
  text is now refused as memory run out, and the host is asked nothing
  (#400).
• On Windows, GetBoundingRectangles on a text range over 2^30 lines
  or more wrapped its array's 32-bit element count and wrote past the
  array. It now answers E_OUTOFMEMORY, as when the array cannot be
  made (#402).
• The UI Automation adapter took values UI Automation does not name: a
  text unit outside character to document was read as the document,
  an endpoint other than the start as the end, a GetText length below
  -1 as no limit, and a scroll amount outside the five named ones was
  answered S_OK, scrolling the other axis alone. Each is now refused
  with E_INVALIDARG, as Navigate already refused an unknown
  direction, and changes nothing. UI Automation's own client passes
  none of these on, so a screen reader through it is unaffected
  (#407).
• The AT-SPI adapter's GetCharacterExtents, GetRangeExtents and
  GetOffsetAtPoint read a coordinate type past the parent's as the
  window's. They now answer InvalidArgs, as the Component methods do
  (#410).
• On iOS, positionFromPosition:inDirection:offset: negated or added
  an extreme offset in signed arithmetic that overflowed, which is
  undefined behaviour, and read a direction UIKit does not name as
  down. It now gives nil for both, as for a position outside the text
  (#408).

v1.3.4

1.3.4 (2026-11-05)

This release makes the accessibility tree refuse node texts that are
not UTF-8, which could end a program through D-Bus, and moves
maul-ui-window to Maul Window 0.13.0, from 0.12.0. The API and the ABI
are those of 1.3.3, and so are layouts, styles, draw lists, line
breaks, shaped text, glyph images, motion curves and the accessibility
tree built from a context. maul-ui-window follows Maul Window and sits
outside the 1.x promise until Window reaches 1.0.

Changed

• maul-ui-window takes Maul Window 0.13.0, from 0.12.0. Before 1.0
  Window's package matches its version exactly, so a program on Window
  0.13.0 could not use maul-ui-window without linking two releases of
  it. Window 0.13.0 changes how a drop is read on macOS, iOS and
  Android, and how an Android drag meets a drop still being copied.
  The glue reads no drop or drag, so what it does is unchanged
  (#395).

Fixed

• muiAccessTree_Apply accepted node texts that are not UTF-8, or
  that hold a NUL, though maul-ui/access.h says each is UTF-8. The
  AT-SPI adapter passes node texts to D-Bus, and libdbus ends the
  whole program on a string that is not UTF-8. So a host that sent a
  broken label could have its process aborted when an assistive
  technology read it. Such an update is now refused with
  mui_errorInvalid, counted as misuse, and changes nothing
  (#393).

v1.3.3

1.3.3 (2026-11-05)

This release makes a C program built with GCC 14 in its C23 mode warn
when it drops a status Maul UI returns, as Clang and C++17 compilers
already did. The API and the ABI are those of 1.3.2, and so are
layouts, styles, draw lists, line breaks, shaped text, glyph images,
motion curves and the accessibility tree.

Fixed

• MUI_NODISCARD, which marks every function that returns a status,
  expanded to nothing under GCC 14 in C23 mode (-std=c23), because
  GCC 14 reports its C23 as __STDC_VERSION__ 202000L, not 202311L.
  It is now [[nodiscard]] there too, so a host that drops a status
  gets a warning, and a host that builds with -Werror gets an error
  (#374).

v1.3.2

1.3.2 (2026-11-04)

This release moves maul-ui-window to Maul Window 0.12.0, from 0.11.0,
and fixes five internal counters that, after 2^32 events, read an old
stamp as current again. The API and the ABI are those of 1.3.1, and so
are layouts, styles, draw lists, line breaks, shaped text, glyph images,
motion curves and the accessibility tree. maul-ui-window follows Maul
Window and sits outside the 1.x promise until Window reaches 1.0.

Changed

• maul-ui-window takes Maul Window 0.12.0, from 0.11.0. Before 1.0
  Window's package matches its version exactly, so a program on Window
  0.12.0 could not use maul-ui-window without linking two releases of
  it. Window 0.12.0 changes mwinRequest_GetDialogFiles, which takes a
  truncatedOut argument, and how Android and iOS drops end. The glue
  reads neither dialog files nor Window's drops, so what it does is
  unchanged
  (#369).

Fixed

• After 2^32 calls of muiAccessTree_Apply, an update in which two
  nodes list each other could be accepted instead of refused with
  mui_errorInvalid. The two nodes then stayed held, each the other's
  parent and reached from no root, until the tree was destroyed, and
  the host was never told they were removed
  (#367).

• Four more internal stamps no longer read as current again after 2^32
  events (#367):

  • AT-SPI: nodes new or moved under a node told 2^32 structure passes
    earlier are told to clients.
  • Accessibility updates: a child its parent lists again after 2^32
    child lists without it is sent again.
  • Popups: after 2^32 sets, Escape closes the newest open popup, not an
    older one.
  • Glyph atlas: an entry whose plot was evicted 2^32 times since it was
    placed no longer reads as live, so it no longer draws whatever glyph
    the plot holds now.

  The stamps are now 64-bit, so the records that keep them in the
  access tree, the AT-SPI adapter, popups and the glyph table take 4 to
  8 bytes more each, and each atlas plot 4.

v1.3.1

1.3.1 (2026-11-04)

This release moves maul-ui-window to Maul Window 0.11.0, from 0.8.0,
and the text component to Maul Unicode 1.0.0, from 0.13.0. The glue's
gamepad navigation now reaches Windows HID pads with many controls, and
Window's fixes to clipboard reads, input method text and compositions
reach the glue. The API and the ABI are those of 1.3.0, and so are
layouts, styles, draw lists, line breaks, shaped text, glyph images,
motion curves and the accessibility tree. maul-ui-window follows Maul
Window and sits outside the 1.x promise until Window reaches 1.0.

Changed

• Maul Unicode is pinned at 1.0.0, from 0.13.0. No source file changed
  from 0.13.0 and its data is still Unicode 18.0.0, so the text
  component compiles the same code and no result moves. Maul Window
  0.11.0 builds against Unicode 1.0.0, so the two pins move together
  (#358).

Fixed

• On Windows, maul-ui-window's gamepad navigation reaches a generic HID
  pad whose descriptor has more than 32 button or more than 32 value
  capabilities, as docs/user/maul-window.md says it does: d-pad and
  stick directions, confirm and cancel, and the shoulders. Window 0.10.0
  gave such a pad no buttons, or no axes and hats, and did not add a
  pad left with neither; 0.11.0 takes its controls from the first 32
  capabilities of the Button and Generic Desktop pages
  (#358).
• maul-ui-window takes Maul Window 0.10.0, whose input fixes reach the
  glue (#353):
  • On X11, a paste takes only the answer to its own clipboard read, not
    a late answer to an earlier read that ran out of time.
  • On X11, input method text past textBytesPerWindow posts an input
    state reset; before, it was dropped or ended with no reset. On X11
    and Wayland, a compose sequence of 64 bytes or more types its text
    when it fits, then resets, instead of typing nothing. On a reset the
    glue lets go of held modifiers, buttons, pen buttons and touches,
    and tells the host to give the block an empty preedit.
  • On Windows, a composition's caret, selection or clause inside a
    surrogate pair ends before the pair, and a composition string whose
    second read fails is refused.
  • On the web, a lone surrogate in pushed text or a typed character
    becomes U+FFFD instead of losing the text.
  • On Windows, a HID gamepad whose reports cannot be read is turned
    away instead of being added and never moving.

v1.3.0

1.3.0 (2026-11-04)

This release states the length of an accessibility update's children
array, so the access tree checks every update the library builds
against it, and fixes a password's mask past the text limit and two
ways the access tree read through or outside an update. The API grows
by one field at the end of muiAccessUpdate. Layouts, styles, draw
lists, line breaks, shaped text, glyph images and motion curves are
those of 1.2.0.

Changed

• muiAccessUpdate gains childCount, the length of its children
  array. muiNode_BuildAccessUpdate sets it, and muiAccessTree_Apply,
  which every adapter's Apply calls, refuses a node whose children
  reach past it, a wrapping sum included. With childCount 0 the
  length is not stated, so Apply cannot check the children against
  it and keeping them in range is the caller's, as before. Positional
  initializers of muiAccessUpdate get a missing-field warning
  (-Wmissing-field-initializers) until they add childCount; 0
  keeps their behaviour
  (#344).

Fixed

• A password of more than 715,827,882 grapheme clusters, a third of
  MUI_MAX_TEXT_BYTES, is no longer laid out with a wrong mask. Up to
  1,431,655,765 clusters its mask passed the text limit, and past that
  its 32-bit length wrapped (2 bytes at 1,431,655,766 clusters). Such
  a password now measures and paints as when memory runs out, counted
  by muiTextService_GetLayoutFailureCount, and accessibility does not
  read it
  (#336).
• muiAccessTree_Apply refuses, with mui_errorInvalid and no change,
  a NULL entry in an update's nodes and a node whose links are counted
  with no array. It read through both
  (#341).
• muiAccessTree_Apply with change callbacks no longer reads outside
  the tree when an update sends a node again and lets it go in the
  same apply: the old root sent with no parent, or a child its parent
  stops listing. Such a node is told once, as removed
  (#348).

v1.2.0

1.2.0 (2026-11-03)

This release changes which text segments count as words, for word
movement and for the words a screen reader steps through, to follow
Unicode's word properties as ICU does, and takes Maul Tween 1.0.0. The
API and ABI are those of 1.1.0, and so are layouts, styles, draw lists,
line breaks, shaped text, glyph images and motion curves.

Changed

• Words are the word segments Maul Unicode's
  muniSegmentIterator_GetWordKind calls words, as ICU's rule status
  does, in place of Maul UI's own test for a letter or a number. Word
  movements (muiNode_MoveTextPosition, and the keys that move or
  delete by word) and muiAccessWord change for segments that hold
  these code points and no other letter or number
  (#331):
  • No longer words: 912 of the 915 General_Category No code points,
    such as superscripts (²), fractions (¼), enclosed digits (① ❶ ⒈),
    CJK enclosed numbers (㈠ ㊀), Ethiopic (፲), Tamil (௰), Kanbun (㆒)
    and counting rods (𝍠); and the halfwidth katakana voiced sound marks
    U+FF9E and U+FF9F when no letter or kana comes before them.
  • Now words: the circled and squared letters (Ⓐ ⓐ 🄰 🅰 🅿), modifier
    and tone letters, some Armenian, Hebrew and Syriac punctuation, the
    symbols and punctuation of Myanmar, New Tai Lue, Ahom, Tai Tham and
    Tai Viet, katakana and hiragana symbols, and the Arabic and Kaithi
    number signs.
• Maul Tween is pinned at 1.0.0, from 0.16.0. Maul UI calls none of the
  player and path functions whose results 0.17.0 changed, and its
  springs, decays, easings and rubber band give the same results
  (#330).

v1.1.0

1.1.0 (2026-11-03)

This release moves Maul UI to Maul Window 0.8.0 and Maul Unicode
0.13.0. The API and ABI are those of 1.0.0, and so are layouts, styles,
draw lists, line breaks, shaped text and glyph images: Maul Unicode
0.13.0 carries the same Unicode 18.0.0 data, and the one result it
changes, Greek and Armenian case conversion, is one Maul UI does not
use. The window glue, maul-ui-window, sits outside the 1.x promise
until Maul Window reaches 1.0 and follows Maul Window 0.8.0's API; its
one change in behavior is the caret below.

Changed

• Maul Window is pinned at 0.8.0, from 0.7.0, and Maul Unicode at
  0.13.0, from 0.8.0. A program on the window glue builds against Maul
  Window 0.8.0, with that release's renames in its own code
  (mwinEvent.kind and mwinEventKind for type and
  mwinEventType), and against Maul Unicode 0.13.0 when it provides
  its own
  (#324).
• Window glue: when muiNode_SetWindowCaret stops text input with the
  null id, the window now keeps its caret, where it was cleared before,
  as Maul Window 0.8.0 does. Text and compositions arrive without
  control characters, which Maul Window 0.8.0 drops
  (#324).

v1.0.0

1.0.0 (2026-11-03)

This is the first stable release. From here a program that builds
against 1.y builds against any later 1.z and means the same, the ABI
holds within a minor version, and results (layouts, styles, draw-list
bytes, accessibility trees, line breaks, shaped text, glyph images and
motion curves) change only in a minor release whose notes say so, or in
a patch release correcting one to what the documentation promised. The
reference renderer, maul-ui-rhi, and the window glue,
maul-ui-window, follow Maul RHI and Maul Window and sit outside that
promise until both reach 1.0. The API is that of 0.7.1, and so are
layouts, styles, draw lists, shaped text and glyph images; a program
built against 0.7.1 is built again, as against any release before 1.0.
The two fixes below are the renderer's.

Changed

• The version promise above is stated in Getting started's Versions
  section and in the release rules. The CMake package now accepts any
  later 1.y release, where it accepted only its exact version, and a
  shared library's SOVERSION is the major and minor version
  (#319).

Fixed

• Renderer: once the glyph atlas had pages, a frame of boxes and
  shadows alone failed to record (muiRhiRenderer_Record answered
  mui_errorPlatform) and drew nothing, for example after a screen's
  last text went away. Such a frame now draws
  (#322).
• Renderer: a hand-built draw list whose glyph runs named the same
  glyphs many times could wrap the instance count past 32 bits, and
  packing then wrote past the instance buffer. Such a list is now
  refused with mui_errorCapacity
  (#317).

v0.7.1

0.7.1 (2026-11-03)

This release fixes two checks in the Maul Window glue and takes Maul
Tween 0.16.0. A preedit's caret is now checked the same way in both
calls that take one, and asking for the keyboard for a node that is
gone is refused. The API and ABI are the same as in 0.7.0, and so are
layouts, styles, draw lists, shaped text and glyph images. A context
reserves 8 bytes more for each transition and animation its limits
allow.

Changed

• Maul Tween is pinned at 0.16.0, from 0.12.0. Maul UI's springs,
  decays, bezier easings and rubber band give the same results. Its
  easing records grow from 72 to 80 bytes on 64-bit, so a context
  reserves 2,560 bytes more at the default limits of 64 transitions and
  256 animations
  (#312).

Fixed

• Window glue: muiTextBlock_SetPreedit took a preedit's caret
  unchecked, so a caret past the preedit or inside a character named an
  offset outside the composition or inside a character.
  muiTextBlock_ShowPreedit refused every caret of a preedit longer
  than INT32_MAX with mui_errorInvalid, where the text is refused
  for its length with mui_errorLimit. Both calls now take a caret of
  -1 (hidden) or a character boundary of the text, and refuse anything
  else with mui_errorInvalid before the block changes
  (#304).
• Window glue: muiNode_RequestWindowKeyboard asked for a plain-text
  keyboard for a node that is gone, or for a host without a context,
  and answered mui_success. It now refuses them with
  mui_errorStale and mui_errorInvalid before it asks Maul Window
  for anything; the null id still hides the keyboard
  (#308).