Duck Studio 2.1.2

Duck Studio source and release downloads are now public. Update to 2.1.2 before opening projects from other people.

• Prevented imported projects from choosing executable decoder DLLs.
• Hardened installer/uninstaller paths against traversal and linked files.
• Restricted photo decoding, blocked external delegates and bounded image resources.
• Kept HTTPS throughout update redirects and bounded signed local manifests.
• Patched renderer archive decompression with ruzstd 0.9.1 (RUSTSEC-2026-0344).
• Updated both bundled .NET runtimes to serviced version 10.0.13.
• Enabled the public signed GitHub update feed for new installations and portable copies.
• Added a security policy, private vulnerability reporting, secret scanning, dependency checks and CodeQL.

Download DuckStudioSetup.exe to install, or extract DuckStudio-Windows-2.1.2.zip for a portable copy. SHA256SUMS.txt contains the download checksums. The installer is self-contained for Windows x64.

Older copies: set Help > Update settings to https://github.com/Rubber-Ducks-Development/duck-studios/releases/latest/download/latest.json or install this release manually. Existing custom feed settings take precedence. The app asks before installing updates and verifies its pinned release signature, signed size and SHA256.

Validation: 44 source/security regression checks; 22 patched archive tests; 17 packaged photo formats including PSD/PSB; supplied logo, signed manifest and all 740 installed file hashes verified. History/package scans found no exposed credentials.

See SECURITY.md for review limits and dependency maintenance warnings. This release has no Authenticode publisher certificate. Live FXServer testing remains separate.