XDrawChem 2.0.1

2.0.1 — 2026-04-23

Security / correctness

• Fix three instances of malloc/strcpy buffer overflow + use-after-free on QByteArray
  temporary in OpenBabel format resolution (application_ob.cpp, tool_2d3d.cpp)
• Fix potential buffer overflow in char type[5] strcpy on user-defined atom labels
  (molecule_obmol.cpp, ioiface.cpp)
• Replace system() shell invocation for Ghemical/KryoMol send with
  QProcess::startDetached to eliminate shell injection risk
• Remove dead http.cpp/http.h module and dead XDC_SERVER / getenv code paths
• Fix -Wreorder warning in CMLParser constructor

UI fixes

• Ring menu: wire Amino Acids, Nucleic Acids, Sugars, and Useful Groups submenus
  to setRingAction (they were silent since the Qt6 port)
• Ring menu: add setData() to Useful Groups (FMOC, BOC, DABCYL, DABSYL, DANSYL,
  EDANS, Biotin) so dispatch actually works
• Custom ring submenu: restore dispatch via per-action lambda forwarding to
  FromRingMenu (silent since the Qt6 port; user-saved rings can be placed again)
• Custom ring save: fix signal-11 crash on save caused by uninitialised
  ringmenu member pointer in application.h
• Custom ring menu refresh: swap only the User-defined submenu in place rather
  than rebuilding the whole ring menu (avoids a paint-device warning and stale
  defaultAction pointers in drawRingButton)
• Property panel: refresh on ring placement, name-to-structure, selection change,
  clipboard operations, undo, text/label edits, delete (previously only refreshed
  for raw drawing actions)
• Property panel: track currently-selected molecule rather than always showing
  the first molecule
• Amino Acids menu: remove non-natural amino acids (nitrophenylalanine, statine)
  that can still be retrieved via PubChem lookup

Packaging

• Debian: bump Standards-Version to 4.7.2
• Flatpak: app-id renamed to io.github.bryanherger.xdrawchem (Flathub requirement)
• Flatpak: desktop and metainfo files now install with reverse-DNS filenames
• Flatpak: OpenBabel build uses cmake-ninja + builddir:true for sandbox correctness
• DEB and RPM: include the reverse-DNS desktop / metainfo / icon copies in
  debian/xdrawchem.install and %files (CMake installs both bare and
  reverse-DNS names; both packaging systems are strict about unpackaged files)
• RPM %files: use literal io.github.bryanherger.* glob patterns so future
  reverse-DNS additions (e.g. MIME icons) don't need spec changes
• Added index.html for GitHub Pages redirect to repo