Security fixes
- Multisite isolation: each site now has its own fonts and generated CSS. Mapped legacy fonts are copied safely without removing shared originals or overwriting shared CSS. Interrupted migrations retry, and new-site creation waits until its tables exist. Single-site paths are unchanged.
- Bounded WOFF reconstruction: validate the complete layout before allocation, cap reconstructed output at 64 MiB, process tables sequentially, reject excess output, and feed the native decompressor in 1 KiB chunks.
Verification
All five CI jobs passed: PHP 7.4, PHP 8.3, coding standards, JavaScript/boot/translation checks (including 40 WOFF regressions), and a real disposable WordPress 7.0 multisite test. Chrome checks also confirmed valid reconstruction and oversized-output rejection.
Notes: WOFFs reconstructing beyond 64 MiB are not converted; use TTF, OTF or WOFF2. This output limit is not a total browser-memory cap. Multisite migration requires local filesystem locking and hard-link support; failed copies retry.
Download etch-font-manager.zip below, or update from WordPress once the update manifest refreshes.