v1.1.4

What's Changed

New Features

• Security fixes and hardening

  This release includes several security fixes and hardening improvements to make
  PicFetch more resilient when handling malformed images and large collections.
  Stronger validation and resource limits reduce the risk of excessive memory and
  CPU use, while additional safeguards protect file saves, strengthen update
  integrity, and tighten permissions in release workflows.

• Add Settings -> Limits -> Similarity Explorer with persisted 512 MB map-data
  and 10,000-item defaults, configurable for larger libraries. Resource-limit
  errors show wrapped toasts naming the setting location. Stream map snapshots
  in bounded chunks with aggregate accounting instead of one large JSON event.

Bugfix

• Fix Linux clipboard copies staying busy after the helper forks its clipboard
  owner, which also blocked Copy Image Path. Complete on launcher exit while
  preserving bounded failure diagnostics and the running clipboard owner.

• Restore JPEG metadata removal for common EXIF/ICC color declarations and camera
  chroma settings. Keep orientation and encoded image data without recompression,
  while retaining structural validation, privacy checks and memory limits. Qualify
  the standard optional sRGB profile fields found in the supplied camera JPEG.

• Bound RAW fallback JPEG parsing with one input-sized budget shared by header,
  marker-fill and entropy traversal. Preserve ordinary multi-preview selection
  and replace timing-dependent coverage with deterministic budget checks.

• Reject Save Changes through symlink leaves, preserving both the link and target
  without copying image content into a different directory. Keep regular writes
  at the selected filename and serialize parent-directory aliases.

• Authenticate staged updates with process-local seals, derive payload hashes
  from verified archive bytes, and retain a write-denying Windows source handle
  through installation.

• Bound ICO and SVG input processing, enforce WASM AVIF builds, and account for
  GIF frame overhead before animation decoding; preserve static GIF fallback.

• Bound comparison decodes to half the shared image budget per pane and avoid
  retaining animation frames that comparison never displays. Include 16-bit
  pixel admission, actual cached-frame weights, localized refusals and the
  corrected UI shard assignment.

• Bound Visual Similarity Explorer collection work and worker event decoding to
  prevent attacker-controlled collections from exhausting CPU or viewer memory.

Internal

• Pin the TUF-root workflow's checkout/setup-go actions to verified v7 commits,
  disable checkout credential persistence, and configure GitHub CLI authentication
  before pushing. Focused TUF tests and stubbed publication paths pass; the live
  scheduled write path is not exercised by PR CI.

• Pin the Qodana action to its reviewed commit, remove source-write permission
  and automatic fix pushes, and disable persisted checkout credentials. Retain
  PR comments, annotations and the Go linter's required project token.

• Windows signing qualification Completed. The Windows release-signing workflow uses the protected
  release-signing environment, retains the verified local installer handoff,
  and checks SIMPLYSIGN_INSTALLER_SHA256 and SIMPLYSIGN_SIGNER_THUMBPRINT
  before installation.

Full Changelog: v1.1.3...v1.1.4