v1.10.1

Puntovivo v1.10.1 — dependency corrections, including one inside the updater

Why this release matters

There is nothing new to learn in v1.10.1. It is a maintenance release that
corrects four third-party libraries Puntovivo depends on, and it exists mainly
because one of those corrections is inside code that already runs on your
computer.

If you are running v1.10.0, the recommended action is simply to accept the
update when it arrives. No setting, screen, or workflow changes.

What changed

A correction inside the desktop updater

The component that checks for new Puntovivo versions reads a small description
file published alongside each release. The library it used to read that file
had a defect that a deliberately malformed file could exploit to make the
application consume processor time without finishing.

Being precise about the size of this: it cannot expose your data, change your
records, or run anything on your machine. The worst outcome is the update check
becoming slow or stalling. Reaching it at all would require someone to replace
the file Puntovivo downloads over an encrypted connection from its own
published location, so this is a precaution rather than a reaction to anything
observed.

That library shipped in v1.10.0 in its uncorrected form, which is the reason
this release exists rather than waiting for the next feature release.

A correction in the PDF path

The library used to build PDF documents, including exports and the day-close
report, received a security correction from its authors. Puntovivo now uses the
corrected version.

Large tables render more predictably

The table component behind long product and operations lists was updated in
v1.10.0 to a version that asked the interface to redraw at moments the
interface was not ready for. Ordinary use was unaffected, and every function of
those tables kept working, but the redraw was being deferred rather than
applied cleanly. This release holds that component at its last correct version
until its authors publish a fix.

Build tooling

One further correction applies only to the tools used to build Puntovivo and
never runs on your computer. It is listed here for completeness rather than
because it affects you.

Before you use it

Every limitation described for v1.10.0 still applies without change, because
this release adds no capability:

• Puntovivo still does not sign or transmit production documents through a
  DIAN-authorized Technology Provider. Provider credentials, certificates,
  contingency behavior, conformance testing, and certification are all still
  required. The Mexico and Chile document packs remain draft-only.
• Software paths exist for receipt printing, cash-drawer commands, scanner
  input, and manual payment-terminal recording. Representative physical devices
  still need qualification in a store-like lab.
• The operational alert channel is a software delivery path, not a staffed
  monitoring service and not a response-time guarantee.
• The recovery rehearsal proves the mechanism works, using a retained
  262,865-row baseline. Treat that as a baseline, not a service target.
• Day close still reports commissions and waste as unavailable rather than
  inventing zero values, and attendance classifications are evidence for
  payroll rather than payroll-final money.
• There is no managed cloud and no staffed support. The product is local-first,
  open source, and still requires an observed private pilot before any
  production-readiness claim.

One note specific to this release: the automated pipeline builds, signs,
notarizes and smoke-tests each platform, but the manual multi-platform
validation on representative machines has not been refreshed since candidate
fc0439d5. That check remains outstanding for both v1.10.0 and v1.10.1 and is
the reason the staged desktop rollout should not be promoted on the strength of
this release alone.

Downloads

Open the v1.10.1 GitHub release
and choose the signed Windows x64 installer, notarized macOS Apple Silicon
archive, Linux x64 AppImage, or web bundle. Update-feed files are consumed by
the desktop updater and are not manual installers.

For engineers and auditors, the generated
v1.10.0...v1.10.1 comparison
keeps the complete commit-level history, and the pull request linked from it
records the affected advisory identifiers and the version bisection behind the
table-component change.