v0.1.16

Historical download — May 2026. Superseded by PDFwringer 0.2.0, which includes the September hardening, password-retry fix, target-size compression, and original/result comparison. The current app requires Apple silicon and macOS 27.0+. This older release and its original asset are preserved as history. See CHANGELOG.md for the progression.

Security Hardening

• Image export: atomic writes, symlink protection, path containment, output count/disk guards
• Preview rendering: single-flight guard prevents resource exhaustion from rapid slider changes
• Metadata flattening: temp file cleanup on all exit paths (cancellation, errors) via defer
• Color adjustment: throws on all-pages-skipped instead of writing empty PDF
• Thumbnail rendering: moved back to MainActor to prevent PDFKit thread-safety races
• Encrypted PDFs: block silent deprotection in metadata save; warn in rotate/crop save
• Multi-file import: async background loading prevents UI freeze on large batches
• Metadata reading: truncate fields to 10K chars to prevent DoS from crafted PDFs
• Heuristic scan: cap page sampling to 10 pages; guard against Inf/NaN numeric conversion
• Split output: unique filenames on collision instead of silently overwriting existing files
• Build system: sandbox entitlements applied in make app; README recommends signed builds

Test Improvements

• Fixed flaky async tests: polling-based state wait instead of fixed sleep timers
• 263 tests across 43 suites, all passing reliably under parallel load