PhotoCraft v0.14.0: safer file opening and Extras that hide transform controls

PhotoCraft v0.14.0 came out on 23 October 2026, three hours after v0.13.0. It is a small release: its release notes list 8 merged pull requests from 4 contributors, 1 of them a first-time contributor. Five of the eight make opening files safer, one makes View › Extras hide the Move tool's transform controls as in Photoshop, and one tightens what automation sessions confined to a workspace can reach. The README still counts 67 tools, and the project's scorecard is the same as in v0.13.0. PhotoCraft is still early alpha, so expect rough edges.

What the security fixes mean for you

An image file tells the program that reads it how big the picture is, how many slices or colours it has and how its data is packed. A damaged or deliberately crafted file can lie about this: it can claim a size that would need many gigabytes of memory, or hold data that grows enormously when unpacked. Without checks, opening such a file can freeze PhotoCraft, run it out of memory or crash it. The fixes below make PhotoCraft check those claims before doing the work, and refuse a file whose numbers don't add up. Ordinary files open as before. If you open images from the web, email or other people, update.

Highlights

• Safer opening of files from elsewhere:
  • PSD: slice records are looked up through an index instead of a search that grew with the square of the number of slices, so a crafted slices block can't keep PhotoCraft busy (#8417).
  • PCX and XPM: PhotoCraft checks that the file really holds the rows it declares before it reserves memory for the image (#8405).
  • SVG: a PNG or WebP image embedded in an SVG is measured by its own header before it is decoded, so a small, highly compressed picture can't make PhotoCraft allocate gigabytes (#8504). A gzip-compressed SVG (.svgz) is unpacked once, within PhotoCraft's size limit, and so is a compressed SVG embedded in another one (#8505).
  • Files and crash recovery: opening something that isn't a regular file is refused, recovery records over 1 MiB or behind a symbolic link are ignored, and a recovery entry can't point outside the recovery folder (#8406).
• View › Extras hides the transform controls. With the Move tool and Show Transform Controls on, ⌘H / Ctrl+H now hides the blue box and its handles along with the other Extras, as in Photoshop, and pressing it again brings them back. Hidden handles don't react to the pointer, and the Show Transform Controls setting is kept. The corner-radius handles of live shapes still show (#6705). See /guides/shortcuts.
• Automation workspaces hold on more routes. Sessions limited to read and write folders now apply those limits to data-set export, linked smart objects and dialogs too. Details below (#8680).

Automation (CLI & MCP)

These changes only affect automation sessions confined to a workspace (read and write roots). Trusted local sessions and the desktop app behave as before (#8680).

• doc.exportDataSets checks every Pixel Replacement image path against the workspace before writing anything, as image.applyDataSet already did.
• PSD, PSB and layered TIFF saves from such a session write a linked smart object as pixels, with the usual warning, instead of embedding the linked file.
• Re-rendering a linked smart object reads its file only if the workspace allows it; otherwise the layer keeps its last rendering.
• ui.dialog.set and ui.dialog.open can't add the hidden fields that send a dialog to another handler, and confirming a dialog that writes files is judged as its file command, such as file.save or file.print.
• An action that pauses at a step dialog resumes under the same workspace limits it was playing under.

Setup and examples: /guides/mcp-cli.

Web build

The online editor on this site doesn't run this build; it has moved on to a newer one. The v0.14.0 web zip is 12,011,648 bytes (11.5 MiB), 4,141 bytes more than v0.13.0's. As before, the app itself is one gzipped part, here 11,911,894 bytes, started by a small boot module. Chinese, Japanese and Korean text still shows as empty boxes in the web build (#1615, still open). Self-hosting notes are on /download/web.

Fixes and stability

• Reading every n-th pixel of a row no longer overflows at extreme coordinates or large steps. The fix came from a code review; no crash in the app was shown (#8668).

More known problems and fixes: /guides/troubleshooting.

Breaking changes or things to know

• No FreeBSD aarch64 build. The release notes say again that this target can't be built within the 5-hour CI limit shared by the Craft apps (craft-common-actions#39, still open). FreeBSD x86_64 is there.
• Workspace automation no longer embeds linked files in PSD, PSB or layered TIFF saves. Those layers arrive as pixels; save from the desktop app or a trusted session to keep the link's contents embedded (#8680).

How to update

Download the v0.14.0 build for your system from /download: Windows, macOS, Linux or the web build. The release has the same 28 files as v0.13.0, with SHA256SUMS.txt to check them against. Builds come only from the official GitHub release; avoid third-party mirrors. If you are coming from v0.12.0 or earlier, also read the v0.13.0 notes. The next release, v0.15.1, came out the same day and continues the security work.

Full release notes, with every merged pull request: PhotoCraft v0.14.0 on GitHub.