PhotoCraft v0.15.1: a round of security hardening for files, printing and plug-ins

PhotoCraft v0.15.1 came out on 23 October 2026, 22 hours after v0.14.0. It is the release after v0.14.0: there is no v0.15.0 release or tag. The version was set to 0.15.0 (e6d6fb4), and every platform built, but the macOS job failed twice after Apple had accepted the notarization: Apple's ticket lookup dropped the connection, first while the DMG was being stapled and then while it was being checked, so no release was drafted (run). About seven hours later the build went out as 0.15.1, with a fix that retries stapling (#8995, 60c87b9). Its release notes list 28 merged pull requests from 5 contributors, with no first-time contributors; about a third are build and test tooling. Most of the rest continue v0.14.0's security work. The README still counts 67 tools, and the scorecard is unchanged. PhotoCraft is still early alpha, so expect rough edges.

What the security fixes mean for you

Most of the fixes come from an automated review of PhotoCraft's code that looked for places where a file, a printer reply or a plug-in controls how much work PhotoCraft does. A damaged or crafted file can claim sizes and counts that make the app freeze, run out of memory or crash. After this release, PhotoCraft counts that work against fixed budgets in many more places, and refuses or simplifies what goes over them. Ordinary files open and render as before. If you open files from people or sites you don't know, update.

Highlights

• Bounds on file parsers:
  • PSD: pattern memory used by a malformed pattern block stays counted, so a later block can't reuse it; text runs and styles, plane buffers and duplicate EXIF text are bounded (#8767, #8768, #8959, #8771).
  • Affinity: shared objects that expand many times, curve records and metadata count against document-wide budgets (#8938).
  • JPEG, WebP and RAW: a truncated JPEG may not claim far more pixels than its data could hold, an animated WebP's ICC profile copies are counted, and RAW lossless-JPEG and TIFF preview buffers are bounded (#8947, #8959). Complete files are unaffected.
  • Fonts, vectors and colour: font collections, warp meshes, contours, gradient stops and ICC curves have limits too (#8768, #8769, #8959).
• Printing and plug-ins. A printer's IPP reply now has a total time limit, so a slow or hostile print server can't keep PhotoCraft waiting (#8956). Plug-ins can't claim the host's own routing keys, their band counts and start-up work are limited, and plug-in files are opened without blocking on special files (#8958).
• ICC profiles are compared by their bytes. PhotoCraft used to treat two profiles with the same 64-bit hash as identical. A crafted profile could share another's hash and be converted with the wrong colours, or not converted at all. Now the bytes are compared (#8863).
• Linked files find their paths more reliably. Every stored path, for linked smart objects, the Displace map, Color Lookup files, Print, video and data-set images, goes through one resolver. On macOS and Linux, a stored Windows path such as C:\… is refused as invalid instead of being read as relative to the document (#8032).

New tools and features

• Select and Mask, engine part. select.refineEdge takes an edits list: the workspace's Quick Selection, Brush, Lasso, Object Selection, Select Subject, Clear and Invert, applied in order before the edge is refined, as one history step. This is the first of two parts: the Select and Mask workspace itself isn't in this release or in v0.16.0, so for now only automation can use it. Steps with edits are refused by strict .atn export, since Photoshop's format has no field for them (#8783). See /guides/mcp-cli.

Web build

The online editor on this site doesn't run this build; it has moved on to a newer one. The v0.15.1 web zip is 12,058,467 bytes (11.5 MiB), up from v0.14.0's 12,011,648; the gzipped app part inside is 11,958,452 bytes. Chinese, Japanese and Korean text still shows as empty boxes in the web build (#1615, still open). Self-hosting notes are on /download/web.

Fixes and stability

• Large working sets are capped: Content-Aware Fill on a very large area skips the turned and scaled sample variants instead of allocating a huge mostly empty image, Liquify uses a coarser grid when a fine one would be too big, and warps and resampling limit their bookkeeping (#8946). The new Select and Mask edits are bounded the same way: their brushes have a total area limit, and Invert works only on the tiles the selection holds (#8783).
• Compositing: sparse filter masks and shape strokes are mixed tile by tile, and very large effect builds are skipped (#8949); clipped groups are planned without exponential work on the GPU, and pattern swatches read only the pixels they show (#8960); tile counts and shared tiles are bounded (#8953).
• The helper script a droplet creates can only be read and run by your own account (#8870).

More known problems and fixes: /guides/troubleshooting.

Breaking changes or things to know

• There is no v0.15.0. The version went straight from 0.14.0 to 0.15.1.
• Deeply nested Blend If groups. A group with Blend If that sits more than two levels deep inside other such groups is now judged by its composited result, as adjustment layers are, instead of re-compositing its children at every level. That stops the work doubling per level, but such files may now render a little differently (#8949).
• No FreeBSD aarch64 build, as in v0.13.0 and v0.14.0 (craft-common-actions#39).

How to update

Download the v0.15.1 build for your system from /download: Windows, macOS, Linux or the web build. The release has the same 28 files as v0.14.0, with SHA256SUMS.txt to check them against. Builds come only from the official GitHub release; avoid third-party mirrors. If you are coming from v0.13.0 or earlier, also read the v0.14.0 notes. The next release, v0.16.0, brings area type, .asl style libraries and an update check.

Full release notes, with every merged pull request: PhotoCraft v0.15.1 on GitHub.