fix(audit): remediate the September 25 audit across all five crates - #325

Closed

LeadcodeDev wants to merge 43 commits into

mainfrom

chantier/audit-2026-09-25

Commits on Sep 25, 2026

fix(animator): gate a timeline step's animation on its own at
LeadcodeDev
committed
b9cf23a
feat(svg): add a fill-reveal draw-on mode via `reveal: fill`
LeadcodeDev
committed
5bda143
fix(css): default flex-direction to column when unset
LeadcodeDev
committed
8afc4c1
fix(animator): rebase a start_at'ed node's animation clock on its own start_at
LeadcodeDev
committed
83f7ca6
fix(geometry): clamp content-overflow checks to the containing block's box
LeadcodeDev
committed
3ba6f76
docs(skills): document the svg reveal modes and how they compose
LeadcodeDev
committed
f99224b
docs(skills): teach the schema the binary actually accepts
LeadcodeDev
committed
2ee05c1
fix(encode): keep the incremental encoder's slot indices aligned
LeadcodeDev
committed
4cce2e1
fix(render): refuse flags the bundled encoder cannot honour
LeadcodeDev
committed
2cd2c98
fix(encode): make the ffmpeg path produce what the flags asked for
LeadcodeDev
committed
5d17cfe
fix(security): close the file reads a scenario could reach
LeadcodeDev
committed
baee884
feat(cli): validate in still the way render already does
LeadcodeDev
committed
08aaace
fix(studio): stop writing scenarios the engine refuses
LeadcodeDev
committed
a650157
fix(components): paint inside the box layout assigned, not a self-computed size
LeadcodeDev
committed
70bbf52
fix(geometry): measure against the real viewport and the real camera
LeadcodeDev
committed
74b0f59
feat(css): make mix-blend-mode, clip-path and visibility do something
LeadcodeDev
committed
ed5e1cf
fix(schema): describe the shapes the parser actually accepts
LeadcodeDev
committed
72b74b3
fix(cli,studio): drop the references text-decoration left behind
LeadcodeDev
committed
9ffb064
fix(badge): stop overriding the alignment its parent asked for
LeadcodeDev
committed
0915bea
fix(examples): make the corpus pass its own validator again
LeadcodeDev
committed
de86870
style(studio): reflow the line left by the text-decoration removal
LeadcodeDev
committed
2e12aae
fix(layout): stop the taffy bridge from swallowing what it cannot translate
LeadcodeDev
committed
2faca28
fix(animator): stop the timing layer from failing quietly
LeadcodeDev
committed
6028508
fix(schema): refuse the keys it used to swallow, and name them
LeadcodeDev
committed
2ae09e2
perf(renderer): cache text measurement instead of narrowing the thread pool
LeadcodeDev
committed
5b81cd3
perf(encode): save frames on the threads that rendered them
LeadcodeDev
committed
e7b8b80
fix(encode): stop --watch from trusting a hash that ignores the files
LeadcodeDev
committed
4d2ca43
fix(encode): check what the container and the codec can actually hold
LeadcodeDev
committed
09a33c3
fix(expand): give each iteration its own scope instead of one flat pass
LeadcodeDev
committed
8739c37
fix(include): resolve directives before rebasing, and clone a repeated index
LeadcodeDev
committed
781b98f
fix(engine): make the scroll wrap, the camera stack and the world clock honest
LeadcodeDev
committed
46d814b
fix(core,studio): let the paint pass and the studio use what the engine knows
LeadcodeDev
committed
b12801c
style(expand): reflow the type-mismatch error construction
LeadcodeDev
committed
d9bcb33
fix(ci): gate publishing on main, and take the fixes that were already available
LeadcodeDev
committed
59d93e5
fix(html): refuse what the dialect cannot express, and reach what it could not
LeadcodeDev
committed
f1d5d37
docs(skills): update the dialect reference to what it now does
LeadcodeDev
committed
9b47e8e
fix(chart): stop the charts from drawing a plausible wrong answer
LeadcodeDev
committed
a7c814a
docs(skills): document the radial bar's explicit maximum
LeadcodeDev
committed
3da2f01
fix(security): guard every ffmpeg input, not one of four
LeadcodeDev
committed
ba9b361
fix(paint): stop the paint pass from clipping, dropping and double-painting
LeadcodeDev
committed
ee173f6
fix(studio,cli): make the editor and the validator report what they see
LeadcodeDev
committed
1233e80
fix(components): spend the typewriter budget in characters, and stop the bleeding
LeadcodeDev
committed
0ef48b9
fix(cli): keep key order through --fix, and refuse transparency before rendering
LeadcodeDev
committed
347c609