v0.3.29
2026-05-19 · Phase 0 hardeningFixed
requires-pythonraised to>=3.11— wheels only ship cp311, users on 3.8/3.9/3.10 get a clear pip error instead of a cryptic linker failure.- Sensor dimension cap unified at
2048across the WASM client, the conversion server, the browser app, the QA harness, and visible site copy. - Root
CITATION.cffremoved —public/CITATION.cffis the single source of truth (root copy lagged at 0.3.27).
Changed
- Server CORS default tightened to
https://codec.mirrorfractal.com. Override at run time viaMFC_ALLOWED_ORIGINS. - WASM release profile strips debug info and the producers section;
wasm-opt -Oz --strip-debug --strip-producersafter build.
Security
scripts/ip_audit_public.shenforces a hard-ban + review list against thepublic/mirror; wired into a pre-push git hook.- WASM build pipeline rejects leaked Rust source paths or sensitive symbol names before the artifact is shipped.
scripts/scrub_wheel.pyverifies wheels are clean of sensitive patterns after substitution.