Kdenlive 26.04.1 יצאה לאור

The first maintenance release of the 26.04 series is now available, with the usual batch of stability fixes and workflow improvements.

Thanks to an NLnet/NGI0 grant, we had a security audit provided by Radically Open Security. The audit found one serious vulnerability that can happen when opening a malicious project file, allowing remote code execution. This is fixed with Kdenlive 26.04.1. Thanks to Edoardo Geraci and Radically Open Security for helping us make our software safer!

We are not aware of the vulnerability being exploited so far. It is important to understand that this security issue is about a manipulated .kdenlive project file containing potentially malicious code. Therefore, it is only relevant if you open a .kdenlive project file that you received from someone else or downloaded from the internet. If you are working only with your own projects or with shared projects in collaboration with fully trusted partners, there is no security risk.

If you cannot upgrade, do not open a project file that was not created by you.

Although the vulnerability is fixed in 26.04.1, we have also implemented another layer of security checks for the upcoming 26.08.0 to warn the user if some other unexpected input is detected in a project file.

Head to our download section to get the latest binaries, or check the updates from your package manager. Please note that for Linux only AppImage and Flatpak are supported by the Kdenlive team.

יומן שינויים מלא

• Try to fix MacOS app permissions. Commit.
• Fix minimum MacOS supported version in Info.plist. Commit.
• Ensure we don't try to access uninitialized media recorder. Commit.
• Ensure we don't try to access audio device before permission confirmed. Commit.
• Warn user on invalid preset on document open. Commit.
• Fix Clip Monitor position stuck when switch clip. Commit. Fixes issue #2177
• Fix otiotest. Commit.
• Fix nonstop message asking to confirm sequence resize. Commit. Fixes bug #518990
• MacOS: explicitely request mic permission. Commit. See bug #509281
• Fix tab order in create color clip dialog. Commit.
• Fix plist typo. Commit.
• Update Mac plist. Commit. See bug #509281
• Fix dropping sequence without audio in timeline. Commit. Fixes bug #519583
• Fix clip monitor playhead remains the same when switching clips. Commit. See issue #2177
• Fix welcome screen recent profile opening incorrect project profile. Commit.
• Fix archiving of title files with images. Commit. See bug #518992
• Fix crash cutting subtitle on layer > 0. Commit. Fixes bug #519505
• Switch transition preview to gif format since most of our binaries don't encode webp. Commit.
• Fix transition preview generation. Commit.
• Fix crash switching multiple times between icon and list view in transitions list. Commit.
• Fix trying to access uninitialized core profile on document open. Commit.
• Fix render test suite crash on unknown render profile. Commit.
• Sanitize proxy parameters. Commit.
• Limit the number of supported layers in subtitles. Commit.
• Always adjust composition duration on drop if there are clips above and below. Commit.
• Fix missing Q_EMIT keyword. Commit.
• Only show transition preview action if python is found. Commit.
• Fix freeze canceling project recovery. Commit.
• Fix playlist with different profile always have audio + video. Commit. Fixes bug #497943
• Fix proxying playlist clip always adds audio. Commit. See bug #497943
• MacOS: fix monitor offset with transform on zoom. Commit.
• Bin icon mode: show folder indicator when item has zones, double click a sequence will expand/colapse it as well as open the sequence in timeline. Commit. Fixes bug #518857
• Ensure double click opens sequence even when it has subclips. Commit. Fixes bug #518857
• Cleanup audio level code, fix possible crash when adding first clip. Commit.
• Transitions preview: script should only generate previews for custom lumas for now. Commit.
• Don't show incorrect transition preview. Commit.
• Fix crash closing app through welcomne screen close button. Commit.

הערות