Raster masks are bounded per document as well as per mask (96 megapixels
and 128 MiB of embedded data), with a decoder spy test proving that the
header check runs before any pixel is decoded. The README and wiki now
state precisely what is migrated, that the response cache is deleted and
rebuilt, that old public files remain on a ComfyUI without the System
User API, and that the containment rule covers the listed consumers, not
arbitrary plugins. package-lock.json carries the 1.4.2 version.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
