MetaLens v0.5.0

Added

• Exit button. An Exit button at the right of the toolbar closes MetaLens: it stops the background
  process that reads and writes the metadata (with everything it started), cancels a download in progress and
  releases its memory and port. It waits while a save is in progress. (File → Quit does the same.)
• Add a position. The Batch dialog puts a latitude and longitude on the selected pictures, or looks up the
  position of each picture by its capture time along a GPX track (with a camera-clock offset and a maximum gap);
  pictures of formats that cannot hold a position are reported. GPS entries can now also be added by hand.
• Legacy Office (DOC, XLS, PPT): the document properties (author, company, manager, custom ones...) can be
  removed in place, without changing the size of the file; Undo restores it exactly.
• Canon CR3 and Fujifilm RAF raw files: EXIF, GPS and the preview picture metadata are read.
• PDF: the XMP metadata stream is now shown and can be removed as a whole (its edit history and identifiers
  were previously kept); TIFF: the IPTC record can be removed as a whole.
• Other languages of XMP texts (title, description...) are listed next to the main text (xmp:dc:title@de),
  read only. Camera maker data: the serial number, owner name, lens and similar values stored in Canon, Nikon
  and Sony camera notes are shown (maker:*, read only) and counted as device or identity data when preparing a
  file for sharing; removing the camera note removes them.
• Search by common names. The names used by the search box are also served by the sidecar (GET /aliases).
• Canon CR3 and Fujifilm RAF files now say why they are read only.
• Operations on several files. A Batch button in the file list works on the selected files: prepare them
  for sharing, shift their dates (minutes, hours or days, forwards or backwards), copy the metadata of the first
  file to the others, rename from metadata (template such as {exif:DateTimeOriginal|%Y%m%d}_{name}) and, for the
  folder, export the metadata of every file to CSV or JSON. Each action shows a preview first; every file is saved
  and can be undone on its own.
• Prepare for sharing. A new Share tab removes what a file reveals before it is sent to someone: choose a
  preset (location, personal data, everything shown) or individual categories, see exactly which fields will
  be removed and which cannot be, then apply it in one step that can be undone (POST /sanitize).
• Editing and adding metadata in TIFF, DNG and RAW (TIFF-based), HEIC/HEIF/AVIF and MP4/MOV files.
  EXIF entries and XMP properties can be changed or added (a longer value is stored at the end of the file and
  the entry points to it; nothing that exists is moved, the picture data is verified unchanged and every change
  can be undone). In videos the creation/modification dates, location, device, software and text entries can be
  changed or created, and XMP can be edited or created; a longer value is stored by growing the movie atom
  (the media data and its offsets are kept consistent). RAW support is experimental.
• PNG and WebP can now be edited: EXIF and XMP fields are written (WebP files gain the extended header
  they need), PNG text chunks can be removed, the picture data is verified unchanged on every save (and the
  save is refused otherwise) and every change can be undone.
• Office documents (DOCX, XLSX, PPTX): application and custom properties (company, manager, template,
  custom fields...) can now be removed, one by one or with Prepare for sharing, and the change can be undone.
• OpenDocument and EPUB files can be edited: texts, dates and custom fields can be rewritten or added, any
  field can be removed (an EPUB keeps its identifier, title and language) and the change can be undone; the rest
  of the package is copied unchanged and signed documents stay untouched.
• Matroska and WebM (MKV, WEBM, MKA): the file's own fields are now read (title, muxer and writing
  application, date, tags, attachments, tracks) instead of the generic reader, and the title, tags, dates and
  attachments can be removed or, for texts, rewritten when they fit (also with Prepare for sharing). Nothing
  is moved, the audio and video data is verified unchanged and every change can be undone byte for byte.
• HEIC, HEIF and AVIF: removal of metadata. EXIF, GPS and XMP can be removed in place (also with Prepare
  for sharing); the image items are verified unchanged and the change can be undone byte for byte.
• TIFF, DNG and TIFF-based RAW files: removal of metadata. Camera, owner, software, dates, GPS and the other
  EXIF entries (and XMP properties) can be removed without moving anything in the file: the removed values are
  zeroed, the picture data and the maker note stay valid and unchanged (verified on every save), and the change
  can be undone byte for byte. RAW support is marked experimental. Nothing can be added or edited in these files.
• MP4, MOV and M4A: removal of structure and XMP. Location, device, dates, text atoms and XMP of videos can
  be removed (also with Prepare for sharing). Nothing in the file is moved and the audio/video data is
  verified unchanged; the change can be undone byte for byte.
• XMP data not shown (edit history, document identifiers, derived-from...) is now listed as one field
  (xmp:@hidden) and is removed together with the other personal data by Prepare for sharing.
• Privacy indicators. Every field is classified by what it can reveal when the file is shared (location,
  identity, device, dates, software, thumbnail, free text). The metadata views show a badge on each sensitive
  field and a line summarizing what sharing the file would reveal. The API exposes sensitivity per field and
  sensitivity_summary per file.
• Video and audio structure (MP4, MOV, M4A). Brand, creation and modification dates, track list (type,
  language, size, rotation, codec, frame rate, sample rate, channels), QuickTime keys (including the location
  and device written by phones), text atoms and the XMP packet, all read-only (qt: fields).
• HEIC, HEIF and AVIF images: size, rotation, EXIF, GPS, XMP and ICC profile.
• PNG: XMP is now shown as regular xmp: fields; image header (bit depth, colour type, interlace), last
  modification time and ICC profile.
• TIFF and DNG: embedded XMP, IPTC and ICC profile.
• JPEG: JFIF header, comments, Multi-Picture index and ICC profile (read-only).
• RAW: Olympus ORF and Panasonic RW2/RWL files are read, as well as more TIFF-based RAW extensions.
• OpenDocument (ODT, ODS, ODP, ODG) and EPUB metadata (read-only).
• PDF: version and linearization are shown.
• Audio: MPEG layer/version/channel mode/bitrate mode/encoder, FLAC stream details, encoder vendor of
  Vorbis files; pictures and general objects show their type and description.
• Files without an extension are recognized from their content and handled like their format (a JPEG
  named photo can now be read and edited like a .jpg).

Security

• The Batch operations (prepare for sharing, shift dates, copy tags, add a position) no longer return the text of
  an internal error for a file that failed: each failed file carries its structured errors list only (the
  detail field of those results is gone).
• GitHub Actions: the package smoke-test jobs now run with read-only repository permissions.
• Development dependency minimatch (used by the packaging tools) updated to 11.0.4 where the packager uses it.

Changed

• The About window is wider (and shows longer release notes), so it no longer looks narrow and tall when an update is available.
• Keys: png:XML:com.adobe.xmp is replaced by the xmp: fields it contains; PNG text in several languages
  is png:<keyword>@<language> instead of png:<keyword>#2; files without an extension use their format's
  keys (e.g. exif:*) instead of hachoir:*; MKV and WebM files use mkv:* keys instead of hachoir:*.
• The temporary copy used while saving now has the same name as the file (inside the private temporary folder).
• A tag editor that cannot open a movie shows its structure read-only instead of reporting a read error.
• An Exif 3.0 UTF-8 text tag no longer makes the whole EXIF block non-rewritable.
• Code quality: circular imports between the image and HEIC handlers removed, unused code and empty error
  handlers cleaned up, a few tests strengthened (they now compare the restored bytes after Undo).

Full Changelog: v0.4.1...v0.5.0

MetaLens v0.5.0-beta.3 (beta)

Added

• Exit button. An Exit button at the right of the toolbar closes MetaLens: it stops the background
  process that reads and writes the metadata (with everything it started), cancels a download in progress and
  releases its memory and port. It waits while a save is in progress. (File → Quit does the same.)
• Add a position. The Batch dialog puts a latitude and longitude on the selected pictures, or looks up the
  position of each picture by its capture time along a GPX track (with a camera-clock offset and a maximum gap);
  pictures of formats that cannot hold a position are reported. GPS entries can now also be added by hand.
• Legacy Office (DOC, XLS, PPT): the document properties (author, company, manager, custom ones...) can be
  removed in place, without changing the size of the file; Undo restores it exactly.
• Canon CR3 and Fujifilm RAF raw files: EXIF, GPS and the preview picture metadata are read.
• PDF: the XMP metadata stream is now shown and can be removed as a whole (its edit history and identifiers
  were previously kept); TIFF: the IPTC record can be removed as a whole.
• Other languages of XMP texts (title, description...) are listed next to the main text (xmp:dc:title@de),
  read only. Camera maker data: the serial number, owner name, lens and similar values stored in Canon, Nikon
  and Sony camera notes are shown (maker:*, read only) and counted as device or identity data when preparing a
  file for sharing; removing the camera note removes them.
• Search by common names. The names used by the search box are also served by the sidecar (GET /aliases).
• Canon CR3 and Fujifilm RAF files now say why they are read only.
• Operations on several files. A Batch button in the file list works on the selected files: prepare them
  for sharing, shift their dates (minutes, hours or days, forwards or backwards), copy the metadata of the first
  file to the others, rename from metadata (template such as {exif:DateTimeOriginal|%Y%m%d}_{name}) and, for the
  folder, export the metadata of every file to CSV or JSON. Each action shows a preview first; every file is saved
  and can be undone on its own.
• Prepare for sharing. A new Share tab removes what a file reveals before it is sent to someone: choose a
  preset (location, personal data, everything shown) or individual categories, see exactly which fields will
  be removed and which cannot be, then apply it in one step that can be undone (POST /sanitize).
• Editing and adding metadata in TIFF, DNG and RAW (TIFF-based), HEIC/HEIF/AVIF and MP4/MOV files.
  EXIF entries and XMP properties can be changed or added (a longer value is stored at the end of the file and
  the entry points to it; nothing that exists is moved, the picture data is verified unchanged and every change
  can be undone). In videos the creation/modification dates, location, device, software and text entries can be
  changed or created, and XMP can be edited or created; a longer value is stored by growing the movie atom
  (the media data and its offsets are kept consistent). RAW support is experimental.
• PNG and WebP can now be edited: EXIF and XMP fields are written (WebP files gain the extended header
  they need), PNG text chunks can be removed, the picture data is verified unchanged on every save (and the
  save is refused otherwise) and every change can be undone.
• Office documents (DOCX, XLSX, PPTX): application and custom properties (company, manager, template,
  custom fields...) can now be removed, one by one or with Prepare for sharing, and the change can be undone.
• OpenDocument and EPUB files can be edited: texts, dates and custom fields can be rewritten or added, any
  field can be removed (an EPUB keeps its identifier, title and language) and the change can be undone; the rest
  of the package is copied unchanged and signed documents stay untouched.
• Matroska and WebM (MKV, WEBM, MKA): the file's own fields are now read (title, muxer and writing
  application, date, tags, attachments, tracks) instead of the generic reader, and the title, tags, dates and
  attachments can be removed or, for texts, rewritten when they fit (also with Prepare for sharing). Nothing
  is moved, the audio and video data is verified unchanged and every change can be undone byte for byte.
• HEIC, HEIF and AVIF: removal of metadata. EXIF, GPS and XMP can be removed in place (also with Prepare
  for sharing); the image items are verified unchanged and the change can be undone byte for byte.
• TIFF, DNG and TIFF-based RAW files: removal of metadata. Camera, owner, software, dates, GPS and the other
  EXIF entries (and XMP properties) can be removed without moving anything in the file: the removed values are
  zeroed, the picture data and the maker note stay valid and unchanged (verified on every save), and the change
  can be undone byte for byte. RAW support is marked experimental. Nothing can be added or edited in these files.
• MP4, MOV and M4A: removal of structure and XMP. Location, device, dates, text atoms and XMP of videos can
  be removed (also with Prepare for sharing). Nothing in the file is moved and the audio/video data is
  verified unchanged; the change can be undone byte for byte.
• XMP data not shown (edit history, document identifiers, derived-from...) is now listed as one field
  (xmp:@hidden) and is removed together with the other personal data by Prepare for sharing.
• Privacy indicators. Every field is classified by what it can reveal when the file is shared (location,
  identity, device, dates, software, thumbnail, free text). The metadata views show a badge on each sensitive
  field and a line summarizing what sharing the file would reveal. The API exposes sensitivity per field and
  sensitivity_summary per file.
• Video and audio structure (MP4, MOV, M4A). Brand, creation and modification dates, track list (type,
  language, size, rotation, codec, frame rate, sample rate, channels), QuickTime keys (including the location
  and device written by phones), text atoms and the XMP packet, all read-only (qt: fields).
• HEIC, HEIF and AVIF images: size, rotation, EXIF, GPS, XMP and ICC profile.
• PNG: XMP is now shown as regular xmp: fields; image header (bit depth, colour type, interlace), last
  modification time and ICC profile.
• TIFF and DNG: embedded XMP, IPTC and ICC profile.
• JPEG: JFIF header, comments, Multi-Picture index and ICC profile (read-only).
• RAW: Olympus ORF and Panasonic RW2/RWL files are read, as well as more TIFF-based RAW extensions.
• OpenDocument (ODT, ODS, ODP, ODG) and EPUB metadata (read-only).
• PDF: version and linearization are shown.
• Audio: MPEG layer/version/channel mode/bitrate mode/encoder, FLAC stream details, encoder vendor of
  Vorbis files; pictures and general objects show their type and description.
• Files without an extension are recognized from their content and handled like their format (a JPEG
  named photo can now be read and edited like a .jpg).

Security

• The Batch operations (prepare for sharing, shift dates, copy tags, add a position) no longer return the text of
  an internal error for a file that failed: each failed file carries its structured errors list only (the
  detail field of those results is gone).
• GitHub Actions: the package smoke-test jobs now run with read-only repository permissions.
• Development dependency minimatch (used by the packaging tools) updated to 11.0.4 where the packager uses it.

Changed

• The About window is wider (and shows longer release notes), so it no longer looks narrow and tall when an update is available.
• Keys: png:XML:com.adobe.xmp is replaced by the xmp: fields it contains; PNG text in several languages
  is png:<keyword>@<language> instead of png:<keyword>#2; files without an extension use their format's
  keys (e.g. exif:*) instead of hachoir:*; MKV and WebM files use mkv:* keys instead of hachoir:*.
• The temporary copy used while saving now has the same name as the file (inside the private temporary folder).
• A tag editor that cannot open a movie shows its structure read-only instead of reporting a read error.
• An Exif 3.0 UTF-8 text tag no longer makes the whole EXIF block non-rewritable.
• Code quality: circular imports between the image and HEIC handlers removed, unused code and empty error
  handlers cleaned up, a few tests strengthened (they now compare the restored bytes after Undo).

Full Changelog: v0.5.0-beta.2...v0.5.0-beta.3

MetaLens v0.5.0-beta.2 (beta)

Added

• Exit button. An Exit button at the right of the toolbar closes MetaLens: it stops the background
  process that reads and writes the metadata (with everything it started), cancels a download in progress and
  releases its memory and port. It waits while a save is in progress. (File → Quit does the same.)
• Add a position. The Batch dialog puts a latitude and longitude on the selected pictures, or looks up the
  position of each picture by its capture time along a GPX track (with a camera-clock offset and a maximum gap);
  pictures of formats that cannot hold a position are reported. GPS entries can now also be added by hand.
• Legacy Office (DOC, XLS, PPT): the document properties (author, company, manager, custom ones...) can be
  removed in place, without changing the size of the file; Undo restores it exactly.
• Canon CR3 and Fujifilm RAF raw files: EXIF, GPS and the preview picture metadata are read.
• PDF: the XMP metadata stream is now shown and can be removed as a whole (its edit history and identifiers
  were previously kept); TIFF: the IPTC record can be removed as a whole.
• Other languages of XMP texts (title, description...) are listed next to the main text (xmp:dc:title@de),
  read only. Camera maker data: the serial number, owner name, lens and similar values stored in Canon, Nikon
  and Sony camera notes are shown (maker:*, read only) and counted as device or identity data when preparing a
  file for sharing; removing the camera note removes them.
• Search by common names. The names used by the search box are also served by the sidecar (GET /aliases).
• Canon CR3 and Fujifilm RAF files now say why they are read only.
• Operations on several files. A Batch button in the file list works on the selected files: prepare them
  for sharing, shift their dates (minutes, hours or days, forwards or backwards), copy the metadata of the first
  file to the others, rename from metadata (template such as {exif:DateTimeOriginal|%Y%m%d}_{name}) and, for the
  folder, export the metadata of every file to CSV or JSON. Each action shows a preview first; every file is saved
  and can be undone on its own.
• Prepare for sharing. A new Share tab removes what a file reveals before it is sent to someone: choose a
  preset (location, personal data, everything shown) or individual categories, see exactly which fields will
  be removed and which cannot be, then apply it in one step that can be undone (POST /sanitize).
• Editing and adding metadata in TIFF, DNG and RAW (TIFF-based), HEIC/HEIF/AVIF and MP4/MOV files.
  EXIF entries and XMP properties can be changed or added (a longer value is stored at the end of the file and
  the entry points to it; nothing that exists is moved, the picture data is verified unchanged and every change
  can be undone). In videos the creation/modification dates, location, device, software and text entries can be
  changed or created, and XMP can be edited or created; a longer value is stored by growing the movie atom
  (the media data and its offsets are kept consistent). RAW support is experimental.
• PNG and WebP can now be edited: EXIF and XMP fields are written (WebP files gain the extended header
  they need), PNG text chunks can be removed, the picture data is verified unchanged on every save (and the
  save is refused otherwise) and every change can be undone.
• Office documents (DOCX, XLSX, PPTX): application and custom properties (company, manager, template,
  custom fields...) can now be removed, one by one or with Prepare for sharing, and the change can be undone.
• OpenDocument and EPUB files can be edited: texts, dates and custom fields can be rewritten or added, any
  field can be removed (an EPUB keeps its identifier, title and language) and the change can be undone; the rest
  of the package is copied unchanged and signed documents stay untouched.
• Matroska and WebM (MKV, WEBM, MKA): the file's own fields are now read (title, muxer and writing
  application, date, tags, attachments, tracks) instead of the generic reader, and the title, tags, dates and
  attachments can be removed or, for texts, rewritten when they fit (also with Prepare for sharing). Nothing
  is moved, the audio and video data is verified unchanged and every change can be undone byte for byte.
• HEIC, HEIF and AVIF: removal of metadata. EXIF, GPS and XMP can be removed in place (also with Prepare
  for sharing); the image items are verified unchanged and the change can be undone byte for byte.
• TIFF, DNG and TIFF-based RAW files: removal of metadata. Camera, owner, software, dates, GPS and the other
  EXIF entries (and XMP properties) can be removed without moving anything in the file: the removed values are
  zeroed, the picture data and the maker note stay valid and unchanged (verified on every save), and the change
  can be undone byte for byte. RAW support is marked experimental. Nothing can be added or edited in these files.
• MP4, MOV and M4A: removal of structure and XMP. Location, device, dates, text atoms and XMP of videos can
  be removed (also with Prepare for sharing). Nothing in the file is moved and the audio/video data is
  verified unchanged; the change can be undone byte for byte.
• XMP data not shown (edit history, document identifiers, derived-from...) is now listed as one field
  (xmp:@hidden) and is removed together with the other personal data by Prepare for sharing.
• Privacy indicators. Every field is classified by what it can reveal when the file is shared (location,
  identity, device, dates, software, thumbnail, free text). The metadata views show a badge on each sensitive
  field and a line summarizing what sharing the file would reveal. The API exposes sensitivity per field and
  sensitivity_summary per file.
• Video and audio structure (MP4, MOV, M4A). Brand, creation and modification dates, track list (type,
  language, size, rotation, codec, frame rate, sample rate, channels), QuickTime keys (including the location
  and device written by phones), text atoms and the XMP packet, all read-only (qt: fields).
• HEIC, HEIF and AVIF images: size, rotation, EXIF, GPS, XMP and ICC profile.
• PNG: XMP is now shown as regular xmp: fields; image header (bit depth, colour type, interlace), last
  modification time and ICC profile.
• TIFF and DNG: embedded XMP, IPTC and ICC profile.
• JPEG: JFIF header, comments, Multi-Picture index and ICC profile (read-only).
• RAW: Olympus ORF and Panasonic RW2/RWL files are read, as well as more TIFF-based RAW extensions.
• OpenDocument (ODT, ODS, ODP, ODG) and EPUB metadata (read-only).
• PDF: version and linearization are shown.
• Audio: MPEG layer/version/channel mode/bitrate mode/encoder, FLAC stream details, encoder vendor of
  Vorbis files; pictures and general objects show their type and description.
• Files without an extension are recognized from their content and handled like their format (a JPEG
  named photo can now be read and edited like a .jpg).

Security

• The Batch operations (prepare for sharing, shift dates, copy tags, add a position) no longer return the text of
  an internal error for a file that failed: each failed file carries its structured errors list only (the
  detail field of those results is gone).
• GitHub Actions: the package smoke-test jobs now run with read-only repository permissions.
• Development dependency minimatch (used by the packaging tools) updated to 11.0.4 where the packager uses it.

Changed

• Keys: png:XML:com.adobe.xmp is replaced by the xmp: fields it contains; PNG text in several languages
  is png:<keyword>@<language> instead of png:<keyword>#2; files without an extension use their format's
  keys (e.g. exif:*) instead of hachoir:*; MKV and WebM files use mkv:* keys instead of hachoir:*.
• The temporary copy used while saving now has the same name as the file (inside the private temporary folder).
• A tag editor that cannot open a movie shows its structure read-only instead of reporting a read error.
• An Exif 3.0 UTF-8 text tag no longer makes the whole EXIF block non-rewritable.
• Code quality: circular imports between the image and HEIC handlers removed, unused code and empty error
  handlers cleaned up, a few tests strengthened (they now compare the restored bytes after Undo).

Full Changelog: v0.5.0-beta.1...v0.5.0-beta.2

MetaLens v0.5.0-beta.1 (beta)

Added

• Add a position. The Batch dialog puts a latitude and longitude on the selected pictures, or looks up the
  position of each picture by its capture time along a GPX track (with a camera-clock offset and a maximum gap);
  pictures of formats that cannot hold a position are reported. GPS entries can now also be added by hand.
• Legacy Office (DOC, XLS, PPT): the document properties (author, company, manager, custom ones...) can be
  removed in place, without changing the size of the file; Undo restores it exactly.
• Canon CR3 and Fujifilm RAF raw files: EXIF, GPS and the preview picture metadata are read.
• PDF: the XMP metadata stream is now shown and can be removed as a whole (its edit history and identifiers
  were previously kept); TIFF: the IPTC record can be removed as a whole.
• Other languages of XMP texts (title, description...) are listed next to the main text (xmp:dc:title@de),
  read only. Camera maker data: the serial number, owner name, lens and similar values stored in Canon, Nikon
  and Sony camera notes are shown (maker:*, read only) and counted as device or identity data when preparing a
  file for sharing; removing the camera note removes them.
• Search by common names. The names used by the search box are also served by the sidecar (GET /aliases).
• Canon CR3 and Fujifilm RAF files now say why they are read only.
• Operations on several files. A Batch button in the file list works on the selected files: prepare them
  for sharing, shift their dates (minutes, hours or days, forwards or backwards), copy the metadata of the first
  file to the others, rename from metadata (template such as {exif:DateTimeOriginal|%Y%m%d}_{name}) and, for the
  folder, export the metadata of every file to CSV or JSON. Each action shows a preview first; every file is saved
  and can be undone on its own.
• Prepare for sharing. A new Share tab removes what a file reveals before it is sent to someone: choose a
  preset (location, personal data, everything shown) or individual categories, see exactly which fields will
  be removed and which cannot be, then apply it in one step that can be undone (POST /sanitize).
• Editing and adding metadata in TIFF, DNG and RAW (TIFF-based), HEIC/HEIF/AVIF and MP4/MOV files.
  EXIF entries and XMP properties can be changed or added (a longer value is stored at the end of the file and
  the entry points to it; nothing that exists is moved, the picture data is verified unchanged and every change
  can be undone). In videos the creation/modification dates, location, device, software and text entries can be
  changed or created, and XMP can be edited or created; a longer value is stored by growing the movie atom
  (the media data and its offsets are kept consistent). RAW support is experimental.
• PNG and WebP can now be edited: EXIF and XMP fields are written (WebP files gain the extended header
  they need), PNG text chunks can be removed, the picture data is verified unchanged on every save (and the
  save is refused otherwise) and every change can be undone.
• Office documents (DOCX, XLSX, PPTX): application and custom properties (company, manager, template,
  custom fields...) can now be removed, one by one or with Prepare for sharing, and the change can be undone.
• OpenDocument and EPUB files can be edited: texts, dates and custom fields can be rewritten or added, any
  field can be removed (an EPUB keeps its identifier, title and language) and the change can be undone; the rest
  of the package is copied unchanged and signed documents stay untouched.
• Matroska and WebM (MKV, WEBM, MKA): the file's own fields are now read (title, muxer and writing
  application, date, tags, attachments, tracks) instead of the generic reader, and the title, tags, dates and
  attachments can be removed or, for texts, rewritten when they fit (also with Prepare for sharing). Nothing
  is moved, the audio and video data is verified unchanged and every change can be undone byte for byte.
• HEIC, HEIF and AVIF: removal of metadata. EXIF, GPS and XMP can be removed in place (also with Prepare
  for sharing); the image items are verified unchanged and the change can be undone byte for byte.
• TIFF, DNG and TIFF-based RAW files: removal of metadata. Camera, owner, software, dates, GPS and the other
  EXIF entries (and XMP properties) can be removed without moving anything in the file: the removed values are
  zeroed, the picture data and the maker note stay valid and unchanged (verified on every save), and the change
  can be undone byte for byte. RAW support is marked experimental. Nothing can be added or edited in these files.
• MP4, MOV and M4A: removal of structure and XMP. Location, device, dates, text atoms and XMP of videos can
  be removed (also with Prepare for sharing). Nothing in the file is moved and the audio/video data is
  verified unchanged; the change can be undone byte for byte.
• XMP data not shown (edit history, document identifiers, derived-from...) is now listed as one field
  (xmp:@hidden) and is removed together with the other personal data by Prepare for sharing.
• Privacy indicators. Every field is classified by what it can reveal when the file is shared (location,
  identity, device, dates, software, thumbnail, free text). The metadata views show a badge on each sensitive
  field and a line summarizing what sharing the file would reveal. The API exposes sensitivity per field and
  sensitivity_summary per file.
• Video and audio structure (MP4, MOV, M4A). Brand, creation and modification dates, track list (type,
  language, size, rotation, codec, frame rate, sample rate, channels), QuickTime keys (including the location
  and device written by phones), text atoms and the XMP packet, all read-only (qt: fields).
• HEIC, HEIF and AVIF images: size, rotation, EXIF, GPS, XMP and ICC profile.
• PNG: XMP is now shown as regular xmp: fields; image header (bit depth, colour type, interlace), last
  modification time and ICC profile.
• TIFF and DNG: embedded XMP, IPTC and ICC profile.
• JPEG: JFIF header, comments, Multi-Picture index and ICC profile (read-only).
• RAW: Olympus ORF and Panasonic RW2/RWL files are read, as well as more TIFF-based RAW extensions.
• OpenDocument (ODT, ODS, ODP, ODG) and EPUB metadata (read-only).
• PDF: version and linearization are shown.
• Audio: MPEG layer/version/channel mode/bitrate mode/encoder, FLAC stream details, encoder vendor of
  Vorbis files; pictures and general objects show their type and description.
• Files without an extension are recognized from their content and handled like their format (a JPEG
  named photo can now be read and edited like a .jpg).

Changed

• Keys: png:XML:com.adobe.xmp is replaced by the xmp: fields it contains; PNG text in several languages
  is png:<keyword>@<language> instead of png:<keyword>#2; files without an extension use their format's
  keys (e.g. exif:*) instead of hachoir:*; MKV and WebM files use mkv:* keys instead of hachoir:*.
• The temporary copy used while saving now has the same name as the file (inside the private temporary folder).
• A tag editor that cannot open a movie shows its structure read-only instead of reporting a read error.
• An Exif 3.0 UTF-8 text tag no longer makes the whole EXIF block non-rewritable.

Full Changelog: v0.4.1...v0.5.0-beta.1

MetaLens v0.4.1

This release contains no change to the application itself: it hardens the build and release pipeline
(the program is the same as 0.4.0).

CI/CD

• test-python-windows now gates the beta (it is in the needs of get-version-beta).
• The stable pipeline runs no tests, so find-latest-beta now also checks that main has the same
  code as the matching beta (only documentation may differ) and stops the release otherwise.
• New smoke test of the packages (scripts/smoke_sidecar.sh, .github/workflows/smoke-packages.yml): the
  .deb, .rpm and .tar.gz are installed on Ubuntu 24.04 and 26.04, Debian 13, Rocky Linux 9 and 10 and
  current Fedora, and the installed sidecar must start, require its token, read sample files of every format
  family and complete a write + undo round trip (the app's shared libraries must also resolve). The packaged
  Windows sidecar is exercised the same way. It gates both the beta and the stable release: nothing is
  published if a package is broken. The stable rebuilds its packages and tests those.

Documentation

• macOS: extended attributes stay read-only (stated in the requirements guide).

Full Changelog: v0.4.0...v0.4.1

MetaLens v0.4.1-beta.3 (beta)

Changed

• Version bumped to 0.4.1 on develop after the 0.4.0 stable release; beta builds of the next
  release are numbered 0.4.1-beta.N.

CI/CD

• test-python-windows now gates the beta (it is in the needs of get-version-beta).
• The stable pipeline runs no tests, so find-latest-beta now also checks that main has the same
  code as the matching beta (only documentation may differ) and stops the release otherwise.
• New smoke test of the packages (scripts/smoke_sidecar.sh, .github/workflows/smoke-packages.yml): the
  .deb, .rpm and .tar.gz are installed on Ubuntu 24.04 and 26.04, Debian 13, Rocky Linux 9 and 10 and
  current Fedora, and the installed sidecar must start, require its token, read sample files of every format
  family and complete a write + undo round trip (the app's shared libraries must also resolve). The packaged
  Windows sidecar is exercised the same way. It gates both the beta and the stable release: nothing is
  published if a package is broken. The stable rebuilds its packages and tests those.

Documentation

• macOS: extended attributes stay read-only (stated in the requirements guide).

Full Changelog: v0.4.1-beta.2...v0.4.1-beta.3

MetaLens v0.4.1-beta.2 (beta)

Changed

• Version bumped to 0.4.1 on develop after the 0.4.0 stable release; beta builds of the next
  release are numbered 0.4.1-beta.N.

CI/CD

• test-python-windows now gates the beta (it is in the needs of get-version-beta).
• The stable pipeline runs no tests, so find-latest-beta now also checks that main has the same
  code as the matching beta (only documentation may differ) and stops the release otherwise.

Documentation

• macOS: extended attributes stay read-only (stated in the requirements guide).

Full Changelog: v0.4.1-beta.1...v0.4.1-beta.2

MetaLens v0.4.1-beta.1 (beta)

Changed

• Version bumped to 0.4.1 on develop after the 0.4.0 stable release; beta builds of the next
  release are numbered 0.4.1-beta.N.

Full Changelog: v0.4.0...v0.4.1-beta.1

MetaLens v0.4.0

Security

• API responses no longer contain the raw text of an exception (which could carry paths or library
  internals): warnings and Undo notices use a short fixed description (describe_error, e.g. "permission
  denied"); the full detail goes to the local log only.
• Deleting GPS (or any EXIF field) from a JPEG that contained a second, duplicated APP1 Exif segment
  left the old copy, GPS coordinates included, in the file. EXIF is now rewritten in place in the first
  Exif segment and duplicates are removed (with a warning), so no byte of the deleted data remains.
• Digitally signed PDFs (/SigFlags, a signed /FT /Sig field, /Perms) were rewritten silently,
  invalidating the signature. They are now read-only, with the reason shown, like encrypted PDFs and
  signed Office packages.

Added

• Folder tree navigation. The Home bookmark now expands the tree along the whole path (drive → … → Home),
  selects the folder and scrolls it into view. Right-clicking a folder opens a menu: Expand / Collapse
  (that folder only), Expand all (every folder of the tree; folders not yet loaded are read down to 3
  levels from the drive root) and Collapse all.
• Update check. Help → Check for Updates… and About → Check for updates look up the latest
  release on GitHub. A stable build is only offered newer stable releases; a beta build is also
  offered newer betas and the stable release of its version, and the dialog says which kind it is.
  The release notes are shown, with Release page, Ignore this version / Stop ignoring
  and, on Windows installed builds, Download & install: the installer is downloaded to a
  temporary folder, verified against the size and SHA-256 digest published by GitHub (a mismatch
  discards it), then started while MetaLens closes. The download can be cancelled. On Linux only
  the release page is offered.
• The check never runs on its own by default: a Check for updates automatically at startup
  option (off by default) is stored in settings.json in the app data folder. When on, a new
  version shows an Update vX.Y.Z button in the toolbar; a failed startup check stays silent.
  All requests are made by the Electron main process, which only talks to the
  overwrite00/MetaLens releases and never accepts URLs from the renderer.
• The About dialog links to the project repository on GitHub, and can be closed with Esc.
• XMP and IPTC for JPEG, read and written: XMP (xmp:<prefix>:<property>, e.g. xmp:dc:title,
  xmp:dc:subject, xmp:photoshop:City; language alternatives and Bag/Seq lists) and IPTC-IIM in the
  Photoshop APP13 segment (iptc:Keywords, iptc:By-line, iptc:Caption-Abstract, ...; repeatable
  datasets as lists, written as UTF-8 with the ESC % G marker). Everything not edited (other XMP
  properties, other 8BIM resources and IIM datasets) is preserved. Extended XMP and legacy IPTC
  character sets are read-only. XMP is also read from WebP.
• IPTC and XMP stay in step: editing or deleting an IPTC dataset also updates its XMP twin already in the file
  (and the other way round) in the same verified transaction, with one Undo; nothing is created on the other
  side and a value the twin cannot store is skipped with a note in warnings.
• Byte-identical Undo: the journal also keeps the original bytes of the region a save changed, so undoing a
  save gives back the very same file (FLAC padding, the MP4 meta atom, XMP/core.xml order included); if the
  region was changed by a later save, the Undo falls back to restoring the values.
• Undo chains: a save that set the modification time no longer makes its Undo fail after later saves (any
  rewrite moves the mtime; only a change by another program is still refused with 409); saving a tag value
  that is already stored leaves MP3/FLAC/WAV/OGG/M4A/WMA files untouched; an I/O error during the byte patch
  falls back to restoring the values instead of leaving a damaged file.
• Safer sync and verification: the IPTC digest is refreshed only when every IPTC/XMP pair in the file agrees;
  read-only fields that are not derived from the file are now checked after a save too; an XMP twin that does not
  fit its segment is skipped with a note instead of failing the save; a byte patch no longer pushes other Undo
  entries out of the journal.
• Safer mirrored deletes: deleting an IPTC dataset no longer removes the XMP twin when it holds other
  language alternatives (e.g. a German title next to the default one): the twin is kept and the response says so.
  Files read by the generic reader (unknown types) now explain why their format metadata is read-only.
  A file that changes while the Undo patch is prepared falls back to the value-level Undo instead of failing.
• Exact Undo on the server: /write and /delete return an undo_token; the new POST /undo
  restores the original bytes of every touched field (pictures, cover art, MakerNote and multi-valued
  fields included) in one verified transaction. It is refused (409) if the file or the fields changed
  meanwhile, and answers 410 for unknown or evicted tokens. The journal is in memory only (50 entries,
  64 MiB) and is lost when the app closes. The file's modification time is not restored implicitly.
• /write accepts an optional delete list, so edits and deletions are one atomic save.
• Adding fields in the editor (Add field) from the server's addable_fields: e.g. EXIF/XMP/IPTC
  fields on a JPEG, ID3 tags on untagged MP3/WAV/AIFF, Vorbis comments on untagged FLAC/Ogg, a title on
  an MP4/MOV without tags, PDF and Office core properties.
• Typed editor: numbers, checkboxes, dropdowns, exact rationals, list editor for multi-valued
  fields, fixed-size pairs (track/disc), date-time with UTC offset; binary fields can only be deleted.
  Notices show why the format is read-only, read errors and warnings.
• Records now expose format_supports_write, format_supports_delete, read_only_reason,
  warnings and addable_fields; fields expose multi, length, binary and always choices.
• New read-only metadata: Office docProps/app.xml (office:app.*) and docProps/custom.xml
  (office:custom.*); OLE DocumentSummaryInformation (company, manager, category, ...) and
  user-defined properties; PNG eXIf and WebP EXIF; GIF comment; pdf:signed.
• The PDF XMP packet is kept in sync with the edited document-info entries (title, author, subject,
  keywords, creator tool, producer, dates); the rest of the packet is preserved.
• Unknown extensions and files without extension are read by hachoir from their content (e.g. a WAV
  renamed .bin or a JPEG without extension).

Changed

• Test-only packages (pytest, python-docx, openpyxl, python-pptx, pywin32) moved to python/requirements-dev.txt;
  python/requirements.txt is the sidecar's runtime set. The sidecar build no longer bundles python-docx, openpyxl
  or python-pptx (it reads Office packages with zipfile/ElementTree; verified by running the sidecar in an
  environment with only the runtime requirements).
• file_busy and file_not_found are ErrorCode constants like the other error codes.
• /write and /delete responses carry undo_unavailable; /diff ignores fs:atime and fs:ctime.
• Version bumped to 0.4.0 (new feature). The fixes below, previously tracked as 0.3.6 betas, ship
  in 0.4.0; there is no 0.3.6 stable release.
• Privacy statements (README, SECURITY, requirements) now say "offline by default" instead of
  "no network calls": the update check is the only network access and is user-initiated or opt-in.
• API error body: every error, authentication included, is now
  {"ok": false, "errors": [{"code", "key", "message"}], "detail": "<summary>"} with stable codes;
  all validation problems of a request are reported together, one per key, before the file is touched.
  A value-related library error is a 422, never a 500.
• A file that cannot be written (read-only attribute, permissions) now returns 403 not_writable
  instead of 409; 409 is reserved for concurrent modification, 410 for expired Undo tokens.
• /hash with no algorithm (algorithms=) returns 400.
• /diff compares the same record as /read, filesystem layer included, and binary values by SHA-256.
• Values are typed and canonical (python/core/values.py): multi-valued tags are JSON lists
  instead of strings joined with ; , numbers are numbers, booleans are booleans, rationals keep their
  exact n/d form, dates are ISO 8601 (datetime with UTC offset, localdatetime for EXIF), binaries
  are {size, sha256, mime} descriptors. img:dpi is a [x, y] number pair (was "72 x 72"),
  fs:win_attrs a list of flags, hachoir values typed (durations in seconds, dates as ISO).
• Changed keys (keys are not stored anywhere, but scripts using the API must adapt): .m4a/.m4b
  tags use mp4:<atom> like MP4/MOV (were tag:<atom>); hachoir fields are
  hachoir:<group index>:<item key> (were derived from the label, and could collide); the MP4 bitrate
  is audio:bitrate of the first audio track (video:bitrate removed); ID3 URL frames are grouped by
  FrameID (tag:WOAR), PRIV frames keyed by owner, never by value.
• The filesystem handler is now a layer added to every record, no longer a primary handler: /list
  reports hachoir for files with no dedicated handler.
• Only fs:mtime is writable at the filesystem level (now with UTC offset required, exact to the
  microsecond and verified); extended attributes are writable only in the Linux user. namespace with
  UTF-8 values (non-UTF-8 values are binary, other namespaces and macOS read-only).
• Every save runs in one transaction: validation, changes on a private copy, read-back verification
  (a library that drops or alters anything makes the save fail with 422 and leaves the file intact),
  then replace. The file was previously copied twice for API writes.
  -...

MetaLens v0.4.0-beta.9 (beta)

Security

• Deleting GPS (or any EXIF field) from a JPEG that contained a second, duplicated APP1 Exif segment
  left the old copy, GPS coordinates included, in the file. EXIF is now rewritten in place in the first
  Exif segment and duplicates are removed (with a warning), so no byte of the deleted data remains.
• Digitally signed PDFs (/SigFlags, a signed /FT /Sig field, /Perms) were rewritten silently,
  invalidating the signature. They are now read-only, with the reason shown, like encrypted PDFs and
  signed Office packages.

Added

• Folder tree navigation. The Home bookmark now expands the tree along the whole path (drive → … → Home),
  selects the folder and scrolls it into view. Right-clicking a folder opens a menu: Expand / Collapse
  (that folder only), Expand all (every folder of the tree; folders not yet loaded are read down to 3
  levels from the drive root) and Collapse all.
• Update check. Help → Check for Updates… and About → Check for updates look up the latest
  release on GitHub. A stable build is only offered newer stable releases; a beta build is also
  offered newer betas and the stable release of its version, and the dialog says which kind it is.
  The release notes are shown, with Release page, Ignore this version / Stop ignoring
  and, on Windows installed builds, Download & install: the installer is downloaded to a
  temporary folder, verified against the size and SHA-256 digest published by GitHub (a mismatch
  discards it), then started while MetaLens closes. The download can be cancelled. On Linux only
  the release page is offered.
• The check never runs on its own by default: a Check for updates automatically at startup
  option (off by default) is stored in settings.json in the app data folder. When on, a new
  version shows an Update vX.Y.Z button in the toolbar; a failed startup check stays silent.
  All requests are made by the Electron main process, which only talks to the
  overwrite00/MetaLens releases and never accepts URLs from the renderer.
• The About dialog links to the project repository on GitHub, and can be closed with Esc.
• XMP and IPTC for JPEG, read and written: XMP (xmp:<prefix>:<property>, e.g. xmp:dc:title,
  xmp:dc:subject, xmp:photoshop:City; language alternatives and Bag/Seq lists) and IPTC-IIM in the
  Photoshop APP13 segment (iptc:Keywords, iptc:By-line, iptc:Caption-Abstract, ...; repeatable
  datasets as lists, written as UTF-8 with the ESC % G marker). Everything not edited (other XMP
  properties, other 8BIM resources and IIM datasets) is preserved. Extended XMP and legacy IPTC
  character sets are read-only. XMP is also read from WebP.
• IPTC and XMP stay in step: editing or deleting an IPTC dataset also updates its XMP twin already in the file
  (and the other way round) in the same verified transaction, with one Undo; nothing is created on the other
  side and a value the twin cannot store is skipped with a note in warnings.
• Byte-identical Undo: the journal also keeps the original bytes of the region a save changed, so undoing a
  save gives back the very same file (FLAC padding, the MP4 meta atom, XMP/core.xml order included); if the
  region was changed by a later save, the Undo falls back to restoring the values.
• Undo chains: a save that set the modification time no longer makes its Undo fail after later saves (any
  rewrite moves the mtime; only a change by another program is still refused with 409); saving a tag value
  that is already stored leaves MP3/FLAC/WAV/OGG/M4A/WMA files untouched; an I/O error during the byte patch
  falls back to restoring the values instead of leaving a damaged file.
• Safer sync and verification: the IPTC digest is refreshed only when every IPTC/XMP pair in the file agrees;
  read-only fields that are not derived from the file are now checked after a save too; an XMP twin that does not
  fit its segment is skipped with a note instead of failing the save; a byte patch no longer pushes other Undo
  entries out of the journal.
• Safer mirrored deletes: deleting an IPTC dataset no longer removes the XMP twin when it holds other
  language alternatives (e.g. a German title next to the default one): the twin is kept and the response says so.
  Files read by the generic reader (unknown types) now explain why their format metadata is read-only.
  A file that changes while the Undo patch is prepared falls back to the value-level Undo instead of failing.
• Exact Undo on the server: /write and /delete return an undo_token; the new POST /undo
  restores the original bytes of every touched field (pictures, cover art, MakerNote and multi-valued
  fields included) in one verified transaction. It is refused (409) if the file or the fields changed
  meanwhile, and answers 410 for unknown or evicted tokens. The journal is in memory only (50 entries,
  64 MiB) and is lost when the app closes. The file's modification time is not restored implicitly.
• /write accepts an optional delete list, so edits and deletions are one atomic save.
• Adding fields in the editor (Add field) from the server's addable_fields: e.g. EXIF/XMP/IPTC
  fields on a JPEG, ID3 tags on untagged MP3/WAV/AIFF, Vorbis comments on untagged FLAC/Ogg, a title on
  an MP4/MOV without tags, PDF and Office core properties.
• Typed editor: numbers, checkboxes, dropdowns, exact rationals, list editor for multi-valued
  fields, fixed-size pairs (track/disc), date-time with UTC offset; binary fields can only be deleted.
  Notices show why the format is read-only, read errors and warnings.
• Records now expose format_supports_write, format_supports_delete, read_only_reason,
  warnings and addable_fields; fields expose multi, length, binary and always choices.
• New read-only metadata: Office docProps/app.xml (office:app.*) and docProps/custom.xml
  (office:custom.*); OLE DocumentSummaryInformation (company, manager, category, ...) and
  user-defined properties; PNG eXIf and WebP EXIF; GIF comment; pdf:signed.
• The PDF XMP packet is kept in sync with the edited document-info entries (title, author, subject,
  keywords, creator tool, producer, dates); the rest of the packet is preserved.
• Unknown extensions and files without extension are read by hachoir from their content (e.g. a WAV
  renamed .bin or a JPEG without extension).

Changed

• Test-only packages (pytest, python-docx, openpyxl, python-pptx, pywin32) moved to python/requirements-dev.txt;
  python/requirements.txt is the sidecar's runtime set. The sidecar build no longer bundles python-docx, openpyxl
  or python-pptx (it reads Office packages with zipfile/ElementTree; verified by running the sidecar in an
  environment with only the runtime requirements).
• file_busy and file_not_found are ErrorCode constants like the other error codes.
• /write and /delete responses carry undo_unavailable; /diff ignores fs:atime and fs:ctime.
• Version bumped to 0.4.0 (new feature). The fixes below, previously tracked as 0.3.6 betas, ship
  in 0.4.0; there is no 0.3.6 stable release.
• Privacy statements (README, SECURITY, requirements) now say "offline by default" instead of
  "no network calls": the update check is the only network access and is user-initiated or opt-in.
• API error body: every error, authentication included, is now
  {"ok": false, "errors": [{"code", "key", "message"}], "detail": "<summary>"} with stable codes;
  all validation problems of a request are reported together, one per key, before the file is touched.
  A value-related library error is a 422, never a 500.
• A file that cannot be written (read-only attribute, permissions) now returns 403 not_writable
  instead of 409; 409 is reserved for concurrent modification, 410 for expired Undo tokens.
• /hash with no algorithm (algorithms=) returns 400.
• /diff compares the same record as /read, filesystem layer included, and binary values by SHA-256.
• Values are typed and canonical (python/core/values.py): multi-valued tags are JSON lists
  instead of strings joined with ; , numbers are numbers, booleans are booleans, rationals keep their
  exact n/d form, dates are ISO 8601 (datetime with UTC offset, localdatetime for EXIF), binaries
  are {size, sha256, mime} descriptors. img:dpi is a [x, y] number pair (was "72 x 72"),
  fs:win_attrs a list of flags, hachoir values typed (durations in seconds, dates as ISO).
• Changed keys (keys are not stored anywhere, but scripts using the API must adapt): .m4a/.m4b
  tags use mp4:<atom> like MP4/MOV (were tag:<atom>); hachoir fields are
  hachoir:<group index>:<item key> (were derived from the label, and could collide); the MP4 bitrate
  is audio:bitrate of the first audio track (video:bitrate removed); ID3 URL frames are grouped by
  FrameID (tag:WOAR), PRIV frames keyed by owner, never by value.
• The filesystem handler is now a layer added to every record, no longer a primary handler: /list
  reports hachoir for files with no dedicated handler.
• Only fs:mtime is writable at the filesystem level (now with UTC offset required, exact to the
  microsecond and verified); extended attributes are writable only in the Linux user. namespace with
  UTF-8 values (non-UTF-8 values are binary, other namespaces and macOS read-only).
• Every save runs in one transaction: validation, changes on a private copy, read-back verification
  (a library that drops or alters anything makes the save fail with 422 and leaves the file intact),
  then replace. The file was previously copied twice for API writes.
• Office dates without UTC offset are refused (422) instead of being treated as UTC.

Fixed

• A save that changes nothing no longer replaces the file. Writing the values a file already has used to swap in
  an identical copy, which detached hard links an...