# Address code review: harden the vendored cursor plugin · dara/icarus

[View on GitCafe](https://git.cafe/dara/icarus/commit/436d75a0091211d039b80fcab8bf5cdff6141689)

Repository: [dara/icarus](https://git.cafe/dara/icarus)

Visibility: public

Requested revision: 436d75a0091211d039b80fcab8bf5cdff6141689

Requested commit: 436d75a0091211d039b80fcab8bf5cdff6141689

Commit: 436d75a0091211d039b80fcab8bf5cdff6141689

Tree: 2ec12884d1ba1119b3cd81ed8a2b594fbc673e42

Author: Dara Adedeji

Committer: Dara Adedeji

## Message

```
Address code review: harden the vendored cursor plugin

- Validate scale/devicePixelRatio at the public image() API, in
  registerCursor(), and defensively in the Swift handler (Greptile P1).
- exactAsset() forwards the package argument; asset loads use the
  caller-supplied bundle (creation) and the resolved key's bundle (DPR
  updates) instead of always rootBundle.
- Await platform delete/register in the DPR-update and cache-switch
  paths so registrations cannot interleave; registerCursor() throws a
  descriptive StateError when the native side returns null.
- Drop the Linux platform from the vendored copy: Icarus ships Windows
  and macOS only, and the upstream Linux implementation had unvalidated
  channel arguments, pixbuf leaks, and a missing not-implemented branch.
- Raise the vendored SDK bounds, document the patches in the changelog,
  rewrite the README (stale upstream prose had broken links and typos),
  make the creation-type enum public, and remove the upstream test stub.

```

## Parents

- [604d70e7efc962005adabc99f3975e4aadee1e2a](https://git.cafe/dara/icarus/commit/604d70e7efc962005adabc99f3975e4aadee1e2a?format=markdown)

[Source at this commit](https://git.cafe/dara/icarus/tree/436d75a0091211d039b80fcab8bf5cdff6141689?format=markdown)