Lyrics Card Generator v6.2.2

Status: released.

Windows distribution is now Setup-only

Starting with v6.2.2, the only Windows download is the x64 installer Lyrics.Card.Generator.Setup.6.2.2.exe; standalone builds are no longer built or published.
v6.2.1 and older builds still open the latest GitHub Release through the in-app update check, so users of an older standalone build can download Setup there.
The Release has exactly three assets—Setup, the SPDX SBOM, and SHA256SUMS—and the workflow produces provenance for each one.

Non-loopback AI service URLs now require HTTPS, while loopback HTTP remains available for local models. Application mutation origin checks bind to a trusted external host. (#143, #145)
Request bodies, upstream responses, AI JSON/SSE streams, remote metadata, and cancellation propagation now have explicit size, deadline, and abort budgets. (#146)
AI settings use atomic persistence to avoid crash- or power-loss truncation, and concurrent locale/preference saves preserve the latest user settings. (#147, #148)
Electron clipboard images are checked against decoded pixel-area and byte budgets before native image allocation. (#149)

A release must descend from reviewed main, and its exact commit must pass every required CI check; authorization is repeated before mutation and publication. (#144)
The stale Sharp exception for Next 15.5.24 is removed, and the packaged Electron runtime is covered by a dedicated dependency audit and the SPDX SBOM. (#150, #151)
Release lookup traverses all pages and fails closed on conflicting state, preventing incorrect reuse once the repository exceeds 100 Releases. (#152)

Windows packaged interaction tests now install observers before controlled-input updates and wait for history relocation actions to become ready, while retaining their strict assertions.
Type checking, lint, stability and core suites, Web Lite, dependency and SBOM policies, packaged regressions, and the Setup install/launch/close/uninstall smoke are release gates.