Every shared lock was std::sync::Mutex with lock().unwrap() (~150 sites),
so a panic in any session's reader or callback poisoned the lock and the
next UI frame panicked too, dropping every open session. Locks are now
parking_lot::Mutex (no poisoning; already in the dependency tree), and a
panic hook reports worker panics as an error toast instead of the session
silently stopping (F3, F4).
- The VNC client refuses desktop sizes over 64 Mpx (ServerInit and
DesktopSize/ExtendedDesktopSize) and ZRLE rectangles over 64 MiB before
allocating, so a hostile server can't force a multi-gigabyte allocation.
- Release URLs from the update manifest and repository URLs from the GitHub
API are handed to the system opener only when they are http(s) links.
Andy Dixon