- **Behavior change** An unknown property of a table cell (anything but `text`, `styleRef`, `style`, `format`, for example the typo `stylRef`) is now error `NRP013` in `ParserValidationMode.Strict` (the template is not rendered) and a warning in `Compat`, like an unknown property of a node or a style. Before, it was only a warning in both modes. The message carries the hint "Myslíte 'styleRef'?", so `apply_quick_fixes` repairs the typo; use `ValidationMode = Compat` to render older templates until they are fixed. - Custom fonts (`meta.fonts`) are first tried in a separate process (`NetReporter.Resources.FontSandbox`, ToDo #164): the same program started with `--nr-font-probe` loads the font, registers it and draws a line of text into a PDF; the host registers it only after that succeeds, so a crash or hang of the native readers (Skia, FreeType, HarfBuzz) takes down only the helper process and the font is refused (`NRP045`). The helper gets a clean environment without the host's secrets, a heap cap and a time limit (20 s, at most 2 at a time) and takes about 0.3 s and tens of MB. A host enables it with `if (FontSandbox.IsProbeInvocation(args)) Environment.Exit(FontSandbox.RunProbe(args));` at the very start of `Main` and `FontSandbox.EnableForHost(typeof(Program).Assembly)` at startup; ReportServer (`Security:Fonts:Isolation`, `SECURITY_FONTS_ISOLATION`), the MCP server over HTTP (`MCP_FONT_ISOLATION`) and the editor (`EDITOR_FONT_ISOLATION`) do so by default (set the setting to `false` to switch it off). The verdict is remembered with the family registration in `FontRegistry`; an environment failure (the helper cannot start, queue full) is not remembered. Uploading a font asset (and importing a bundle) goes through the same check: a refused font is `415`, an unavailable check `503 CONTENT_VERIFICATION_UNAVAILABLE`. It is not an operating system boundary (the helper has the host's rights): use a non-root user and `readOnlyRootFilesystem` in the deployment for more. - C# expressions `{{# … }}` (ToDo #146): `ITemplateTools.ValidateTemplateAsync` (so `validate_template`, `/template-tools/validate` and the client) and the editor report the info `NRP046` with the number of different C# expressions of a template and what they cost (every different expression is compiled once per process and stays in memory, the first one pays for starting Roslyn, ~60 MB and ~1 s); `TemplateDataContract.CSharpExpressions` lists them. `RenderCompletedContext.CompiledCSharpExpressions` and `NewCSharpExpressions` and `ReportRenderer.CompiledCSharpExpressionCount` expose how many the process compiled, and the renderer logs the first use of Roslyn in a process. The agent instructions of the MCP server (instructions, prompt `design_report_template`) tell to prefer bindings without `#`. - ReportServer and MCP cap the number of different C# expressions lower than the library (500 instead of 2000): `Security:RequestLimits:MaxCSharpExpressions` (`SECURITY_REQUESTLIMITS_MAX_CSHARP_EXPRESSIONS`) and `NetReporterMcp:MaxCSharpExpressions` (`MCP_MAX_CSHARP_EXPRESSIONS`, HTTP only; stdio keeps 2000); `new TemplateTools(maxCSharpExpressions: …)` applies the same cap to data validation. `GET /metrics/runtime` (Admin) returns the number of compiled expressions, the cap and the process memory (`workingSetBytes`, `privateBytes`, `gcHeapBytes`) of one pod. - Security: a bitmap (PNG, JPEG, GIF, WebP, BMP) with too many pixels is no longer decoded. A small file can declare huge dimensions and the decoder unpacks it in memory at 4 bytes per pixel (a 100 Mpx PNG is a few kilobytes). The new public `NetReporter.Resources.ImageFileCheck` reads the dimensions from the file header without decoding (PNG `IHDR`, JPEG `SOF` after any segments, GIF, WebP `VP8`/`VP8L`/`VP8X`, both BMP header forms) and `ResourceLimits.MaxImagePixels` (default 50 Mpx) is applied to images from files, URLs, data URIs and the resolver (`asset:{id}`, reported as `NRP044`); an image over the limit or with an unreadable header is replaced by the placeholder, SVG and other formats are not checked. Configuration: `Security:Resources:MaxImagePixels` (`SECURITY_RESOURCES_MAX_IMAGE_PIXELS`), `MCP_RESOURCES_MAX_IMAGE_PIXELS`; a non-positive value fails the host start. `AssetReference.Replace` rewrites `asset:{id}` references with a mapping. - ReportServer: uploading or replacing an image, importing a bundle and moving data URIs into assets check the bitmap dimensions (`ReportServer:Content:Assets:MaxImagePixels`, default 50 Mpx): too many pixels is `413 CONTENT_TOO_LARGE`, an unreadable header `415`. - ReportServer: `POST /content/{kind}/{id}/copy` copies the foreign assets the item refers to (not the system ones) to the caller and rewrites the references in the copy. Before, the copy read the author's assets only because a public item used them, so it lost its images when the author hid the item or deleted the asset. The new asset is a record over the same blob (no data is duplicated); content the caller already owns is reused. - ReportServer: `GET /content/templates` returns a `summary` of every template (`title`, `description`, `pageSize`, `isLandscape`, `isValidJson`), computed on every save of the template content (one place in `ReportServerDbContext.SaveChanges`) and filled for older rows at API start. The template editor gallery uses it and no longer loads every template to draw its cards (one query for the whole gallery); against an older server it reads the templates as before. - ReportServer: local disk cache of content in the API pod (`ReportServer:Content:Cache:Path`, off by default) to reduce the data read from Postgres. It holds the small asset blobs stored in the database and the texts of template versions and working copies under the SHA-256 of the content, so it never needs invalidation; validity is checked by a light query without the content column and the content is read from the database only on a miss. Access is still checked in the database before every read. Writes are atomic, the least recently used files are evicted over `MaxBytes` (default 256 MiB), a disk error is only a cache miss. k3s mounts an `emptyDir` (`sizeLimit` 512Mi), the Docker Compose sample a volume `api-cache`. `GET /admin/content/cache-stats` (Admin) reports hits, misses, served bytes and bytes read from the database, also while the cache is off. - **Behavior change** ReportServer: removed the code of the old storages the shared content store replaced (ToDo #163). `POST /admin/content/drop-legacy` and `POST /admin/content/import-editor` are gone (`import-folder` stays; `alreadyImported` in the import response is always 0), as are `ContentApiClient.DropLegacyAsync`, the old template entities and importer, `IReportServerStorage.DeleteLegacyTemplateCopiesAsync` and the setting `EDITOR_CONNECTION_STRING` (API secret, k3s secret map, Compose). The migration `DropLegacyTemplateTables` drops the schema `legacy` with `DROP SCHEMA IF EXISTS legacy CASCADE`; if the old tables still hold templates that were not taken over into the shared store (no flag `LegacyTemplatesImportedUtc`, the update skipped 3.0) the migration fails and deletes nothing: deploy 3.0.x first and let the API start. Make a `pg_dump` before the update, the drop is irreversible. The content of an old editor database (schema `editor`) must be imported with 3.x or exported to a folder and uploaded with `import-folder`. Celý seznam změn: CHANGELOG.md v balíčku a https://dev.azure.com/advsoft/Knihovny/_git/NetReporter?path=/src/NetReporter/CHANGELOG.md