← All news

Duck Studio 2.1.2: source code and downloads are now public

Duck Studio’s source code and release downloads are public on GitHub. Version 2.1.2 hardens project imports, image decoding, installation and updates, so update before opening projects from other people.

Duck Studio, our Windows workspace for GTA V clothing and tattoo packs, is now open source under the MIT license. The source code and every release are on GitHub: https://github.com/Rubber-Ducks-Development/duck-studios

Version 2.1.2 is a security release. Please update before opening projects you got from other people.

  • Imported projects can no longer choose executable decoder DLLs.
  • Installer and uninstaller paths are protected against traversal and linked files.
  • Photo decoding is restricted, external delegates are blocked and image resources are bounded.
  • Update downloads stay on HTTPS through redirects, and signed local manifests are bounded.
  • The renderer’s archive decompression is patched with ruzstd 0.9.1 (RUSTSEC-2026-0344).
  • Both bundled .NET runtimes are updated to 10.0.13.
  • New installations and portable copies use the public signed GitHub update feed.
  • The repository now has a security policy, private vulnerability reporting, secret scanning, dependency checks and CodeQL.

Download DuckStudioSetup.exe to install, or extract DuckStudio-Windows-2.1.2.zip for a portable copy. SHA256SUMS.txt lists the checksum of every download.

Using an older copy? Set Help > Update settings to https://github.com/Rubber-Ducks-Development/duck-studios/releases/latest/download/latest.json, or install 2.1.2 manually. Duck Studio always asks before installing an update and checks its signature, size and SHA256 first.

Version 2.1.1, released earlier the same day, is superseded by 2.1.2.

Full release notes: https://github.com/Rubber-Ducks-Development/duck-studios/releases/tag/v2.1.2