Source and unmodified dual MIT/Apache-2.0 licenses come from the published image-webp0.2.4 crate. Published VCS metadata names revision 08b57d473c90148dd4b37a075df365afc3dfcc2b. upstream.json records original file hashes, before the local patch. The published manifest and production dependencies remain unchanged. Two upstream YUV test array lines have trailing whitespace removed for the source hooks; behavior is unchanged.
The container decoder now supplies its expected static canvas or ANMF frame width/height to the original VP8 decoder. It compares the intrinsic keyframe header before allocating macroblocks or Y/U/V planes. Previously a small VP8X canvas could contain a much larger VP8 header, allocating hundreds of MiB before InconsistentImageSizes. This is a codec boundary correction, not an alternate WebP parser or Maka renderer workaround. Lossless decoding already checks the expected dimensions before transforms/output allocation. Three lossy paths (static, animated opaque, animated alpha) use the same early check.
The raw VP8 API without a container retains its intrinsic-dimension behavior; container callers use the supplied-dimension path. Native image admission still limits encoded bytes, outer dimensions/pixels, aggregate allocations and actual concurrent jobs. The image crate's max_alloc is not claimed as an allocator sandbox.