chore: release

[caiopensrc]

🤖 New release

• c2pa: 0.84.1 -> 0.85.0 (⚠ API breaking changes)
• c2pa-c-ffi: 0.84.1 -> 0.85.0
• c2patool: 0.26.59 -> 0.26.60

⚠ c2pa breaking changes

--- failure auto_trait_impl_removed: auto trait no longer implemented ---

Description:
A public type has stopped implementing one or more auto traits. This can break downstream code that depends on the traits being implemented.
        ref: https://doc.rust-lang.org/reference/special-types-and-traits.html#auto-traits
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.46.0/src/lints/auto_trait_impl_removed.ron

Failed in:
  type Manifest is no longer UnwindSafe, in /tmp/.tmpnAW1Re/c2pa-rs/sdk/src/manifest.rs:59
  type Manifest is no longer RefUnwindSafe, in /tmp/.tmpnAW1Re/c2pa-rs/sdk/src/manifest.rs:59
  type Ingredient is no longer UnwindSafe, in /tmp/.tmpnAW1Re/c2pa-rs/sdk/src/ingredient.rs:58
  type Ingredient is no longer RefUnwindSafe, in /tmp/.tmpnAW1Re/c2pa-rs/sdk/src/ingredient.rs:58
  type ManifestDefinition is no longer UnwindSafe, in /tmp/.tmpnAW1Re/c2pa-rs/sdk/src/builder.rs:106
  type ManifestDefinition is no longer RefUnwindSafe, in /tmp/.tmpnAW1Re/c2pa-rs/sdk/src/builder.rs:106

Changelog

c2pa

0.85.0

21 May 2026

Added

• Support CAWG callback signing via c_ffi (#2118)

Fixed

• Use XMP instance_id from source asset in sign and save_to_stream (#2158)
• Harden against Builder::base_path injection attack on archive deserialisation (#2139)
• Harden against integer overflow attacks in hash_stream_by_alg_with_progress range validation (#2140)

Other

• Avoid buffering stream when computing placeholder PNG C2PA chunk (#2154)
• Avoid buffering stream when computing placeholder JPEG C2PA chunk (#2155)
• Fix lints in newer Rust versions. (#2153)
• Optimize signing passes/copies for large PNGs (#1967)
• Optimize signing passes/copies for large RIFFs (#1970)
• Optimize signing passes/copies for large JPEGs (#1971)
• Lazy-load ingredient manifest stores from shared Arc (#2103)
• Consolidate embeddable async functions (#2149)
• Consolidate async verify functions (#2146)

c2pa-c-ffi

0.85.0

21 May 2026

Added

• Support CAWG callback signing via c_ffi (#2118)

c2patool

0.26.60

21 May 2026

Added

• Support CAWG callback signing via c_ffi (#2118)

---

This PR was generated with release-plz.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.33%. Comparing base (d466080) to head (5a0fbc0).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2145   +/-   ##
=======================================
  Coverage   78.33%   78.33%           
=======================================
  Files         176      176           
  Lines       45692    45692           
=======================================
  Hits        35795    35795           
  Misses       9897     9897           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[codspeed-hq]

Merging this PR will not alter performance

✅ 30 untouched benchmarks
⏩ 64 skipped benchmarks¹

---

_{Comparing release-plz-2026-05-13T18-48-29Z (5a0fbc0) with main (82ea133)²}

Footnotes

1. 64 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on main (d466080) during the generation of this report, so 82ea133 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩