Skip to content

fix(deps): update dependencies - #46

Open
tannevaled wants to merge 1 commit into
mainfrom
renovate/deps
Open

fix(deps): update dependencies#46
tannevaled wants to merge 1 commit into
mainfrom
renovate/deps

Conversation

@tannevaled

@tannevaled tannevaled commented Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/go-gfx/gfx v0.37.0 → v0.41.0 age confidence
github.com/go-pdfkit/conformance v0.0.0-20261026002156-aa06f483a744 → v0.3.2 age confidence
github.com/go-pdfkit/extract v0.9.0 → v0.11.0 age confidence
github.com/go-pdfkit/html2pdf v0.3.0 → v0.4.1 age confidence
github.com/go-pdfkit/pdfkit v0.20.0 → v0.24.0 age confidence
github.com/go-pdfkit/reader v0.9.0 → v0.11.0 age confidence
github.com/go-webengine/engine v0.18.1 → v0.47.2 age confidence

Release Notes

go-gfx/gfx (github.com/go-gfx/gfx)

v0.41.0

Compare Source

What's Changed

Full Changelog: go-gfx/gfx@v0.40.0...v0.41.0

v0.40.0

Compare Source

One path-data parser, shared by three formats

vector.ParseData reads the syntax of SVG's d attribute and returns the outline, with a geometry.Matrix applied on the way. It was svg's private parser until now.

It moved because three formats write the same syntax. SVG 1.1 §8.3 defines it; ODF's draw:path carries it verbatim in svg:d; and ECMA-388 Annex C gives OpenXPS's abbreviated geometry syntax as an algorithm which, read against it, is a strict subset with a prefix:

SVG d ODF draw:path OpenXPS
commands M L H V C S Q T A Z the same (svg:d) the same, minus T
arc operands rx ry rot large sweep x y the same the same order
sweep sense positive-angle the same FLAG2 == 1 ? Clockwise — the same
fill rule on the shape on the shape an F0/F1 prefix on the data

Left where it was, the arc maths and the smooth-curve reflection would have been transcribed a second and a third time by whoever read those formats next. The F0/F1 prefix is deliberately not handled: a fill rule belongs to the shape, not to the outline, so an XPS reader strips it and chooses EvenOdd or NonZero itself.

⛔ The suite passing was not evidence the move was safe

[a b c d e f] — the form SVG's matrix(), XPS's RenderTransform, ODF's draw:transform and PDF's cm all write — is not a row-major 2×3 matrix. Read as one, b and c swap, which leaves every unrotated drawing correct and every rotated one mirrored.

Planting exactly that swap left the whole of svg's test suite green, because every drawing in it is axis-aligned and b == c == 0 there.

So the move was proved against a control rather than against the suite: the parser as it stood before it, over 20 030 inputs (every command letter in both cases, the compact number forms, the arc flags run into the next coordinate, the malformed data that must be refused, and 20 000 generated paths) × 6 matrices including a rotation, a shear and a mirror, compared with math.Float64bits — exact, because the move was meant to reorder no arithmetic:

  agreed exactly : 115518      points differ : 0
  both refused   :   4662      verdict differ: 0

The same probe reports 57 518 differing with the mutant in place, which is the only reason that zero means anything. TestAShearedTransformTellsBFromC now keeps the witness in the repository, with b = 0.25 and c = 0.75.

ParseData takes a geometry.Matrix rather than a flat six-tuple, so the transposition is not expressible: its entries are named Xx, Yx, X0 / Xy, Yy, Y0, and b and c are not adjacent.

Also
  • vector now imports geometry, which the documentation had described as the design for some time while the code did not do it.
  • The docs site named geometry.Affine and Concat — neither exists. Corrected to Matrix / Mul (go-gfx/docs#18).
  • 0 uncovered blocks of 2090 across the module.

Compatibility: ParseData is an addition; no existing API changed. (Path.Each and Path.Len, which a consumer of this parser usually wants next, shipped in v0.39.0 — checked against the tag rather than remembered.)

v0.39.0

Compare Source

What's Changed

Full Changelog: go-gfx/gfx@v0.38.0...v0.39.0

v0.38.0

Compare Source

What's Changed

Full Changelog: go-gfx/gfx@v0.37.0...v0.38.0

go-pdfkit/extract (github.com/go-pdfkit/extract)

v0.11.0

Compare Source

What's Changed

Full Changelog: go-pdfkit/extract@v0.10.0...v0.11.0

v0.10.0

Compare Source

What's Changed

Full Changelog: go-pdfkit/extract@v0.9.0...v0.10.0

go-pdfkit/html2pdf (github.com/go-pdfkit/html2pdf)

v0.4.1

Compare Source

What's Changed

Full Changelog: v0.4.0...v0.4.1

v0.4.0

Compare Source

html2pdf v0.4.0

  • Options.Fetch (a Fetcher, the engine's Engine.Fetcher hook) replaces the network client for every http(s) sub-resource.
  • html2pdf.Offline refuses every request: a stylesheet or image that is not a data: URL is treated as missing, the export carries on.
  • Options.OnRefused(url) is called for each refusal, so a caller can count them; ErrOffline is the sentinel.
  • file: URLs are never read, whatever BaseURL is.
  • CLI: --offline (with --in).

A backwards-compatible feature: the default behaviour is unchanged (PR #​47).

go-pdfkit/pdfkit (github.com/go-pdfkit/pdfkit)

v0.24.0

Compare Source

What's Changed

Full Changelog: go-pdfkit/pdfkit@v0.23.0...v0.24.0

v0.23.0

Compare Source

What's Changed

Full Changelog: go-pdfkit/pdfkit@v0.22.0...v0.23.0

v0.22.0

Compare Source

What's Changed

Full Changelog: go-pdfkit/pdfkit@v0.21.0...v0.22.0

v0.21.0

Compare Source

What's Changed

Full Changelog: go-pdfkit/pdfkit@v0.20.0...v0.21.0

go-pdfkit/reader (github.com/go-pdfkit/reader)

v0.11.0

Compare Source

CheckLinearized: asking whether a file is what its front says

Linearized(b) has been here since v0.10.0 and answers the cheap question a reader asks before streaming: are the parameters at the front well formed? Of Table F.1's claims it checked exactly one against the file — /L against the byte count — because that is all a reader can afford, having fetched 1024 bytes and resolved nothing.

That makes it a weaker test than it looks, and a writer developed against it would pass without linearizing anything: /O, /E, /N and /T were read for type and never consulted, so a file with a correct /L and four invented integers was accepted. That is precisely what a first linearizer emits.

CheckLinearized(b) is the other question, for the other caller: not "may a reader trust the front of this file" but "is this file actually what the front says". It opens the document, so it costs what opening costs, and it is the judgement a writer needs on bytes it has just produced. Every parameter must point at what it claims to:

checked against
/N the document's real page count
/O the real first page, and that a reader will treat it as page one
/H a real stream object, its extent matching exactly
/T the main cross-reference section — either of the two meanings Table F.1 gives it
/E the end of the last object the first-page cross-reference section lists
/E, and why a second producer was needed

/E is the parameter a writer is most likely to get wrong, so leaving it ungated was the hole that let a writer be its own judge. It is now checked against the first-page cross-reference section — the one Annex F puts at the front and startxref points at, whose entries are the first page's objects.

The subtlety is that F.3.1 permits the primary hint stream on either side of the first page. qpdf writes it before (/H 550, /E 902); Ghostscript -dFastWebView writes it after, at /E exactly (/H 829, /E 829). A rule that simply took the highest-offset entry would therefore refuse every Ghostscript file. Both qpdf fixtures place it before and cannot tell the two rules apart, which is why a Ghostscript-produced file is committed beside them.

Values a 32-bit build cannot address are refused, not truncated

int(Integer) discards the high half where int is 32 bits, so a /H length of 2³²+127 read as 127 — the committed fixture's own hint length, a plausible value every later check then accepted. The same bytes were judged sound on one machine and refused on another, with nothing to say which. Every integer the dictionary offers now goes through one conversion that refuses what it cannot represent, /P included. The new error is ErrLinearizationMalformed.

Known limits, stated rather than implied
  • /E is checked against the first-page cross-reference section, which is not the same as checking the section is right. A writer that omits objects page one genuinely needs produces an internally consistent file that passes. Ghostscript does this on a document with shared fonts, outlines and links: /H = /E = 1941 is accepted here, while qpdf --check computes 5500..5501 and reports page one as 9 objects where the hint table claims 4. Deciding what page one needs means walking its resources — the partition the hint tables describe — and that judgement is still outstanding.
  • The hint tables' contents are not decoded or compared with the file; only /H's extent is checked.
  • /P is range-checked but nothing cross-checks its value.
One deliberate disagreement with qpdf

qpdf computes /E as a range (901..902 on the committed fixture), accepting the end with or without the line ending after endobj. This requires the end including it, which is what both measured producers write. A file carrying the lower value would pass qpdf --check and be refused here; none has been observed, and the alternative is a window that cannot tell a correct /E from one a byte short — the same argument that made the /H length an exact comparison.

Across the rest, there are 0 disagreements with qpdf over 42 generated files: 1, 2, 3, 5, 25 and 100 pages × plain, object streams, uncompressed streams, 256-bit encryption and --newline-before-endstream.

All limits are tracked in #​40.

v0.10.0

Compare Source

What's Changed

Full Changelog: go-pdfkit/reader@v0.9.0...v0.10.0

go-webengine/engine (github.com/go-webengine/engine)

v0.47.2

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.47.1...v0.47.2

v0.47.1

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.47.0...v0.47.1

v0.47.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.46.2...v0.47.0

v0.46.2

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.46.1...v0.46.2

v0.46.1

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.46.0...v0.46.1

v0.46.0

Compare Source

What's Changed
  • feat(officecanvas,paint): say which SVG document and element each recorded shape came from by @​tannevaled in #​414

Full Changelog: go-webengine/engine@v0.45.13...v0.46.0

v0.45.13

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.12...v0.45.13

v0.45.12

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.11...v0.45.12

v0.45.11

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.10...v0.45.11

v0.45.10

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.9...v0.45.10

v0.45.9

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.8...v0.45.9

v0.45.8

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.7...v0.45.8

v0.45.7

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.6...v0.45.7

v0.45.6

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.5...v0.45.6

v0.45.5

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.4...v0.45.5

v0.45.4

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.3...v0.45.4

v0.45.3

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.45.2...v0.45.3

v0.45.2

Compare Source

What's Changed
  • fix(js): Worker.postMessage is genuinely asynchronous now, not a blocking round trip by @​tannevaled in #​389

Full Changelog: go-webengine/engine@v0.45.1...v0.45.2

v0.45.1

Compare Source

What's Changed
  • fix(js): a self-requeuing short-delay timer could starve an older job forever by @​tannevaled in #​386

Full Changelog: go-webengine/engine@v0.45.0...v0.45.1

v0.45.0

Compare Source

What's Changed
  • Blob, URL.createObjectURL/revokeObjectURL, and a blob: aware importScripts by @​tannevaled in #​385

Full Changelog: go-webengine/engine@v0.44.5...v0.45.0

v0.44.5

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.44.4...v0.44.5

v0.44.4

Compare Source

What's Changed
  • Host import exceptions propagate unchanged; shared memory grows visibly across agents by @​tannevaled in #​383

Full Changelog: go-webengine/engine@v0.44.3...v0.44.4

v0.44.3

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.44.2...v0.44.3

v0.44.2

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.44.1...v0.44.2

v0.44.1

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.44.0...v0.44.1

v0.44.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.43.5...v0.44.0

v0.43.5

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.43.4...v0.43.5

v0.43.4

Compare Source

What's Changed
  • Fix the actual cause of the reported native crash: switch wazero to the Interpreter engine by @​tannevaled in #​377

Full Changelog: go-webengine/engine@v0.43.3...v0.43.4

v0.43.3

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.43.2...v0.43.3

v0.43.2

Compare Source

What's Changed
  • Fix the real cause of the reported native crash: a worker GPU-teardown use-after-free race by @​tannevaled in #​375

Full Changelog: go-webengine/engine@v0.43.1...v0.43.2

v0.43.1

Compare Source

What's Changed
  • Bump go-macos/metal to v0.6.1: fixes an AutoreleasePool gap matching a reported native crash by @​tannevaled in #​374

Full Changelog: go-webengine/engine@v0.43.0...v0.43.1

v0.43.0

Compare Source

What's Changed
  • Make per-render request count configurable (Options.MaxRequests/Engine.MaxRequests) by @​tannevaled in #​373

Full Changelog: go-webengine/engine@v0.42.1...v0.43.0

v0.42.1

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.42.0...v0.42.1

v0.42.0

Compare Source

What's Changed
  • Add WebGPU error scopes, GPUShaderStage, explicit layouts, copyBufferToBuffer by @​tannevaled in #​371

Full Changelog: go-webengine/engine@v0.41.0...v0.42.0

v0.41.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.40.2...v0.41.0

v0.40.2

Compare Source

What's Changed
  • Give WebAssembly.Instance/.Module real identity, and a real performance.now() by @​tannevaled in #​369

Full Changelog: go-webengine/engine@v0.40.1...v0.40.2

v0.40.1

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.40.0...v0.40.1

v0.40.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.39.0...v0.40.0

v0.39.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.38.0...v0.39.0

v0.38.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.37.0...v0.38.0

v0.37.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.36.0...v0.37.0

v0.36.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.35.1...v0.36.0

v0.35.1

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.35.0...v0.35.1

v0.35.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.34.0...v0.35.0

v0.34.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.33.0...v0.34.0

v0.33.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.32.0...v0.33.0

v0.32.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.31.0...v0.32.0

v0.31.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.30.0...v0.31.0

v0.30.0

Compare Source

What's Changed
  • Give SharedArrayBuffer its own instanceof/toString identity, not ArrayBuffer's by @​tannevaled in #​355

Full Changelog: go-webengine/engine@v0.29.1...v0.30.0

v0.29.1

Compare Source

What's Changed
  • Gate a timer job's first firing by real wall-clock delay under EnableWorkerStreaming by @​tannevaled in #​354

Full Changelog: go-webengine/engine@v0.29.0...v0.29.1

v0.29.0

Compare Source

What's Changed
  • Add real COOP/COEP gating and typed-array-view postMessage sharing (M3 completeness) by @​tannevaled in #​353

Full Changelog: go-webengine/engine@v0.28.1...v0.29.0

v0.28.1

Compare Source

What's Changed
  • Make setInterval genuinely repeat; clearTimeout/clearInterval actually cancel by @​tannevaled in #​352

Full Changelog: go-webengine/engine@v0.28.0...v0.28.1

v0.28.0

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.27.1...v0.28.0

v0.27.1

Compare Source

What's Changed

Full Changelog: go-webengine/engine@v0.27.0...v0.27.1

v0.27.0

Compare Source

What's Changed
  • Add Engine.EnableWorkerStreaming: a live event loop for unsolicited Worker messages by @​tannevaled in #​349

Full Changelog: go-webengine/engine@v0.26.0...v0.27.0

[v0.26.0](https://redirect.github.com/go-web

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@tannevaled

tannevaled commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: corpus/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 8 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.27.2 -> 1.27.4
github.com/andybalholm/brotli v1.2.6 -> v1.2.8
github.com/go-gfx/gfx v0.36.1 -> v0.37.0
github.com/go-gfx/oksvg v0.2.0 -> v0.4.0
github.com/go-images/images v0.1.0 -> v0.1.1-0.20261026203936-4ac989d310a1
github.com/go-images/jpeg2000 v0.13.8 -> v0.14.0
github.com/go-opentype/opentype v0.16.0 -> v0.21.1
github.com/klauspost/compress v1.18.7 -> v1.20.2
golang.org/x/net v0.61.0 -> v0.62.0
File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 5 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.27.2 -> 1.27.4
github.com/andybalholm/brotli v1.2.6 -> v1.2.8
github.com/go-gfx/oksvg v0.2.0 -> v0.4.0
github.com/go-images/images v0.1.0 -> v0.1.1-0.20261026203936-4ac989d310a1
github.com/klauspost/compress v1.18.7 -> v1.20.2
golang.org/x/net v0.61.0 -> v0.62.0

@tannevaled
tannevaled force-pushed the renovate/deps branch 6 times, most recently from 56bb8a0 to d0c5461 Compare November 8, 2026 07:01
@tannevaled
tannevaled force-pushed the renovate/deps branch 3 times, most recently from 16ec88a to 4c4488e Compare November 11, 2026 07:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tannevaled