Skip to content

fix(deps): update dependencies - #57

Open
tannevaled wants to merge 1 commit into
mainfrom
renovate/deps
Open

fix(deps): update dependencies#57
tannevaled wants to merge 1 commit into
mainfrom
renovate/deps

Conversation

@tannevaled

@tannevaled tannevaled commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/go-opentype/opentype v0.16.2-0.20261027113239-5e69589e9a5e → v0.21.1 age confidence
github.com/go-pdfkit/reader v0.9.0 → v0.11.0 age confidence
github.com/go-widgets/painter v0.16.0 → v0.17.1 age confidence
github.com/go-widgets/toolkit v0.345.2 → v0.376.1 age confidence

Release Notes

go-opentype/opentype (github.com/go-opentype/opentype)

v0.21.1

Compare Source

What's Changed

  • perf(face): decode and flatten each glyph outline once, bound the caches by @​tannevaled in #​68

Full Changelog: go-opentype/opentype@v0.21.0...v0.21.1

v0.21.0

Compare Source

What's Changed

  • feat(face): GlyphMaskIndexAt, a glyph mask at a fractional pen position by @​tannevaled in #​67

Full Changelog: go-opentype/opentype@v0.20.0...v0.21.0

v0.20.0

Compare Source

What's Changed

  • a shaped run gets an unrounded form, or no typesetter can use the shared one by @​tannevaled in #​65

Full Changelog: go-opentype/opentype@v0.19.0...v0.20.0

v0.19.0

Compare Source

What's Changed

  • every scaled metric gets an unrounded form, because a MATH value is fractional by @​tannevaled in #​64

Full Changelog: go-opentype/opentype@v0.18.0...v0.19.0

v0.18.0

Compare Source

GPOS kerning now follows the spec's two different stopping rules instead of one.

A pair covered by an early kern lookup with an explicit zero reported no kerning at all, because Kern returned at the first lookup whose pair-adjustment subtable covered the pair. OpenType stops at the first matching subtable within a lookup, but processes lookups in LookupList order, each acting on the previous ones' results — so their adjustments add (spec, chapter 2).

Libertinus Serif files four separate kern feature records: its lookup 0 covers A/V with 0 and its lookup 6 covers the same pair with −112. Every AV in that family came out 1.12pt too wide at 10pt.

Kerner.Kerning also now asks whether GPOS covered the pair rather than whether it answered non-zero — a zero in a pair-adjustment lookup is the font saying "no adjustment between these two", which is an answer. A pair no GPOS lookup mentions still falls through to the legacy kern table.

Measured, in font units

pair before after
Libertinus Serif AV 0 −112
Libertinus Serif To 0 −63
TeXGyreTermesX AV −130 −130 (control)
TeXGyreTermesX To −90 −90 (control)

Downstream, go-tex's \hbox{AV} at 10pt in Libertinus went from 13.47pt to 12.35pt, against XeTeX's 12.35pt.

This is a minor rather than a patch because it changes the kerning a caller gets for any font that files a pair in more than one lookup; a downstream fidelity floor measured against the old values will need re-measuring.

#​63

🤖 Generated with Claude Code

v0.17.1

Compare Source

What's Changed

  • README: the OS/2 line metrics, and which set Ascent/Descent belong to by @​tannevaled in #​58
  • fix(deps): update module github.com/andybalholm/brotli to v1.2.8 by @​tannevaled in #​60
  • NewFaceAt: a face at a fractional size, for a caller that counts finer than a pixel by @​tannevaled in #​62

Full Changelog: go-opentype/opentype@v0.17.0...v0.17.1

go-pdfkit/reader (github.com/go-pdfkit/reader)

v0.11.0

Compare Source

CheckLinearized: asking whether a file is what its front says

Linearized(b) has been here since v0.10.0 and answers the cheap question a reader asks before streaming: are the parameters at the front well formed? Of Table F.1's claims it checked exactly one against the file — /L against the byte count — because that is all a reader can afford, having fetched 1024 bytes and resolved nothing.

That makes it a weaker test than it looks, and a writer developed against it would pass without linearizing anything: /O, /E, /N and /T were read for type and never consulted, so a file with a correct /L and four invented integers was accepted. That is precisely what a first linearizer emits.

CheckLinearized(b) is the other question, for the other caller: not "may a reader trust the front of this file" but "is this file actually what the front says". It opens the document, so it costs what opening costs, and it is the judgement a writer needs on bytes it has just produced. Every parameter must point at what it claims to:

checked against
/N the document's real page count
/O the real first page, and that a reader will treat it as page one
/H a real stream object, its extent matching exactly
/T the main cross-reference section — either of the two meanings Table F.1 gives it
/E the end of the last object the first-page cross-reference section lists
/E, and why a second producer was needed

/E is the parameter a writer is most likely to get wrong, so leaving it ungated was the hole that let a writer be its own judge. It is now checked against the first-page cross-reference section — the one Annex F puts at the front and startxref points at, whose entries are the first page's objects.

The subtlety is that F.3.1 permits the primary hint stream on either side of the first page. qpdf writes it before (/H 550, /E 902); Ghostscript -dFastWebView writes it after, at /E exactly (/H 829, /E 829). A rule that simply took the highest-offset entry would therefore refuse every Ghostscript file. Both qpdf fixtures place it before and cannot tell the two rules apart, which is why a Ghostscript-produced file is committed beside them.

Values a 32-bit build cannot address are refused, not truncated

int(Integer) discards the high half where int is 32 bits, so a /H length of 2³²+127 read as 127 — the committed fixture's own hint length, a plausible value every later check then accepted. The same bytes were judged sound on one machine and refused on another, with nothing to say which. Every integer the dictionary offers now goes through one conversion that refuses what it cannot represent, /P included. The new error is ErrLinearizationMalformed.

Known limits, stated rather than implied
  • /E is checked against the first-page cross-reference section, which is not the same as checking the section is right. A writer that omits objects page one genuinely needs produces an internally consistent file that passes. Ghostscript does this on a document with shared fonts, outlines and links: /H = /E = 1941 is accepted here, while qpdf --check computes 5500..5501 and reports page one as 9 objects where the hint table claims 4. Deciding what page one needs means walking its resources — the partition the hint tables describe — and that judgement is still outstanding.
  • The hint tables' contents are not decoded or compared with the file; only /H's extent is checked.
  • /P is range-checked but nothing cross-checks its value.
One deliberate disagreement with qpdf

qpdf computes /E as a range (901..902 on the committed fixture), accepting the end with or without the line ending after endobj. This requires the end including it, which is what both measured producers write. A file carrying the lower value would pass qpdf --check and be refused here; none has been observed, and the alternative is a window that cannot tell a correct /E from one a byte short — the same argument that made the /H length an exact comparison.

Across the rest, there are 0 disagreements with qpdf over 42 generated files: 1, 2, 3, 5, 25 and 100 pages × plain, object streams, uncompressed streams, 256-bit encryption and --newline-before-endstream.

All limits are tracked in #​40.

v0.10.0

Compare Source

What's Changed

Full Changelog: go-pdfkit/reader@v0.9.0...v0.10.0

go-widgets/painter (github.com/go-widgets/painter)

v0.17.1

Compare Source

What's Changed

Full Changelog: go-widgets/painter@v0.17.0...v0.17.1

v0.17.0

Compare Source

What's Changed

Full Changelog: go-widgets/painter@v0.16.2...v0.17.0

v0.16.2

Compare Source

What's Changed

Full Changelog: go-widgets/painter@v0.16.1...v0.16.2

v0.16.1

Compare Source

What's Changed

Full Changelog: go-widgets/painter@v0.16.0...v0.16.1

go-widgets/toolkit (github.com/go-widgets/toolkit)

v0.376.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.376.0...v0.376.1

v0.376.0

Compare Source

The two declared pins reach their releases

toolkit declared two fleet modules at pseudo-versions while both had been
released:

github.com/go-images/images      v0.1.1-0.20261026203936-…  → v0.3.0
github.com/go-opentype/opentype  v0.16.2-0.20261027113239-… → v0.20.0

Why this repository. toolkit is the intermediate its consumers inherit
those pins through — go mod why in go-freedesktop/notifications gives
notifications/cmd/notifyd → go-widgets/toolkit → go-images/images/ops, and
go-aiquota/tray, go-pdfkit/app and go-widgets/window require toolkit
directly. They carried the ceiling as // indirect and could not raise it
themselves; now their next update is an ordinary tagged bump.

Chosen by measurement: pinscan --verify-origin reads each declaring
repository's go.mod from GitHub and reported 11 that still declare such a
pin, out of 64 a working-tree pass named — 53 were already fixed upstream.

Two corrections inside the branch, both worth keeping

⛔ The first commit raised opentype to v0.18.0, read out of a scan table
from the previous evening. v0.20.0 had been published that morning at
08:42, so the fix was landing two releases behind the release it existed to
reach. The version a consumer should reach is a fact about now; a scan table
is a fact about when it ran.

⛔ CI was red while the local suite was green, because they ask different
questions. This repository has two modules — the root and rougelex,
which carries the same two as // indirect and has
replace github.com/go-widgets/toolkit => ../. A root go mod tidy does not
descend, so the gate's freshness check said so:

go: updates to go.mod needed; to update it: go mod tidy

⭐ One transitive consequence, named rather than left in the diff:
github.com/andybalholm/brotli v1.2.7 → v1.2.8, which minimal version
selection picks up from the new requirements.

v0.375.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.11...v0.375.0

v0.374.11

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.10...v0.374.11

v0.374.10

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.9...v0.374.10

v0.374.9

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.8...v0.374.9

v0.374.8

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.7...v0.374.8

v0.374.7

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.6...v0.374.7

v0.374.6

Compare Source

What's Changed

  • fix(input): a disabled Entry, TextView and CodeEditor ignore editing; harden the a11y gate by @​tannevaled in #​577

Full Changelog: go-widgets/toolkit@v0.374.5...v0.374.6

v0.374.5

Compare Source

What's Changed

  • fix(a11y): announce Disabled from every widget that honours it; audit gate by @​tannevaled in #​576

Full Changelog: go-widgets/toolkit@v0.374.4...v0.374.5

v0.374.4

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.3...v0.374.4

v0.374.3

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.2...v0.374.3

v0.374.2

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.1...v0.374.2

v0.374.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.374.0...v0.374.1

v0.374.0

Compare Source

What's Changed

  • feat(forgepane)!: optional ForgeChooser and ForgeLocatable (forge drop-down, folder) by @​tannevaled in #​568

Full Changelog: go-widgets/toolkit@v0.373.1...v0.374.0

v0.373.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.373.0...v0.373.1

v0.373.0

Compare Source

What's Changed

  • feat(forgepane): optional ForgeCommitter git transport; nil command hides its control by @​tannevaled in #​566

Full Changelog: go-widgets/toolkit@v0.372.0...v0.373.0

v0.372.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.371.0...v0.372.0

v0.371.0

Compare Source

What's Changed

  • feat: ForgePane, the git/forge pane as a widget over a ForgeModel interface by @​tannevaled in #​565

Full Changelog: go-widgets/toolkit@v0.370.0...v0.371.0

v0.370.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.369.0...v0.370.0

v0.369.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.368.0...v0.369.0

v0.368.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.367.0...v0.368.0

v0.367.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.366.0...v0.367.0

v0.366.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.365.0...v0.366.0

v0.365.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.364.1...v0.365.0

v0.364.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.364.0...v0.364.1

v0.364.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.363.0...v0.364.0

v0.363.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.362.1...v0.363.0

v0.362.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.362.0...v0.362.1

v0.362.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.361.0...v0.362.0

v0.361.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.360.0...v0.361.0

v0.360.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.359.0...v0.360.0

v0.359.0

Compare Source

What's Changed

  • feat(a11y): Focused/Disabled/ReadOnly/Multiline, stable A11yNode.Key, AccessibleName (T1) by @​tannevaled in #​541

Full Changelog: go-widgets/toolkit@v0.358.0...v0.359.0

v0.358.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.357.0...v0.358.0

v0.357.0

Compare Source

What's Changed

  • feat(focus)!: HasFocus() observable; TextView/RichEditor/AddressBar are Focusable by @​tannevaled in #​539

Full Changelog: go-widgets/toolkit@v0.356.0...v0.357.0

v0.356.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.355.1...v0.356.0

v0.355.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.355.0...v0.355.1

v0.355.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.354.0...v0.355.0

v0.354.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.353.0...v0.354.0

v0.353.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.352.0...v0.353.0

v0.352.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.351.0...v0.352.0

v0.351.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.350.1...v0.351.0

v0.350.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.350.0...v0.350.1

v0.350.0

Compare Source

Ribbon: a quick access bar

A ribbon puts each command on one tab. That is the point of a ribbon and
also its one structural cost: Save belongs to a tab, so saving means leaving
the tab being worked in.

Ribbon.Quick is the bar that answers it — RibbonButton and RibbonToggle
controls drawn as marks at the right of the tab row, beside the tabs and before
the collapse chevron, and still there when the ribbon is collapsed, which
is when it matters most.

r.Quick = []*toolkit.RibbonControl{
    {Kind: toolkit.RibbonButton, Action: save, Tip: "Write the deck to disk"},
    {Kind: toolkit.RibbonButton, Action: undo},
}
  • QuickMax is 20, the reference's own number. Past it they are not drawn,
    and QuickRect says so rather than handing back a rectangle for a command
    nobody can see.
  • QuickRect(label) is ControlRect for the bar: a canvas has no DOM, so
    a harness driving the surface needs to be told where a control is.
  • Keytips are digits, 1 to 9, shown with the tab letters and matched before
    them: Alt then 1 runs the first command without choosing a tab.
  • Keyboard: Right off the last tab enters the bar (it is what is physically
    to the right), Left off its start goes back to the tabs. With no bar the tabs
    wrap exactly as they did.
  • A command may be on the bar and on no tab at all.

Icons only — the row is one line of text tall — so the tooltip now follows a
hovered mark as well as a hovered cell, and is pulled back inside the ribbon's
width rather than running off the right edge.

Not included: the customisation drop-down, More Commands…, the
below-the-ribbon placement, and persistence of a user's own list.

Twenty-two ribbon tests, -race green, 100.0% of statements, 0 of 17 252
blocks uncovered.

v0.349.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.349.0...v0.349.1

v0.349.0

Compare Source

DiffView now marks the words that changed inside a changed line (WordChanges, a word diff through textdiff). Long lines wrap, with both sides level, so nothing is cut at the column's edge (#​521).

Note on tags: v0.346.1 is the same commit as v0.348.1 (the DiffView clipping fix, #​520). It was tagged out of order, so that tag holds newer code than v0.347.0 and v0.348.0. Published tags do not move. Use v0.348.1 or later; this release includes that fix.

v0.348.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.348.0...v0.348.1

v0.348.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.347.0...v0.348.0

v0.347.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.346.0...v0.347.0

v0.346.1

Compare Source

v0.346.1 is the same commit as v0.348.1: the DiffView fix that clips each half's titles and lines (#​520).

It was tagged out of order, after v0.347.0 and v0.348.0, so this tag holds newer code than those higher versions. Published tags do not move, so it stays. Use v0.348.1 or later.

v0.346.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.345.2...v0.346.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@tannevaled

tannevaled commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
github.com/go-gfx/gfx v0.36.1 -> v0.41.0
github.com/go-images/images v0.1.1-0.20261026203936-4ac989d310a1 -> v0.3.0

@tannevaled
tannevaled force-pushed the renovate/deps branch 7 times, most recently from bfb4f24 to c50c314 Compare November 9, 2026 07:47
@tannevaled
tannevaled force-pushed the renovate/deps branch 5 times, most recently from 0dc977e to bc2d887 Compare November 14, 2026 07:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tannevaled