From 1203085a4e79c59c616918435269b8fa98719235 Mon Sep 17 00:00:00 2001
From: tannevaled <tannevaled@users.noreply.github.com>
Date: Sun, 1 Nov 2026 01:57:40 +0100
Subject: [PATCH] Bump go-gfx/gfx to v0.37.0 and go-images/jpeg2000 to v0.14.0

No code change. render never calls codec.Decode/DecodeBest (only
codec.DecodeEmbeddedJBIG2), so the new 40 Mpx default there does not apply.
The JPX path keeps render's own per-image ceilings (maxImagePixels,
maxDecodeBytes) checked from DecodeConfig before jpeg2000.Decode; the new
default MaxSamples (2^28) is above everything those admit, so the default
is kept rather than inventing a number. go-ico and go-bmp leave the graph.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 61ce571..8f2e25d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
           check-latest: true
           cache: true
 
@@ -107,7 +107,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
           check-latest: true
           cache: true
       # ⛔ `qemu-user-static` is a VIRTUAL package on Ubuntu 26.04, which
@@ -183,7 +183,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
 
       - name: Cross-build the test binary with the pinned toolchain
         env:
@@ -228,5 +228,5 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
       - run: go test ./...