fix(deps): update the fleet

[tannevaled]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-opentype/fonts	v0.8.0 → v0.9.0
github.com/go-pdfkit/pdffont	v0.3.0 → v0.3.1

---

Release Notes

go-opentype/fonts (github.com/go-opentype/fonts)

v0.9.0: — Tinos, and a licence that lives elsewhere

Compare Source

Tinos is the metric-compatible stand-in for Times, as Arimo is for Helvetica and Cousine for Courier. Two of the three were bundled and the third was not.

It was skipped because its google/fonts directory ships no OFL.txt, though its METADATA.pb names the licence and the text sits in the upstream project. A seed may now say where the real text is — the rule is untouched: no licence, no bundle.

48 families.

go-pdfkit/pdffont (github.com/go-pdfkit/pdffont)

v0.3.1: — catch up with the siblings, and set Renovate to watch them

Compare Source

A dependency release, and the thing that stops it being needed again.

What this was behind on

reader v0.6.0 carries fixes this module was doing without and handing to its own callers, among them two denial-of-service defects:

• a 219-byte file with no trailer, whose last object is numbered 2 147 483 647, took 21.2 s to open and allocated not one byte — so no memory limit anywhere caught it
• /Crypt, which 209 files (12.8% of the 1 633 real government forms) carry and which used to make every one of them decode to nothing readable
• a second map-order non-determinism, in indexObjectStreams: five different answers in five runs of the same binary on the same file
• a damaged stream's decoded prefix kept and labelled as salvage, rather than returned with a nil error as though it were the whole of it

pdffont v0.3.0 comes with it where it is reachable: the /ToUnicode map whose size had nothing to do with its input — 10 655 bytes producing 13 107 200 entries, 1 054 MB and 10 seconds, per font per page.

Why it happened

Nothing in this organisation was watching for a sibling's release. Nine of the ten Go modules had fallen behind at least once, and two of them were still requiring the reader from before the 21-second defect was fixed in it.

The organisation already had a Renovate preset at go-pdfkit/.github, with rules for Go modules and for actions — and not one of the ten modules extended it, so the preset had never been read by anything. The one-line renovate.json that does is now here, matching what every go-ruby-* repository already has.

Renovate still has to be installed on the organisation for it to run.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.