fix(deps): update the fleet

[tannevaled]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-gfx/gfx	v0.15.0 → v0.16.0
github.com/go-opentype/opentype	v0.10.0 → v0.12.0
github.com/go-pdfkit/pdffont	v0.3.0 → v0.3.1

---

Release Notes

go-gfx/gfx (github.com/go-gfx/gfx)

v0.16.0: — the registry writes too

Compare Source

codec.Encode writes PNG, JPEG, GIF, TIFF and BMP, each through the same reference library that reads it. Nothing here encodes anything itself.

The registry could read eleven formats and write none, so every consumer that had a picture and needed a file wrote its own encoder call — and a PDF toolkit that can draw a page could not offer "PDF to PNG".

Reading and writing are not symmetric, and the gap is not an oversight: a reference decoder exists in pure Go for every format Sniff names, a reference encoder for five of them. WEBP, ICO, ICNS, PNM, QOI, JP2 and JBIG2 return ErrCannotEncode rather than something in another format under the asked-for name. CanEncode says which way a format goes without having to fail to find out.

Alpha survives into PNG and TIFF. The other three do not, and what they are given is the image composited onto white — chosen here rather than left to the encoder, because an encoder that simply drops the channel puts the colour that was under the transparency into the file, and for a page drawn on transparent ground that is black.

100% statement coverage, go vet and -race clean, nine cross-compile targets, CGO-free.

go-opentype/opentype (github.com/go-opentype/opentype)

v0.12.0

Compare Source

v0.11.0

Compare Source

go-pdfkit/pdffont (github.com/go-pdfkit/pdffont)

v0.3.1: — catch up with the siblings, and set Renovate to watch them

Compare Source

A dependency release, and the thing that stops it being needed again.

What this was behind on

reader v0.6.0 carries fixes this module was doing without and handing to its own callers, among them two denial-of-service defects:

• a 219-byte file with no trailer, whose last object is numbered 2 147 483 647, took 21.2 s to open and allocated not one byte — so no memory limit anywhere caught it
• /Crypt, which 209 files (12.8% of the 1 633 real government forms) carry and which used to make every one of them decode to nothing readable
• a second map-order non-determinism, in indexObjectStreams: five different answers in five runs of the same binary on the same file
• a damaged stream's decoded prefix kept and labelled as salvage, rather than returned with a nil error as though it were the whole of it

pdffont v0.3.0 comes with it where it is reachable: the /ToUnicode map whose size had nothing to do with its input — 10 655 bytes producing 13 107 200 entries, 1 054 MB and 10 seconds, per font per page.

Why it happened

Nothing in this organisation was watching for a sibling's release. Nine of the ten Go modules had fallen behind at least once, and two of them were still requiring the reader from before the 21-second defect was fixed in it.

The organisation already had a Renovate preset at go-pdfkit/.github, with rules for Go modules and for actions — and not one of the ten modules extended it, so the preset had never been read by anything. The one-line renovate.json that does is now here, matching what every go-ruby-* repository already has.

Renovate still has to be installed on the organisation for it to run.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.