fix(deps): update dependencies

[tannevaled]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-crdt/crdt	v0.37.0 → v0.39.0
github.com/go-widgets/toolkit	v0.298.0 → v0.300.0

---

Release Notes

go-crdt/crdt (github.com/go-crdt/crdt)

v0.39.0

Compare Source

ErrUnknownFormat — a snapshot this build has no reader for is now told apart from bytes that are damaged.

Before, a snapshot written by a newer build read back as crdt: malformed encoding. That is what you would say about corruption. It is not corruption, and the person holding it needs a different thing: a snapshot travels — in go-crdt/collab a joining client calls LoadComposite on one the server sends it — so the ordinary way to meet this is a peer running a newer build, and the answer is to upgrade rather than to go hunting for damaged data.

v0.38.0 made that likely enough to be worth naming: its notes say to upgrade clients before servers, and this is what a deployment that did not sounds like.

It wraps rather than replaces

var ErrUnknownFormat = fmt.Errorf("%w: format version this build does not know", ErrMalformed)

These bytes are malformed as far as this build is concerned, so a caller that only ever asked that question goes on getting the same answer — errors.Is(err, ErrMalformed) still holds, and every existing test asserting it passes unchanged. What is new is being able to ask the narrower question.

Reported by all four loaders: Load, LoadList, LoadMap, LoadComposite. A test pins that the distinction actually distinguishes — truncated bytes must not come back as an unknown format, or it would be a rename.

v0.38.0: — snapshot format version 8

Compare Source

⚠️ Read this before upgrading a server

A snapshot travels. In go-crdt/collab, a joining client calls
crdt.LoadComposite on a snapshot the server sends it (client.go:190), and
no reader before this release knows version 8. There is no negotiation to
fall back on — a reader either knows the version byte or refuses the bytes.

Upgrade clients before servers, or both together.

Every snapshot version this package has published has had this property, and
versions 1–6 still load here, so an old snapshot opens in a new build. It is
worth saying out loud this time because much of the fleet is several releases
behind: a server on v0.38.0 will lock out a client on v0.31.0.

---

An encoding per column

Every column is now a sequence of groups — a run is a count and a value,
everything else a literal stretch — and the single column of interleaved deletion
fields is split into four columns each holding one kind of number.

On the automerge-paper trace:

snapshot	478 474 → 259 890 bytes (45.7% smaller)
what gzip -6 still finds in it	4.13× → 2.31×

The three columns #​88 was filed
about — clocks, run sites and deletion sites, each holding one distinct
value and costing 71 924 bytes between them — now cost twelve bytes.
Deletion gaps go 50 286 → 1 483, spans 50 297 → 3 048, sequence steps
55 828 → 17 975.

The grouping threshold was measured rather than chosen: 2 → 266 270,
3 → 259 840, 4 → 259 808, 6 → 261 016.

What was deliberately left out, with the number

A deflated column encoding is understood and never written — the order
OpSuperseded shipped in (#​83).
Flipping it is one constant. It was measured first:

	Bytes
version 8	259 890
with the text column deflated	128 270
compressed per column by whoever stores it	110 487
the same, text deflated first	110 512

It halves a raw snapshot and costs 25 bytes to any caller that already
compresses — and gitstore (through git's zlib) and pgstore (through
Postgres's TOAST) already do. It would also cost the promise that the same state
is the same bytes, which most of the test suite depends on.

Also in this release

Documentation, measurement and tests only:

• The size comparison in docs/performance.md now reports compressed as well
  as raw, because it was comparing one format that compresses its text
  internally (diamond-types LZ4s content over 20 bytes) against five that do not,
  under one heading.
• A losing duplicate deletion is pinned: what it costs to leave one out, and the
  rule that no superseded run may cover one.

Version 7 is reserved, not used: the purge branch defines it, and giving one
version byte two meanings is the failure the numbering exists to prevent.

go-widgets/toolkit (github.com/go-widgets/toolkit)

v0.300.0

Compare Source

v0.299.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[tannevaled]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
github.com/go-images/images	v0.0.0-20260815210351-4a50ef5ab734 -> v0.0.0-20260830151046-7e8189dc2288
github.com/go-opentype/fonts	v0.6.0 -> v0.9.0
github.com/go-opentype/opentype	v0.5.0 -> v0.12.0
github.com/go-richdoc/richdoc	v0.2.0 -> v0.3.0