fix(deps): update dependencies

[tannevaled]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/go-crdt/collab	v0.36.1 → v0.37.0			require	minor
github.com/go-crdt/crdt	v0.37.0 → v0.39.0			require	minor
github.com/go-images/images	7e8189d → 23d959d			require	digest
github.com/go-widgets/toolkit	v0.298.0 → v0.300.0			require	minor

---

Release Notes

go-crdt/collab (github.com/go-crdt/collab)

v0.37.0: — snapshot format 8

Compare Source

⚠️ Read this before upgrading a server

This release takes crdt v0.39.0, which writes snapshot format version 8.
A server persists that format and sends it to every joining client.

A client cannot negotiate a snapshot format — it reads the version byte or it
does not — and no crdt before v0.38.0 knows version 8.

Upgrade clients before servers, or both together.

What you get for it

Snapshots are 45.7% smaller on the automerge-paper trace (478 474 → 259 890
bytes), because every column now has an encoding of its own. Three columns that
held one repeated value and cost 71 924 bytes between them now cost twelve. See
crdt v0.38.0.

That matters most where nothing else compresses: DirStore, MemoryStore and
every transport. gitstore (through git's zlib) and pgstore (through
Postgres's TOAST) were already recovering much of it.

And a client that says when the server is ahead of it

Before, a client meeting a newer server got:

crdt: malformed encoding

which reads as corrupt data and sends somebody after the wrong thing. Now:

the server's snapshot is in a format this client cannot read, so it is
running a newer build; upgrade the client, or the server's peers before
the server

The cause is wrapped rather than replaced, so errors.Is(err, crdt.ErrUnknownFormat)
holds for anyone who wants to branch on it.

Satellites

gitstore and pgstore take crdt v0.39.0 as well. No behaviour changes in
either; tag them if you depend on them directly.

go-crdt/crdt (github.com/go-crdt/crdt)

v0.39.0

Compare Source

ErrUnknownFormat — a snapshot this build has no reader for is now told apart from bytes that are damaged.

Before, a snapshot written by a newer build read back as crdt: malformed encoding. That is what you would say about corruption. It is not corruption, and the person holding it needs a different thing: a snapshot travels — in go-crdt/collab a joining client calls LoadComposite on one the server sends it — so the ordinary way to meet this is a peer running a newer build, and the answer is to upgrade rather than to go hunting for damaged data.

v0.38.0 made that likely enough to be worth naming: its notes say to upgrade clients before servers, and this is what a deployment that did not sounds like.

It wraps rather than replaces

var ErrUnknownFormat = fmt.Errorf("%w: format version this build does not know", ErrMalformed)

These bytes are malformed as far as this build is concerned, so a caller that only ever asked that question goes on getting the same answer — errors.Is(err, ErrMalformed) still holds, and every existing test asserting it passes unchanged. What is new is being able to ask the narrower question.

Reported by all four loaders: Load, LoadList, LoadMap, LoadComposite. A test pins that the distinction actually distinguishes — truncated bytes must not come back as an unknown format, or it would be a rename.

v0.38.0: — snapshot format version 8

Compare Source

⚠️ Read this before upgrading a server

A snapshot travels. In go-crdt/collab, a joining client calls
crdt.LoadComposite on a snapshot the server sends it (client.go:190), and
no reader before this release knows version 8. There is no negotiation to
fall back on — a reader either knows the version byte or refuses the bytes.

Upgrade clients before servers, or both together.

Every snapshot version this package has published has had this property, and
versions 1–6 still load here, so an old snapshot opens in a new build. It is
worth saying out loud this time because much of the fleet is several releases
behind: a server on v0.38.0 will lock out a client on v0.31.0.

---

An encoding per column

Every column is now a sequence of groups — a run is a count and a value,
everything else a literal stretch — and the single column of interleaved deletion
fields is split into four columns each holding one kind of number.

On the automerge-paper trace:

snapshot	478 474 → 259 890 bytes (45.7% smaller)
what gzip -6 still finds in it	4.13× → 2.31×

The three columns #​88 was filed
about — clocks, run sites and deletion sites, each holding one distinct
value and costing 71 924 bytes between them — now cost twelve bytes.
Deletion gaps go 50 286 → 1 483, spans 50 297 → 3 048, sequence steps
55 828 → 17 975.

The grouping threshold was measured rather than chosen: 2 → 266 270,
3 → 259 840, 4 → 259 808, 6 → 261 016.

What was deliberately left out, with the number

A deflated column encoding is understood and never written — the order
OpSuperseded shipped in (#​83).
Flipping it is one constant. It was measured first:

	Bytes
version 8	259 890
with the text column deflated	128 270
compressed per column by whoever stores it	110 487
the same, text deflated first	110 512

It halves a raw snapshot and costs 25 bytes to any caller that already
compresses — and gitstore (through git's zlib) and pgstore (through
Postgres's TOAST) already do. It would also cost the promise that the same state
is the same bytes, which most of the test suite depends on.

Also in this release

Documentation, measurement and tests only:

• The size comparison in docs/performance.md now reports compressed as well
  as raw, because it was comparing one format that compresses its text
  internally (diamond-types LZ4s content over 20 bytes) against five that do not,
  under one heading.
• A losing duplicate deletion is pinned: what it costs to leave one out, and the
  rule that no superseded run may cover one.

Version 7 is reserved, not used: the purge branch defines it, and giving one
version byte two meanings is the failure the numbering exists to prevent.

go-widgets/toolkit (github.com/go-widgets/toolkit)

v0.300.0

Compare Source

v0.299.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[tannevaled]

ℹ️ Artifact update notice

File name: rougelex/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
github.com/go-crdt/collab	v0.36.1 -> v0.37.0
github.com/go-crdt/crdt	v0.37.0 -> v0.39.0
github.com/go-images/images	v0.0.0-20260830151046-7e8189dc2288 -> v0.0.0-20260831115433-23d959d868e3