Repository navigation
fix(deps): update dependencies - #476
Merged
Merged
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: rougelex/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
tannevaled
force-pushed
the
renovate/deps
branch
6 times, most recently
from
October 10, 2026 10:30
af5739c to
856ae28
Compare
tannevaled
force-pushed
the
renovate/deps
branch
from
October 10, 2026 20:31
856ae28 to
448a561
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.74.0→v0.77.1v0.55.0→v0.57.0v0.34.0→v0.35.0v0.2.0→v0.3.0v0.0.0-20260927173152-87444e36aac4→v0.1.0v0.10.0→v0.12.0v0.13.0→v0.15.0v0.5.0→v0.7.0v0.4.0→v0.6.0v0.2.0→v0.4.0v0.3.0→v0.3.1v0.9.0→v0.14.0v0.13.0→v0.15.0v0.321.2→v0.328.0Release Notes
go-crdt/collab (github.com/go-crdt/collab)
v0.77.1Compare Source
v0.77.0Compare Source
v0.76.4Compare Source
v0.76.3Compare Source
v0.76.2Compare Source
v0.76.1Compare Source
v0.76.0Compare Source
v0.75.4Compare Source
v0.75.3Compare Source
v0.75.2Compare Source
v0.75.1Compare Source
v0.75.0Compare Source
go-crdt/crdt (github.com/go-crdt/crdt)
v0.57.0Compare Source
v0.56.2Compare Source
v0.56.1Compare Source
v0.56.0Compare Source
v0.55.6Compare Source
v0.55.5Compare Source
v0.55.4Compare Source
v0.55.3Compare Source
v0.55.2Compare Source
v0.55.1Compare Source
go-gfx/gfx (github.com/go-gfx/gfx)
v0.35.0: — bound the surface and the embedded rasterCompare Source
A security release. Behaviour change:
svg.Rasterizenow returns an errorfor a surface past
Options.MaxPixels, which is why it is a minor rather thana patch. Callers wanting a larger canvas set
MaxPixels.An SVG is text, and two of the numbers in it decide allocations: the
document's own
width/height, and the dimensions an embedded<image href="data:…">declares in its header. A surface is four bytes a pixel.width="40000" height="40000"<image>claims 20000×20000⛔ Nothing about the size of either input hints at the size of the output — and
drawImageskips decode failures in silence, so the gigabyte was allocatedand nothing anywhere said so.
What the fix is
Options.MaxPixels, defaulting toDefaultMaxPixels= 40 000 000 pixels(a hundred and sixty million bytes) — the same ceiling
go-pdfkit/renderalready uses, so the fleet has one number for this rather than two.
image.DecodeConfig, before anything is decoded: a ceiling enforced afterthe allocation it bounds is not a ceiling, it is a comment;
int64— two numbers a file chose,multiplied in
inton a 32-bit build, is how a ceiling is passed byoverflowing past it (
386is in the build matrix);Scalecounts towards it: the surface is the product, and only one of thetwo numbers is ours.
Also
A
<line>whose two ends coincide was the module's single uncoveredstatement, and the 100 % gate passed anyway because the total rounds up across
seven packages. ⛔ A gate that passes by rounding will one day pass over a real
gap. Closed.
100 % statement coverage,
-racegreen, twelve CI checks across eightarchitectures, four mutations against the ceilings all caught.
v0.34.1Compare Source
go-icons/iconoir (github.com/go-icons/iconoir)
v0.3.0Compare Source
v0.2.1Compare Source
go-opentype/fonts (github.com/go-opentype/fonts)
v0.12.0Compare Source
v0.11.0Compare Source
go-opentype/opentype (github.com/go-opentype/opentype)
v0.15.0Compare Source
v0.14.0Compare Source
go-opentype/shape (github.com/go-opentype/shape)
v0.7.0Compare Source
v0.6.0Compare Source
go-richdoc/richdoc (github.com/go-richdoc/richdoc)
v0.6.0Compare Source
v0.5.1Compare Source
v0.5.0Compare Source
go-rouge/rouge (github.com/go-rouge/rouge)
v0.4.0Compare Source
v0.3.0Compare Source
go-typeset/bidi (github.com/go-typeset/bidi)
v0.3.1Compare Source
go-widgets/mvvm (github.com/go-widgets/mvvm)
v0.14.0Compare Source
v0.13.0: — bind a cycle button and a commandCompare Source
tkbind can bind a cycle button and a command
Two shapes an app could not bind with what was here, and wrote by hand instead — one direction each, in the consumer (#32).
A cycle button holds a position, not a value. A quarter turn is 90, 180 or 270 and the button sits at 0, 1 or 2, so there is nothing for an index-to-index binding to keep equal.
BindCycleValuestakes the table —values[i]is what positionimeans — and binds both ways through it;BindCycleis the plain index case, clamped. A value the table has not got settles on the first position and is written back, because a model left holding 45 while the button shows a quarter turn is two sides with two answers.A button that checks its own preconditions is a button that looks pressable.
BindButtongives aButtonaCommand: pressing executes, andCanExecutedrivesDisabled, so the rule lives once instead of being re-checked inside every handler.100% of statements; nine mutations, all caught. One survived the first run — replacing the range check on an incoming position with
if true— becauseIndex()is anObservablewith no guard, anything canSeta position the table has no value for, andvalues[i]there is a panic rather than a wrong answer.v0.12.0: — bind a box, a spinner, a list and a tickCompare Source
tkbind can bind the four everyday controls
tkbindhad binders for aBrowser, aTable, aContainerand aRangeSlider— and none for the text box, the spin button, the drop-down and the tick box, which are the four an app reaches for first.BindEntry,BindSpin,BindChoiceandBindCheckfill that in (#31).Without them an app binds these by hand, and hand-binding settles into a
Subscribethat copies the value into a plain field plus a rebuild to get it back — a field copied across a boundary plus an imperative resync, which is the shape MVVM exists to remove.The clamping happens in the observable, before the link exists, which is not where it looks like it belongs.
SpinButton.SetValueclamps to[Min, Max]andDropDown.Selectrefuses an index it has no option for — butBindTwoWayseeds the destination by writing itsObservable, which is neither of those paths. A ViewModel asking for option nine of three therefore puts the list on nine, and normalising afterwards cannot fix it, because the fix would be to callSelect, andSelectis the guard that just declined.100% of statements, eight mutations all caught — each link severed, each clamp disabled at both ends.
v0.11.0Compare Source
v0.10.0Compare Source
go-widgets/painter (github.com/go-widgets/painter)
v0.15.0Compare Source
v0.14.0Compare Source
go-widgets/toolkit (github.com/go-widgets/toolkit)
v0.328.0Compare Source
Table.CellFill: per-cell backgrounds (heatmaps), text inked by WCAG contrast, selection band kept, nil renders as before. New toolkit.Viridis and toolkit.ContrastInk. Entry: the caret is clamped after an external Text().Set, so a Backspace before the next Draw no longer panics. #483
v0.327.0Compare Source
New XYPlot widget: numeric series against labelled axes on 1-2-5 ticks, line/stem/marker styles, legend, hover readout, one stroke per pixel column for long series. Registered in the MVVM gate and the bounds sweep. #484
v0.326.1Compare Source
Entry: a click places the caret under the pointer when the field is not at the surface's left edge (the Entry subtracted its own X from an already widget-local coordinate, so the caret went to 0). #485
v0.326.0Compare Source
v0.325.0Compare Source
v0.324.0Compare Source
v0.323.1Compare Source
v0.323.0Compare Source
v0.322.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.