[tannevaled]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-gfx/gfx	v0.34.1 → v0.35.0

---

Release Notes

go-gfx/gfx (github.com/go-gfx/gfx)

v0.35.0: — bound the surface and the embedded raster

Compare Source

A security release. Behaviour change: svg.Rasterize now returns an error
for a surface past Options.MaxPixels, which is why it is a minor rather than
a patch. Callers wanting a larger canvas set MaxPixels.

An SVG is text, and two of the numbers in it decide allocations: the
document's own width/height, and the dimensions an embedded
<image href="data:…"> declares in its header. A surface is four bytes a pixel.

input	before	after
~110 bytes declaring width="40000" height="40000"	6103.5 MiB, rasterised without complaint	0.0 MiB, refused
a 246-byte SVG whose <image> claims 20000×20000	1526.1 MiB held, then drawn into a 100×100 square	0.0 MiB, skipped
a 5000×5000 document	95.4 MiB	95.4 MiB, unchanged

⛔ Nothing about the size of either input hints at the size of the output — and
drawImage skips decode failures in silence, so the gigabyte was allocated
and nothing anywhere said so.

What the fix is

Options.MaxPixels, defaulting to DefaultMaxPixels = 40 000 000 pixels
(a hundred and sixty million bytes) — the same ceiling go-pdfkit/render
already uses, so the fleet has one number for this rather than two.

• ⛔ the embedded picture is refused from its header, via
  image.DecodeConfig, before anything is decoded: a ceiling enforced after
  the allocation it bounds is not a ceiling, it is a comment;
• ⛔ both products are computed in int64 — two numbers a file chose,
  multiplied in int on a 32-bit build, is how a ceiling is passed by
  overflowing past it (386 is in the build matrix);
• Scale counts towards it: the surface is the product, and only one of the
  two numbers is ours.

Also

A <line> whose two ends coincide was the module's single uncovered
statement, and the 100 % gate passed anyway because the total rounds up across
seven packages. ⛔ A gate that passes by rounding will one day pass over a real
gap. Closed.

100 % statement coverage, -race green, twelve CI checks across eight
architectures, four mutations against the ceilings all caught.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.