From be4c0b23256c3e7c9d960e98682b547b3dc8833b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 00:30:32 +0000 Subject: [PATCH 1/4] deps: bump the go-deps group with 3 updates Bumps the go-deps group with 3 updates: [github.com/signintech/gopdf](https://github.com/signintech/gopdf), [golang.org/x/image](https://github.com/golang/image) and [golang.org/x/net](https://github.com/golang/net). Updates `github.com/signintech/gopdf` from 0.38.1 to 0.38.2 - [Changelog](https://github.com/signintech/gopdf/blob/master/Changelog.md) - [Commits](https://github.com/signintech/gopdf/compare/v0.38.1...v0.38.2) Updates `golang.org/x/image` from 0.46.0 to 0.47.0 - [Commits](https://github.com/golang/image/compare/v0.46.0...v0.47.0) Updates `golang.org/x/net` from 0.60.0 to 0.61.0 - [Commits](https://github.com/golang/net/compare/v0.60.0...v0.61.0) --- updated-dependencies: - dependency-name: github.com/signintech/gopdf dependency-version: 0.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: golang.org/x/image dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/net dependency-version: 0.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] --- go.mod | 10 +++++----- go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index b192d5b..095e09e 100644 --- a/go.mod +++ b/go.mod @@ -4,10 +4,10 @@ go 1.26.8 require ( github.com/microcosm-cc/bluemonday v1.0.27 - github.com/signintech/gopdf v0.38.1 + github.com/signintech/gopdf v0.38.2 github.com/spf13/cobra v1.10.2 - golang.org/x/image v0.46.0 - golang.org/x/net v0.60.0 + golang.org/x/image v0.47.0 + golang.org/x/net v0.61.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -18,6 +18,6 @@ require ( github.com/phpdave11/gofpdi v1.0.14-0.20211212211723-1f10f9844311 // indirect github.com/pkg/errors v0.8.1 // indirect github.com/spf13/pflag v1.0.9 // indirect - golang.org/x/sys v0.48.0 // indirect - golang.org/x/text v0.42.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/text v0.43.0 // indirect ) diff --git a/go.sum b/go.sum index 7a16fd7..938c7a5 100644 --- a/go.sum +++ b/go.sum @@ -12,21 +12,21 @@ github.com/phpdave11/gofpdi v1.0.14-0.20211212211723-1f10f9844311/go.mod h1:vBmV github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I= github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/signintech/gopdf v0.38.1 h1:mMdVMPKrvHCskYmjet/uTuXRAEV742oTM7GdFcuhuwM= -github.com/signintech/gopdf v0.38.1/go.mod h1:d23eO35GpEliSrF22eJ4bsM3wVeQJTjXTHq5x5qGKjA= +github.com/signintech/gopdf v0.38.2 h1:PeBwYjHfyRqjLUKxdnlCE6y/q2ekKlhYqa+wPtErNAY= +github.com/signintech/gopdf v0.38.2/go.mod h1:d23eO35GpEliSrF22eJ4bsM3wVeQJTjXTHq5x5qGKjA= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY= github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ= -golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew= -golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= -golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= -golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= -golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= +golang.org/x/image v0.47.0 h1:za/8gVz++PPZqmZJBNSISICN5Rrj5zixP/8K++fgmqo= +golang.org/x/image v0.47.0/go.mod h1:IkN5o4A7vq55vXN8FWjjnhg9Rs2GOtffqsSi9mWAKYE= +golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= +golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= From 80074fc2c488c1ca3196e512dfb4f6dabfc4378c Mon Sep 17 00:00:00 2001 From: Anna Veretennykova Date: Wed, 21 Oct 2026 11:29:21 +0300 Subject: [PATCH 2/4] test: regenerate golden.pdf for gopdf 0.38.2 --- internal/engine/testdata/golden.pdf | Bin 77482 -> 77620 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/internal/engine/testdata/golden.pdf b/internal/engine/testdata/golden.pdf index 93d94cd5814c7431ac129bd5462906c97201035b..4da5500cdde786c96544df6096c40f5f42a6c21d 100644 GIT binary patch delta 775 zcmZ`$u}T9`5G0W5O2xwNnky91-FuBxFUgv%j1D0NOXP3jhEB delta 643 zcmZvZKT1PE5XK3ldYzV5uX%+cGBZ1Wb}*K)u(9zRBBTwxV_12CG!a(t1{PKxKm{)# z2suDv493j5)$;NCW_P~t;e9xJ8{W@Hk#LtUm+) zY6=>?m}rOVS33(PlmH3}#q9*MV8yvt9BGw;66WYtO5WF^K} Date: Wed, 21 Oct 2026 11:29:21 +0300 Subject: [PATCH 3/4] build: raise Go floor to 1.26.10 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 095e09e..c68ec1d 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/annavetech/pdfengine -go 1.26.8 +go 1.26.10 require ( github.com/microcosm-cc/bluemonday v1.0.27 From 7ed7d80c403c9feb80c6147891a2b3ad893515f7 Mon Sep 17 00:00:00 2001 From: Anna Veretennykova Date: Wed, 21 Oct 2026 11:32:26 +0300 Subject: [PATCH 4/4] docs: Go 1.26.10 floor, dependency versions and changelog --- .tool-versions | 2 +- CHANGELOG.md | 6 ++++++ docs/CONTRIBUTING.md | 2 +- docs/DEPENDENCIES.md | 20 +++++++++++--------- 4 files changed, 19 insertions(+), 11 deletions(-) diff --git a/.tool-versions b/.tool-versions index 459141f..0767b00 100644 --- a/.tool-versions +++ b/.tool-versions @@ -1 +1 @@ -golang 1.26.8 +golang 1.26.10 diff --git a/CHANGELOG.md b/CHANGELOG.md index fc939cb..a4771e0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ Versioning follows [Semantic Versioning](https://semver.org/). ## [Unreleased] +### Changed +- `github.com/signintech/gopdf` is bumped to v0.38.2, which now emits `/CIDToGIDMap /Identity` in each embedded TrueType font dictionary; `internal/engine/testdata/golden.pdf` is regenerated to match. `golang.org/x/image` is bumped to v0.47.0 and `golang.org/x/net` to v0.61.0. + +### Security +- The Go floor is 1.26.10, which fixes GO-2026-6809 in crypto/x509. Release 1.4.0 declared Go 1.26.8 in `go.mod`. + --- ## [1.4.0] - 2026-10-14 diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index 1028dee..011b691 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -27,7 +27,7 @@ go test ./... go run ./cmd/pdfengine pdf convert README.md -o output.pdf ``` -Go 1.26.8 or later is required. +Go 1.26.10 or later is required. --- diff --git a/docs/DEPENDENCIES.md b/docs/DEPENDENCIES.md index e5167dc..7b6f16d 100644 --- a/docs/DEPENDENCIES.md +++ b/docs/DEPENDENCIES.md @@ -6,12 +6,12 @@ author: Anna Veretennykova website: www.annave.tech version: 1.4.0 created: 2026-05-06 -updated: 2026-08-23 +updated: 2026-10-21 --> # Dependencies -Go version: **1.26.8** (minimum). The engine uses `log/slog` (added in 1.21). The 1.26 minor comes from `golang.org/x/image` v0.46.0 and `golang.org/x/net` v0.59.0, both of which declare `go 1.26.0`. The patch level includes the standard library fixes for GO-2026-4601 (1.26.1) and GO-2026-6088 (1.26.6). +Go version: **1.26.10** (minimum). The engine uses `log/slog` (added in 1.21). The 1.26 minor comes from `golang.org/x/image` v0.47.0 and `golang.org/x/net` v0.61.0, both of which declare `go 1.26.0`. The patch level includes the standard library fixes for GO-2026-4601 (1.26.1), GO-2026-6088 (1.26.6) and GO-2026-6809 (1.26.10). All dependencies are listed in `go.mod`. Run `go mod verify` to confirm checksums match `go.sum`. @@ -19,7 +19,7 @@ All dependencies are listed in `go.mod`. Run `go mod verify` to confirm checksum ## Direct dependencies -### `github.com/signintech/gopdf v0.36.0` +### `github.com/signintech/gopdf v0.38.2` **Must be exactly v0.36.0 or higher within the v0 series.** @@ -29,7 +29,8 @@ PDF generation. The engine calls `pdf.GetBytesPdfReturnErr()` to obtain the PDF |---|---| | < v0.36.0 | Compile error: `GetBytesPdfReturnErr` undefined | | v0.36.0 | Confirmed working | -| v0.37+ | Unknown: compile succeeds; check PDF rendering output against the golden tests | +| v0.38.2 | Confirmed working | +| Other v0.37+ | Unknown: compile succeeds; check PDF rendering output against the golden tests | Upgrade path: run `go test ./internal/engine/...` after any gopdf upgrade. The engine test suite exercises rendering across all node types. A rendering regression will typically appear as a misplaced element or a panic. @@ -49,7 +50,7 @@ HTML sanitisation. Applied to input only when the format is `html` (explicit or --- -### `golang.org/x/image v0.23.0` +### `golang.org/x/image v0.47.0` Image format support for WebP decoding. The standard library `image` package handles PNG, JPEG, and GIF; WebP requires this extended package. @@ -61,18 +62,18 @@ import _ "golang.org/x/image/webp" | Version range | Result | |---|---| | Any v0.x | Should work: the `webp` package has a stable decode API | -| v0.23.0 | Confirmed working | +| v0.47.0 | Confirmed working | --- -### `golang.org/x/net v0.33.0` +### `golang.org/x/net v0.61.0` HTML parsing, used by `bluemonday` (indirect requirement). Also provides the `html` tokeniser that the HTML parser adapter uses directly. | Version range | Result | |---|---| | Any v0.x | Should work | -| v0.33.0 | Confirmed working | +| v0.61.0 | Confirmed working | --- @@ -112,7 +113,8 @@ These are required by direct dependencies but not imported directly by the engin | `github.com/phpdave11/gofpdi` | v1.0.14-0.20211212211723-1f10f9844311 | gopdf: PDF import | | `github.com/pkg/errors` | v0.8.1 | gopdf: error wrapping | | `github.com/spf13/pflag` | v1.0.9 | cobra: POSIX/GNU-style flag parsing | -| `golang.org/x/text` | v0.21.0 | golang.org/x/net: text encoding | +| `golang.org/x/sys` | v0.49.0 | golang.org/x/net, golang.org/x/image: module requirement | +| `golang.org/x/text` | v0.43.0 | golang.org/x/net: text encoding | ---