annaveretennykova · Oct 21, 2026 · Oct 19, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026
@@ -1 +1 @@
-golang 1.26.8
+golang 1.26.10
@@ -7,6 +7,12 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Changed
+- `github.com/signintech/gopdf` is bumped to v0.38.2, which now emits `/CIDToGIDMap /Identity` in each embedded TrueType font dictionary; `internal/engine/testdata/golden.pdf` is regenerated to match. `golang.org/x/image` is bumped to v0.47.0 and `golang.org/x/net` to v0.61.0.
+
+### Security
+- The Go floor is 1.26.10, which fixes GO-2026-6809 in crypto/x509. Release 1.4.0 declared Go 1.26.8 in `go.mod`.
+
 ---
 
 ## [1.4.0] - 2026-10-14

@@ -27,7 +27,7 @@ go test ./...
 go run ./cmd/pdfengine pdf convert README.md -o output.pdf
 ```
 
-Go 1.26.8 or later is required.
+Go 1.26.10 or later is required.
 
 ---
 

@@ -6,20 +6,20 @@ author:      Anna Veretennykova
 website:     www.annave.tech
 version:     1.4.0
 created:     2026-05-06
-updated:     2026-08-23
+updated:     2026-10-21
 -->
 
 # Dependencies
 
-Go version: **1.26.8** (minimum). The engine uses `log/slog` (added in 1.21). The 1.26 minor comes from `golang.org/x/image` v0.46.0 and `golang.org/x/net` v0.59.0, both of which declare `go 1.26.0`. The patch level includes the standard library fixes for GO-2026-4601 (1.26.1) and GO-2026-6088 (1.26.6).
+Go version: **1.26.10** (minimum). The engine uses `log/slog` (added in 1.21). The 1.26 minor comes from `golang.org/x/image` v0.47.0 and `golang.org/x/net` v0.61.0, both of which declare `go 1.26.0`. The patch level includes the standard library fixes for GO-2026-4601 (1.26.1), GO-2026-6088 (1.26.6) and GO-2026-6809 (1.26.10).
 
 All dependencies are listed in `go.mod`. Run `go mod verify` to confirm checksums match `go.sum`.
 
 ---
 
 ## Direct dependencies
 
-### `github.com/signintech/gopdf v0.36.0`
+### `github.com/signintech/gopdf v0.38.2`
 
 **Must be exactly v0.36.0 or higher within the v0 series.**
 
@@ -29,7 +29,8 @@ PDF generation. The engine calls `pdf.GetBytesPdfReturnErr()` to obtain the PDF
 |---|---|
 | < v0.36.0 | Compile error: `GetBytesPdfReturnErr` undefined |
 | v0.36.0 | Confirmed working |
-| v0.37+ | Unknown: compile succeeds; check PDF rendering output against the golden tests |
+| v0.38.2 | Confirmed working |
+| Other v0.37+ | Unknown: compile succeeds; check PDF rendering output against the golden tests |
 
 Upgrade path: run `go test ./internal/engine/...` after any gopdf upgrade. The engine test suite exercises rendering across all node types. A rendering regression will typically appear as a misplaced element or a panic.
 
@@ -49,7 +50,7 @@ HTML sanitisation. Applied to input only when the format is `html` (explicit or
 
 ---
 
-### `golang.org/x/image v0.23.0`
+### `golang.org/x/image v0.47.0`
 
 Image format support for WebP decoding. The standard library `image` package handles PNG, JPEG, and GIF; WebP requires this extended package.
 
@@ -61,18 +62,18 @@ import _ "golang.org/x/image/webp"
 | Version range | Result |
 |---|---|
 | Any v0.x | Should work: the `webp` package has a stable decode API |
-| v0.23.0 | Confirmed working |
+| v0.47.0 | Confirmed working |
 
 ---
 
-### `golang.org/x/net v0.33.0`
+### `golang.org/x/net v0.61.0`
 
 HTML parsing, used by `bluemonday` (indirect requirement). Also provides the `html` tokeniser that the HTML parser adapter uses directly.
 
 | Version range | Result |
 |---|---|
 | Any v0.x | Should work |
-| v0.33.0 | Confirmed working |
+| v0.61.0 | Confirmed working |
 
 ---
 
@@ -112,7 +113,8 @@ These are required by direct dependencies but not imported directly by the engin
 | `github.com/phpdave11/gofpdi` | v1.0.14-0.20211212211723-1f10f9844311 | gopdf: PDF import |
 | `github.com/pkg/errors` | v0.8.1 | gopdf: error wrapping |
 | `github.com/spf13/pflag` | v1.0.9 | cobra: POSIX/GNU-style flag parsing |
-| `golang.org/x/text` | v0.21.0 | golang.org/x/net: text encoding |
+| `golang.org/x/sys` | v0.49.0 | golang.org/x/net, golang.org/x/image: module requirement |
+| `golang.org/x/text` | v0.43.0 | golang.org/x/net: text encoding |
 
 ---
 

@@ -1,13 +1,13 @@
 module github.com/annavetech/pdfengine
 
-go 1.26.8
+go 1.26.10
 
 require (
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/signintech/gopdf v0.38.1
+	github.com/signintech/gopdf v0.38.2
 	github.com/spf13/cobra v1.10.2
-	golang.org/x/image v0.46.0
-	golang.org/x/net v0.60.0
+	golang.org/x/image v0.47.0
+	golang.org/x/net v0.61.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -18,6 +18,6 @@ require (
 	github.com/phpdave11/gofpdi v1.0.14-0.20211212211723-1f10f9844311 // indirect
 	github.com/pkg/errors v0.8.1 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
-	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 )
@@ -12,21 +12,21 @@ github.com/phpdave11/gofpdi v1.0.14-0.20211212211723-1f10f9844311/go.mod h1:vBmV
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/signintech/gopdf v0.38.1 h1:mMdVMPKrvHCskYmjet/uTuXRAEV742oTM7GdFcuhuwM=
-github.com/signintech/gopdf v0.38.1/go.mod h1:d23eO35GpEliSrF22eJ4bsM3wVeQJTjXTHq5x5qGKjA=
+github.com/signintech/gopdf v0.38.2 h1:PeBwYjHfyRqjLUKxdnlCE6y/q2ekKlhYqa+wPtErNAY=
+github.com/signintech/gopdf v0.38.2/go.mod h1:d23eO35GpEliSrF22eJ4bsM3wVeQJTjXTHq5x5qGKjA=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ=
-golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew=
-golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/image v0.47.0 h1:za/8gVz++PPZqmZJBNSISICN5Rrj5zixP/8K++fgmqo=
+golang.org/x/image v0.47.0/go.mod h1:IkN5o4A7vq55vXN8FWjjnhg9Rs2GOtffqsSi9mWAKYE=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-Original file line number
+Diff line change
@@ Expand Up / @@ -27,7 +27,7 @@ go test ./... @@
     go run ./cmd/pdfengine pdf convert README.md -o output.pdf
     ```
-    Go 1.26.8 or later is required.
+    Go 1.26.10 or later is required.
     ---
@@ Expand Down @@