Skip to content

fix(deps): update dependencies - #48

Open
tannevaled wants to merge 1 commit into
mainfrom
renovate/deps
Open

tannevaled wants to merge 1 commit into
mainfrom
renovate/deps

Conversation

@tannevaled

@tannevaled tannevaled commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
github.com/go-embedded-ruby/ruby v0.6.1 → v0.8.3 age confidence indirect minor
github.com/go-fleettools/landingkit v0.7.0 → v0.14.0 age confidence require minor
github.com/go-widgets/toolkit v0.329.0 → v0.345.2 age confidence require minor
hugo 0.168.0 → 0.169.0 age confidence uses-with minor

Release Notes

go-embedded-ruby/ruby (github.com/go-embedded-ruby/ruby)

v0.8.3

Compare Source

What's Changed

Full Changelog: go-embedded-ruby/ruby@v0.8.2...v0.8.3

v0.8.2

Compare Source

What's Changed

Full Changelog: go-embedded-ruby/ruby@v0.8.1...v0.8.2

v0.8.1: — a missing argument is MRI's error, not a Go panic

Compare Source

One commit since v0.8.0: the arity fix (#​824), closing #​820.

A missing argument is MRI's error again, not a Go panic

31 methods across FFT and Image read their arguments by index without checking how many they had been given. A call with too few arguments indexed past the end of the slice, and the Go panic was recovered and re-raised as an ArgumentError — the right class, by accident, with a message that came from Go's runtime rather than from Ruby.

FFT.fft                 # before: a recovered index-out-of-range
                        # now:    ArgumentError, MRI's wording and arity

The fix puts the arity at the registration site, so it cannot be forgotten when a method is added:

def("fft", 1, 1, func(...) {...})
def("fftfreq", 1, 2, ...)       // n, and an optional sample spacing
def("spectrogram", 4, 5, ...)

Ranges are real optional arguments, not slack: Image#set is 5, 6.

Two tests, because Image is not in every build

Image is excluded from the rbgo_core build and FFT is not, so a single test naming both went red on the core lane. They are split by build tag, and each counts what it walked — 3 and 34, 17 methods — so a census that silently stopped finding methods would fail rather than pass quietly. Verified under both tags: 23 tests on the default build, 6 on rbgo_core, no "no tests to run".

Known, and already in flight

The README's BigDecimal entry lists sqrt, which is not bound — BigDecimal("2.0").sqrt(0) raises NoMethodError. That is older than this release and is corrected in #​826; the method itself is #​825, and the gap is upstream, in go-ruby-bigdecimal/bigdecimal, which has no square root at all.

Measured on 664fcfe with all 10 lanes green.

v0.8.0

Compare Source

What's Changed

  • Embedding API: an Interp that keeps state, exchanges values with Go, and lets Go define Ruby by @​tannevaled in #​823

Full Changelog: go-embedded-ruby/ruby@v0.7.0...v0.8.0

v0.7.0

Compare Source

What's Changed

  • Special, Stats, Integrate, Optimize: go-numerics and go-statistics as cgo-free scipy-style modules by @​tannevaled in #​819

Full Changelog: go-embedded-ruby/ruby@v0.6.1...v0.7.0

go-fleettools/landingkit (github.com/go-fleettools/landingkit)

v0.14.0

Compare Source

What's Changed

Full Changelog: go-fleettools/landingkit@v0.13.0...v0.14.0

v0.13.0

Compare Source

What's Changed

Full Changelog: go-fleettools/landingkit@v0.12.0...v0.13.0

v0.12.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-26.

Commits since v0.11.0:

  • 23b20da LoadingCarousel: the loading carousel for a page Hugo does not build (#​21)

v0.11.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-26.

Commits since v0.10.0:

  • 95223aa hero-carousel: more than one terminal card (terminal = "") (#​20)

v0.10.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-26.

Commits since v0.9.0:

  • 774de89 icons/browser.html: the icon of the red button (v0.10.0) (#​19)

v0.9.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-26.

Commits since v0.8.0:

v0.8.0

Compare Source

Languages: per-language partial strings (i18n kit_* keys, en fr de es zh ko ja), a language selector, hreflang and lang. A single-language site renders byte for byte as before.

v0.7.1

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-24.

Commits since v0.7.0:

go-widgets/toolkit (github.com/go-widgets/toolkit)

v0.345.2

Compare Source

What's Changed

  • fix(entry): a masked Entry keeps its secret from the a11y tree and clipboard by @​tannevaled in #​514

Full Changelog: go-widgets/toolkit@v0.345.1...v0.345.2

v0.345.1

Compare Source

Text-only programs no longer link net/http (#​513)

go-opentype now inflates WOFF2 with the decoder-only dsnet/compress/brotli (go-opentype/opentype#55). The previous decoder, andybalholm/brotli, imports net/http from its root package, so every toolkit program linked net/http, crypto/tls and their init-time self-tests.

one Label, js/wasm, -s -w raw gzip -9
v0.345.0 7.48 MB 2.13 MB
v0.345.1 5.66 MB 1.61 MB

The inflate is now bounded by the size the WOFF2 directory declares, so a decompression bomb is refused. The trade-off: WOFF2 inflates about 1.37× slower, roughly 0.4 ms per 200 KB font.

v0.345.0

Compare Source

Link only what a program uses (#​511)

A program now links far less of what it never uses. Measured on GOOS=js GOARCH=wasm with -ldflags="-s -w":

program before after
one Label 10.49 MB (2.88 MB gzip) 7.48 MB (2.13 MB gzip)
go-wasmcontainers/dashboard 20.42 MB (5.17 MB gzip) 17.72 MB (4.58 MB gzip)
go-wasmcontainers/relay flow map 22.62 MB (5.44 MB gzip) 19.95 MB (4.85 MB gzip)
Breaking
  • CollabText, NewCollabText, MetaName and MetaColor moved to github.com/go-widgets/toolkit/collabui. There is no deprecated forwarder, because a forwarder would bring back the import this release removes. To migrate, change toolkit.NewCollabText to collabui.NewCollabText. No module in the fleet used it.
Changed
  • Material and Thumbnail now use the codec-free github.com/go-images/images/ops, so the image decoders are no longer linked. That saves about 1.7 MB of wasm code.
  • The e-mail Rule regexp, the built-in iso icon registry and the RichEditorToolbar button table are now built the first time they are used, not by package initializers. toolkit.init now reaches nothing.
Added
  • ColorHex and ParseColorHex, which convert between a colour and its #rrggbbaa string.

v0.344.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.343.1...v0.344.0

v0.343.1

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.343.0...v0.343.1

v0.343.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.342.0...v0.343.0

v0.342.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.341.0...v0.342.0

v0.341.0

Compare Source

What's Changed

Full Changelog: go-widgets/toolkit@v0.340.0...v0.341.0

v0.340.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-23.

Commits since v0.339.0:

  • 12856eb Ribbon: RibbonGrid, a size picker (Table: columns by rows) (#​504)

v0.339.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-23.

Commits since v0.338.0:

  • 3d28543 Splitter: N panes with draggable, focusable dividers (WAI-ARIA window splitter) (#​503)

v0.338.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.337.0:

v0.337.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.336.0:

v0.336.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.335.0:

v0.335.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.334.0:

v0.334.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.333.1:

  • 5caf4a9 feat: Ribbon, an Office-style command ribbon (tabs, groups, large and small controls) (#​499)

v0.333.1

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.333.0:

  • 38365ac fix: a pressed ToggleButton draws its label in the accent ink (#​497)

v0.333.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.332.0:

  • 5ad4087 feat: minimap ticks for search matches wear the highlight colour (MinimapMark.Color) (#​496)

v0.332.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.331.0:

  • 85fb18e feat: PageStrip, a virtualised strip of page thumbnails (#​495)

v0.331.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.330.0:

  • 88707dc feat: minimap for CodeEditor (TextView.ShowMinimap), with line marks (#​494)

v0.330.0

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-22.

Commits since v0.329.1:

  • 1f40ab6 feat: scrollbars (vertical and horizontal) for TextView and CodeEditor (#​493)

v0.329.1

Compare Source

Release backfilled on 2026-10-26; tag created 2026-10-21.

Commits since v0.329.0:

gohugoio/hugo (hugo)

v0.169.0

Compare Source

The main motivation behind this release is to get out a build with Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the eMudhra incident for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. resources.GetRemote.

This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via .Params (also below), a faster and more robust plainify, and a set of bug fixes.

Security notes

Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML:

  • pre and post values in menu entries defined in front matter are now HTML escaped, unless text/html is allowed in security.allowContent, which already marks HTML in /content as trusted. A warning (warning-menu-pre-post-html-escaped) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. f63482b
  • emojify and plainify now return a string unless the input is template.HTML, in which case the result is also template.HTML. Previously both always returned template.HTML, so e.g. {{ .Title | emojify }} would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through safeHTML. Thanks to @​Reload3d for reporting this. #​15452
Deprecations

Reserved front matter fields such as title, date and summary are currently also stored in .Params. Lookups such as .Params.title (and ByParam "title", where .Pages "Params.title" ... etc.) are now redirected to the corresponding Page method and logged as deprecated, unless the field was set in the params section of front matter. The content of .Params is unchanged for now. 53e1fef

Deprecated Use instead
.Params.date .Date
.Params.description .Description
.Params.draft .Draft
.Params.expirydate .ExpiryDate
.Params.keywords .Keywords
.Params.lastmod .Lastmod
.Params.layout .Layout
.Params.linktitle .LinkTitle
.Params.publishdate .PublishDate
.Params.slug .Slug
.Params.summary .RawSummary (new)
.Params.title .Title
.Params.translationkey .TranslationKey
.Params.type .Type
.Params.weight .Weight
Bug fixes
Improvements
Dependency Updates

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@tannevaled
tannevaled force-pushed the renovate/deps branch 3 times, most recently from 849fd5c to 039a03f Compare October 21, 2026 18:09
@tannevaled

tannevaled commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: playground/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
github.com/go-gfx/gfx v0.35.0 -> v0.36.1
github.com/go-images/images v0.1.0 -> v0.1.1-0.20261026203936-4ac989d310a1
github.com/go-richdoc/richdoc v0.6.0 -> v0.7.0
File name: playground/rubywasm/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
github.com/go-ruby-chronic/chronic v0.0.0-20260916091614-bd47d560b6f4 -> v0.1.0

@tannevaled
tannevaled force-pushed the renovate/deps branch 5 times, most recently from 379c70c to 806e15c Compare October 26, 2026 19:25

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant