From 23fe77f0da33a43c0c0ef9053ccda8cc8a3477ae Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sun, 1 Nov 2026 09:02:11 +0100 Subject: [PATCH 1/2] Bump go-gfx/gfx to v0.37.0 gfx v0.36.2 makes the Netpbm/QOI decoders refuse headers larger than the file, v0.36.3 decodes .ico in-tree (no more go-ico memory bomb) and v0.37.0 makes codec.Decode / codec.DecodeBest refuse images above 40 Mpx from the header. go.mod and go.sum only; build, vet and tests pass. Co-Authored-By: Claude Opus 5.5 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 177612b..8f74ae5 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/go-plot/plot go 1.27.2 require ( - github.com/go-gfx/gfx v0.36.1 + github.com/go-gfx/gfx v0.37.0 github.com/go-ndarray/ndarray v0.28.0 github.com/go-opentype/fonts v0.14.0 github.com/go-opentype/opentype v0.16.1 diff --git a/go.sum b/go.sum index 5333192..1a784a7 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A= github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= -github.com/go-gfx/gfx v0.36.1 h1:dnqxna+69Hr5ioGadB2UDe6wrXeqwPOhqftr6YONgpQ= -github.com/go-gfx/gfx v0.36.1/go.mod h1:Tst3pkyuqFV13Ab98WZVxgJmFN4GZtTKoqwRkBZKko8= +github.com/go-gfx/gfx v0.37.0 h1:nQH23BtuJ1pqXqvg0s7FHSI1c/ewg9nnBl3Nc3cYCik= +github.com/go-gfx/gfx v0.37.0/go.mod h1:4OenoKrgdht6UXYf5SV8w2tb41hfAdy4QoxJRPsRDz4= github.com/go-ndarray/ndarray v0.28.0 h1:9RWfw01uRUH1YqsVUpNllm01XEohqdSfsk4Kw0x18VA= github.com/go-ndarray/ndarray v0.28.0/go.mod h1:bDbGWswQLmTMh6V3LwvKUbpfHzeG4sZDcvuGnA0GC+s= github.com/go-opentype/fonts v0.14.0 h1:WHw7k9gkHT1pu9B2yyvd0FWyQqn/4NKFQoKhvMYt3Mo= From adf5aa798ffe57878e3ab9ec5c40a0b127e482df Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sun, 1 Nov 2026 09:04:35 +0100 Subject: [PATCH 2/2] benchmarks: go mod tidy for the gfx v0.37.0 bump The nested benchmarks module replaces the parent with ../, so its go.mod must follow the parent's requirements; CI vets it. Co-Authored-By: Claude Opus 5.5 --- tools/compare/go.mod | 2 +- tools/compare/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/compare/go.mod b/tools/compare/go.mod index 486ad3f..e50764e 100644 --- a/tools/compare/go.mod +++ b/tools/compare/go.mod @@ -9,7 +9,7 @@ require ( require ( github.com/andybalholm/brotli v1.2.7 // indirect - github.com/go-gfx/gfx v0.36.1 // indirect + github.com/go-gfx/gfx v0.37.0 // indirect github.com/go-opentype/fonts v0.14.0 // indirect github.com/go-opentype/opentype v0.16.1 // indirect github.com/go-tex/math v0.50.0 // indirect diff --git a/tools/compare/go.sum b/tools/compare/go.sum index 5333192..1a784a7 100644 --- a/tools/compare/go.sum +++ b/tools/compare/go.sum @@ -1,7 +1,7 @@ github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A= github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= -github.com/go-gfx/gfx v0.36.1 h1:dnqxna+69Hr5ioGadB2UDe6wrXeqwPOhqftr6YONgpQ= -github.com/go-gfx/gfx v0.36.1/go.mod h1:Tst3pkyuqFV13Ab98WZVxgJmFN4GZtTKoqwRkBZKko8= +github.com/go-gfx/gfx v0.37.0 h1:nQH23BtuJ1pqXqvg0s7FHSI1c/ewg9nnBl3Nc3cYCik= +github.com/go-gfx/gfx v0.37.0/go.mod h1:4OenoKrgdht6UXYf5SV8w2tb41hfAdy4QoxJRPsRDz4= github.com/go-ndarray/ndarray v0.28.0 h1:9RWfw01uRUH1YqsVUpNllm01XEohqdSfsk4Kw0x18VA= github.com/go-ndarray/ndarray v0.28.0/go.mod h1:bDbGWswQLmTMh6V3LwvKUbpfHzeG4sZDcvuGnA0GC+s= github.com/go-opentype/fonts v0.14.0 h1:WHw7k9gkHT1pu9B2yyvd0FWyQqn/4NKFQoKhvMYt3Mo=