Bump @takumi-rs/core from 2.3.2 to 2.4.2

[dependabot]

Bumps @takumi-rs/core from 2.3.2 to 2.4.2.

Release notes

Sourced from @​takumi-rs/core's releases.

[email protected]

• @​takumi-rs/core@​2.4.2
• @​takumi-rs/helpers@​2.4.2
• @​takumi-rs/image-response@​2.4.2
• [email protected]
• @​takumi-rs/wasm@​2.4.2
• [email protected]

Stop copying Uint8Array font and image inputs on the native binding

Buffer inputs were already passed to render tasks as ref-counted views, but Uint8Array inputs went through a full to_vec copy first. Both now cross into the async tasks zero-copy; only bare ArrayBuffer inputs still copy.

Hand font and image bytes to the bindings as Uint8Array views

Fetched fonts and images flowed to the bindings as bare ArrayBuffers, which the native binding copies. Wrapping them in a Uint8Array view costs nothing and takes the zero-copy path.

[email protected]

• @​takumi-rs/core@​2.4.1
• @​takumi-rs/image-response@​2.4.1
• @​takumi-rs/wasm@​2.4.1
• [email protected]
• @​takumi-rs/helpers@​2.4.1
• [email protected]

[email protected]

• [email protected]
• @​takumi-rs/helpers@​2.4.0
• @​takumi-rs/image-response@​2.4.0
• @​takumi-rs/wasm@​2.4.0
• @​takumi-rs/core@​2.4.0
• [email protected]

Enforce allowUrl on every redirect hop

fetchOk with an allowUrl policy now follows redirects manually (capped at 5 hops) and re-checks the resolved target of each hop, so an allowed URL can no longer redirect to a blocked address. Callers without a policy keep default redirect handling.

Unify decoded resources behind one budgeted cache

Decoded images had a byte budget, but each SVG kept up to 32 rasterized pixmaps outside it, and every render re-parsed its stylesheets from scratch. ImageCache is now ResourceCache: SVG sources, their rasterized pixmaps, and parsed stylesheets all weigh against the same budget as decoded images. The default budget drops from 64 MiB to 16 MiB and becomes configurable — new Renderer({ cacheMaxBytes }) in the bindings, ResourceCache::new(max_bytes) in Rust, with 0 disabling caching. SVG rasters and parsed stylesheets now also survive across renders, so a server re-rendering the same template stops re-rasterizing and re-parsing per request. Rust callers: RenderOptions.stylesheet is now Arc<StyleSheet>; pass sheet.into().

Return an error for viewports too large to allocate

A viewport whose pixel buffer overflowed the backing allocation used to fall back to a 1x1 canvas, so the render produced a valid-looking but wrong tiny image with no error. The root canvas is now built through a fallible path that surfaces the allocation failure as an InvalidViewport error instead. Internal offscreen canvases keep their bounded sizes and are unaffected.

Blend animated WebP frames by default on the native binding

AnimatedWebpOptions::builder() left blend and dispose unset, so they fell back to false while the type's Default and the wasm backend use blend: true. Native animated WebP now alpha-blends frames over prior content like wasm does, so animations with partially transparent later frames render the same on both backends. The builder defaults are pinned to the Default values.

Convert native panics into catchable errors instead of aborting the process

... (truncated)

Changelog

Sourced from @​takumi-rs/core's changelog.

@​takumi-rs/core@​2.4.2

Stop copying Uint8Array font and image inputs on the native binding

Buffer inputs were already passed to render tasks as ref-counted views, but Uint8Array inputs went through a full to_vec copy first. Both now cross into the async tasks zero-copy; only bare ArrayBuffer inputs still copy.

@​takumi-rs/core@​2.4.0

Unify decoded resources behind one budgeted cache

Decoded images had a byte budget, but each SVG kept up to 32 rasterized pixmaps outside it, and every render re-parsed its stylesheets from scratch. ImageCache is now ResourceCache: SVG sources, their rasterized pixmaps, and parsed stylesheets all weigh against the same budget as decoded images. The default budget drops from 64 MiB to 16 MiB and becomes configurable — new Renderer({ cacheMaxBytes }) in the bindings, ResourceCache::new(max_bytes) in Rust, with 0 disabling caching. SVG rasters and parsed stylesheets now also survive across renders, so a server re-rendering the same template stops re-rasterizing and re-parsing per request. Rust callers: RenderOptions.stylesheet is now Arc<StyleSheet>; pass sheet.into().

Return an error for viewports too large to allocate

A viewport whose pixel buffer overflowed the backing allocation used to fall back to a 1x1 canvas, so the render produced a valid-looking but wrong tiny image with no error. The root canvas is now built through a fallible path that surfaces the allocation failure as an InvalidViewport error instead. Internal offscreen canvases keep their bounded sizes and are unaffected.

Blend animated WebP frames by default on the native binding

AnimatedWebpOptions::builder() left blend and dispose unset, so they fell back to false while the type's Default and the wasm backend use blend: true. Native animated WebP now alpha-blends frames over prior content like wasm does, so animations with partially transparent later frames render the same on both backends. The builder defaults are pinned to the Default values.

Convert native panics into catchable errors instead of aborting the process

The published napi artifacts are now built with unwind panics, so a Rust panic reached through malformed input surfaces as a JS error rather than killing the host process. Wasm keeps abort panics by design.

@​takumi-rs/core@​2.3.0

Accept raw RGBA pixels as an image source

An image node's src takes { width, height, data, premultiplied? } and renders the pixels without decoding; the Bitmap JSX helper wraps it as an <img>.

@​takumi-rs/core@​2.2.0

Extend the built-in Geist to weight 300

The embedded last-resort font covers wght 300..800 and trims unused stylistic sets, ending up slightly smaller than before.

Claim generic font families from the JS font API

Font descriptors accept generic (e.g. "monospace"), so stacks like Tailwind's font-mono resolve to registered fonts without naming the family.

@​takumi-rs/core@​2.0.2

Accept a promise in the fonts option

fonts now takes Promise<FontLoader[]> as well as the plain list, so googleFonts results pass straight through without await.

Extend the embedded font weight axis to 800

The embedded last-resort Geist subset now covers weights 400 to 800.

... (truncated)

Commits

• 35bf40d Version Packages (#1029)
• aace3f7 Chore: collapse napi buffer lowering, use native base64 in playground (#1028)
• 414d63b Chore: drop dead code, single-impl traits, and duplicated binding lowering (#...
• ea0bb64 Version Packages (#1025)
• 42951f3 Version Packages (#1002)
• 6f7bd48 Tests: add malformed binary input coverage at binding boundaries (#1008)
• f6b44d0 Core: unify decoded resources behind one budgeted cache (#1004)
• a6f42bb Bindings: trim takumi-bindings-common to shared lowering only (#1003)
• f3c3b92 Bindings: share font and stylesheet lowering across napi and wasm (#1001)
• 6839b60 Version Packages (#994)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)