[dependabot]

Bumps opentype.js from 1.3.4 to 2.0.0.

Release notes

Sourced from opentype.js's releases.

2.0.0

What's Changed

• Add COLRv0 + CPALv0 support by @​yne in opentypejs/opentype.js#490
• Fix cpal arguments by @​yne in opentypejs/opentype.js#508
• Update to use Buffer.alloc in place of deprecated new Buffer() by @​pwagland in opentypejs/opentype.js#474
• Redefine deltaGlyphId from USHORT to SHORT according to spec in opentypejs/opentype.js#456
• add tests for parsing lookup type 6 formats 1 and 3 by @​Connum in opentypejs/opentype.js#454
• Add option for leftSideBearing in new Glyph by @​adri326 in opentypejs/opentype.js#510
• Replaced concat with push for performance by @​Balearica in opentypejs/opentype.js#513
• Don't attempt to parse meta table tags "appl" and "bild". Fixes #522 by @​graphicore in opentypejs/opentype.js#523
• Gracefully handle unsupported WOFF2 parsing by @​yne in opentypejs/opentype.js#518
• Bump json5 from 2.2.0 to 2.2.3 by @​dependabot[bot] in opentypejs/opentype.js#537
• Bump minimist and rollup-plugin-license by @​dependabot[bot] in opentypejs/opentype.js#543
• font inspector: fix headline floating when table section with "Undefined" is expanded by @​Connum in opentypejs/opentype.js#545
• Preserve platform specific names in fonts. by @​ILOVEPIE in opentypejs/opentype.js#542
• make jshint and jscs ignore the /.git folder by @​Connum in opentypejs/opentype.js#549
• Bump dependencies by @​Connum in opentypejs/opentype.js#550
• create post table from existing data if available by @​cthorner in opentypejs/opentype.js#530
• log warning instead of throwing an error when encountering an unknown ClassDef format by @​Connum in opentypejs/opentype.js#548
• Fixed code style issue. by @​ILOVEPIE in opentypejs/opentype.js#555
• mark as side effect free by @​hipstersmoothie in opentypejs/opentype.js#531
• make cffEncoding.charset fall back to CIDs instead of undefined by @​Connum in opentypejs/opentype.js#562
• Set correctly unicode 0 to ".null" glyph by @​puria in opentypejs/opentype.js#461
• GSUB writing support for lookup type 5 by @​Connum in opentypejs/opentype.js#566
• adding stringToGlyphIndexes() by @​axkibe in opentypejs/opentype.js#575
• optimize performance by replacing modulus with bitwise operator by @​Connum in opentypejs/opentype.js#572
• Auto test + deploy using Github Action by @​yne in opentypejs/opentype.js#567
• Fix Illegal Invocation in npm start Hot Reload by @​yne in opentypejs/opentype.js#578
• GSUB lookup table type 7 subtable format 1 by @​CTOStone in opentypejs/opentype.js#486
• Parsing and writing support for variable font tables fvar, STAT and avar by @​Connum in opentypejs/opentype.js#576
• add missing import file extensions, add @​TODO comments for refactoring by @​Connum in opentypejs/opentype.js#582
• implement CFF2 parsing by @​Connum in opentypejs/opentype.js#580
• Parse cmap table format 14 and handle Unicode Variation Sequences (UVSes) by @​Connum in opentypejs/opentype.js#581
• SVG-related improvements and fixes by @​Connum in opentypejs/opentype.js#569
• feat: Added a thai context to the bidi and substitution features by @​rafallyczkowskiadylic in opentypejs/opentype.js#535
• check if command exists in subpath before comparing values by @​Connum in opentypejs/opentype.js#585
• added local rule for banning forEach(), replace forEach() with for() by @​Connum in opentypejs/opentype.js#584
• Add WOFF2 loading support to demo pages by @​yne in opentypejs/opentype.js#591
• gasp table by @​ollimeier in opentypejs/opentype.js#595
• fix(glyph): Resolve the problem of invalid unicodes input parameters by @​sammyfeng0530 in opentypejs/opentype.js#608
• Update README.md by @​Zearin in opentypejs/opentype.js#600
• add tests for and fix #613, test toDOMElement() via mocked elements by @​Connum in opentypejs/opentype.js#621
• change npm start command to output module version by @​Connum in opentypejs/opentype.js#625
• bump all dependency versions except mocha by @​Connum in opentypejs/opentype.js#629
• add tests for LONGDATETIME parsing/encoding by @​Connum in opentypejs/opentype.js#631
• chore: Create dependabot.yml by @​Jolg42 in opentypejs/opentype.js#636
• Bump eslint from 8.52.0 to 8.53.0 by @​dependabot[bot] in opentypejs/opentype.js#637
• chore: Update README.md by @​Jolg42 in opentypejs/opentype.js#639
• handle endchar command with seac parameters (standard encoding accented characters) by @​Connum in opentypejs/opentype.js#633
• fix hasChar() for CMAP fonts and add tests (fix #330) by @​Connum in opentypejs/opentype.js#632

... (truncated)

Commits

• e2eaede Merge pull request #833 from opentypejs/cursor/use-trusted-npm-publishing
• 44e9523 Use Node 24 for npm releases
• c500ded Use trusted npm publishing for releases
• f2cb527 Bump GitHub Actions JavaScript actions to v5.
• bd60958 Merge pull request #832 from opentypejs/cursor/harden-release-workflow
• c2c6baf Harden release workflow
• cf02e12 Merge pull request #824 from fjobeir/master
• 7b85ca3 reverse changes on package-lock.json
• 658d9c3 Remove version from package-lock.json
• 478a12a fix: remove version from PR
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for opentype.js since your current version.

✅ Low: The change is an exact-pinned Dependabot bump. package.json, bun.lock and CREDITS.md all name 2.0.0 and agree with each other. The lockfile drops the two transitive deps that 1.3.4 needed and 2.0.0 does not. The only consumer, sketch.mjs, calls require('opentype.js') and opentype.parse, and the stated verification showed byte-identical output on all five example scenes at the parent and the head.

Updates from git push no-mistakes

[mdsmithaustin]

@dependabot rebase

[mdsmithaustin]

Verdict: PASS+NOTES
Head: 87ab693
Patch-id: 0099019e5787e58602442ab8c8dfd4081b90004b
Docs: needs changes

Independent shipping check of opentype.js 1.3.4 to 2.0.0 in skills/pr-recap/scripts/sketch, comparing parent 0bc7cf93 with this head.

What I rendered. In clean copies of both commits, bun install --frozen-lockfile passed: 10 packages at the parent, 8 at the head. Each copy then ran bun sketch.mjs on all five scenes in skills/pr-recap/references/examples/.

Parent against head. Every result is identical.

• Exit codes are 0 for all five scenes on both sides.
• The JSON reports are byte-identical, with no problems and no overlaps.
• The PNGs are byte-identical: each scene has the same SHA-256 on both sides, so the pixels match. I viewed flow and check side by side, and they look the same.
• The report does not list measured boxes, so I wrapped the font in a probe that recorded every call draw() makes. All 1,077 calls (60 to getAdvanceWidth, 1,017 to charToGlyphIndex) return the same values. unitsPerEm (1000), ascender (886), descender (-374) and the glyph count (217) match. A wider sweep of 1,394 code points, 5,184 two-character pairs and 11 strings also matches.
• bun test ../../../../tests/skills/pr-recap passes 24 of 24 at the head, the same as at the parent. CI is green.

Notes:

1. Line 72 of skills/pr-recap/CREDITS.md still says opentype.js 1.3.4, but line 69 says the list matches the pins in package.json. Change that line to opentype.js 2.0.0, MIT License, https://github.com/opentypejs/opentype.js. The licence is still MIT, per both the registry's license field and the shipped LICENSE file. No other doc names 1.3.4. references/sketch.md names opentype.js without a version.
2. The APIs the tool calls behave the same, per the probe above: opentype.parse on an ArrayBuffer, getAdvanceWidth, charToGlyphIndex, unitsPerEm, ascender and descender. require('opentype.js') still resolves through main to the UMD bundle dist/opentype.js, because the package has no exports map. One 2.0.0 change does not affect the tool. opentype.load and loadSync are now stubs that only log a deprecation, so new code must keep using parse.
3. string.prototype.codepointat and tiny-inflate leave the lockfile because 2.0.0 has no runtime dependencies. The sha512 in bun.lock matches the registry's dist.integrity for 2.0.0. The package has no install lifecycle scripts. The registry shows that GitHub Actions published it with a provenance attestation. I checked that the attestation exists but did not verify its signature.

[mdsmithaustin]

Verdict: PASS+NOTES
Head: 74cbb32
Patch-id: cdcbf0b40350ee8ca7cfae5d38439cb3ff6fe10c
Docs: pass

This re-verifies the PR at its new head and replaces the earlier verdict for 87ab693f. The only new commit, 74cbb325, changes line 72 of skills/pr-recap/CREDITS.md from opentype.js 1.3.4 to opentype.js 2.0.0.

Base. gh reports the PR base as 0bc7cf93. Main is now at 8846421a (#305), which touches watch-pr and one line of the pr-recap skill but not the sketch tool. The merge-base is 0bc7cf93 either way, so git diff <base>...74cbb325 | git patch-id --stable gives the same patch-id for both.

What I reran. In a clean copy of 74cbb325, bun install --frozen-lockfile passed with 8 packages. All five example scenes rendered with exit 0. Every PNG and JSON report is byte-identical to the parent 0bc7cf93 renders from the first check. bun test ../../../../tests/skills/pr-recap passes 24 of 24. CI on this head is green, including CodeQL.

Docs. CREDITS.md now lists Rough.js 4.6.6, opentype.js 2.0.0 and resvg-js 2.6.2, which match the three pins in scripts/sketch/package.json. The licence is still MIT. No file in the repo names 1.3.4 any more.

Notes:

1. The earlier API and lockfile checks still hold, because 74cbb325 touches only CREDITS.md. In 2.0.0, opentype.load and loadSync are stubs that only log a deprecation, so new sketch code must keep calling parse.
2. I checked that the registry lists a provenance attestation for opentype.js 2.0.0 but did not verify its signature.