chore(deps): update dependency @takumi-rs/core to v2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@takumi-rs/core (source)	^1.7.0 → ^2.0.0

---

Release Notes

kane50613/takumi (@​takumi-rs/core)

v2.4.0

Unify decoded resources behind one budgeted cache

Decoded images had a byte budget, but each SVG kept up to 32 rasterized pixmaps outside it, and every render re-parsed its stylesheets from scratch. ImageCache is now ResourceCache: SVG sources, their rasterized pixmaps, and parsed stylesheets all weigh against the same budget as decoded images. The default budget drops from 64 MiB to 16 MiB and becomes configurable — new Renderer({ cacheMaxBytes }) in the bindings, ResourceCache::new(max_bytes) in Rust, with 0 disabling caching. SVG rasters and parsed stylesheets now also survive across renders, so a server re-rendering the same template stops re-rasterizing and re-parsing per request. Rust callers: RenderOptions.stylesheet is now Arc<StyleSheet>; pass sheet.into().

Return an error for viewports too large to allocate

A viewport whose pixel buffer overflowed the backing allocation used to fall back to a 1x1 canvas, so the render produced a valid-looking but wrong tiny image with no error. The root canvas is now built through a fallible path that surfaces the allocation failure as an InvalidViewport error instead. Internal offscreen canvases keep their bounded sizes and are unaffected.

Blend animated WebP frames by default on the native binding

AnimatedWebpOptions::builder() left blend and dispose unset, so they fell back to false while the type's Default and the wasm backend use blend: true. Native animated WebP now alpha-blends frames over prior content like wasm does, so animations with partially transparent later frames render the same on both backends. The builder defaults are pinned to the Default values.

Convert native panics into catchable errors instead of aborting the process

The published napi artifacts are now built with unwind panics, so a Rust panic reached through malformed input surfaces as a JS error rather than killing the host process. Wasm keeps abort panics by design.

v2.3.0

Accept raw RGBA pixels as an image source

An image node's src takes { width, height, data, premultiplied? } and renders the pixels without decoding; the Bitmap JSX helper wraps it as an <img>.

v2.2.0

Extend the built-in Geist to weight 300

The embedded last-resort font covers wght 300..800 and trims unused stylistic sets, ending up slightly smaller than before.

Claim generic font families from the JS font API

Font descriptors accept generic (e.g. "monospace"), so stacks like Tailwind's font-mono resolve to registered fonts without naming the family.

v2.0.2

Accept a promise in the fonts option

fonts now takes Promise<FontLoader[]> as well as the plain list, so
googleFonts results pass straight through without await.

Extend the embedded font weight axis to 800

The embedded last-resort Geist subset now covers weights 400 to 800.

v2.0.0

Make the embedded font a true last resort

Both bindings now embed one font: a Latin Geist subset with a 400 to 700
weight axis (Geist Mono and Manrope are gone). It no longer claims the
sans-serif generic family and always sorts after registered fonts in
fallback selection, so generic families and unstyled text resolve to the fonts
you load. The new FontResource::last_resort marks a font's families to sort
after every normal registration.

Cap animation frame rate per format

Browsers clamp any animation frame of 10ms or less to 100ms, so a high frame
rate stalls instead of playing fast. write_animation now rejects a frame rate
above AnimationFormat::max_fps with the new AnimationFrameRateTooHigh error:
90 fps for WebP and APNG, 50 fps for GIF (centisecond delays). The napi and WASM
renderAnimation bindings surface the error.

Apply structured keyframes in renderAnimation

renderAnimation accepted a keyframes option but never registered it, so
structured keyframes animated with render yet stayed static in animations. It
now extends the stylesheet with them like the other entry points.

Fix buffer pool bucket capacity invariant

Release now buckets a buffer by the floor power of two its capacity guarantees,
and acquire_dirty reserves before set_len. A pooled buffer can no longer be
lengthened past its allocation.

Skip mask copies and per-pixel mask lookups in canvas fast paths

Borrow the combined constraint mask directly when it already matches the
canvas viewport instead of copying it per draw, and hoist mask lookups out of
the per-pixel blit loops. Output is unchanged.

Make subset-group font selection deterministic

Subsets registered under one logical family (via FontResource::subset_of) were kept
in registration order. Callers commonly register fonts concurrently, so that order — and
therefore which subset won for a codepoint covered by more than one (e.g. overlapping
weight subsets, where the loser is faux-bolded) — varied per process. Identical input
could render to different bytes run to run.

Subsets are now held in a BTreeSet, ordered by their family name, so expansion and
selection no longer depend on registration timing. Same input renders identically.

Shrink the published binaries

Size-optimize the layout and shaping crates that never run per pixel, cutting
the published WASM and native binary size.

Share the renderer facade between the napi and wasm bindings

The napi and wasm Renderer wrappers now build on a shared prepareRenderInput
helper in @takumi-rs/helpers/renderer, so their option types and render bodies
live in one place. Both backends check signal before and after resolving
fonts and images: on native, an already-aborted signal now throws before any
resource fetch.

Fix gradient stop snapping panic for oversized stop lists

Gradients with more color stops than the LUT can hold no longer panic. The
sample-index clamp and normalization passes stay within LUT bounds.

Reuse per-scene state across animation frames

Compute each scene's font snapshot once and share its image and stylesheet
handles across frames instead of re-snapshotting and deep-cloning the whole
option tree per frame. Frame output is unchanged.

Remove encodeFrames

Renderer.encodeFrames and its EncodeFramesOptions / AnimationFrameSource
types are gone. renderAnimation covers scene-based animation; pre-rendered
frame encoding had no callers.

Replace fetchResources/extractResourceUrls with prepareImages

@takumi-rs/helpers exports prepareImages({ node, sources?, fetchCache?, fetch?, timeout? }),
which collects a node tree's remote images and fetches the ones not already supplied. Pass a
fetchCache (a Map<string, Promise<ArrayBuffer>>, or any Map-like store) to coalesce
concurrent fetches of the same URL and reuse the bytes across renders; a failed fetch is
evicted so a later call retries.

The extractResourceUrls and fetchResources helpers are removed. The images render option
takes the same group form: { sources, fetchCache, fetch, timeout }.

Stream animation frames straight into the encoder

Add write_animation, which renders a timeline and feeds each frame to the
encoder as it arrives, holding one raw frame at a time instead of the whole
sequence. Both the napi and WASM renderAnimation bindings use it, so a high
frame rate or a long duration no longer exhausts memory. On native the WebP
encoder still runs frames in parallel, now over bounded chunks. The WASM WebP
encoder now merges runs of identical frames like the native one, so a static or
slow animation encodes and stores far less. The eager render_animation +
write_animated_* path stays for callers that want every frame at once.

Guard shadow and blur buffer sizing against overflow

Extreme blur radii could overflow the u32 shadow-buffer area and panic or
over-allocate. Sizing now uses saturating math and skips shadows above a 256
Mi-pixel budget.

Type keyframe declarations with csstype instead of DOM's CSSStyleDeclaration

KeyframesMap and KeyframeRule typed each keyframe's declarations as
Record<string, CSSStyleDeclaration>, requiring every CSS property on a single
offset and needing the DOM lib. Declarations are now typed with csstype's
Properties, an optional peer dependency, so a single offset only needs the
properties it sets and consumers without the DOM lib still typecheck.

Accept a bare URL string in fonts

fonts entries can now be a URL string, e.g. fonts: ["https://example.com/Inter.woff2"].
The bytes are fetched on demand and keyed by the URL; family name, weight, and style come
from the font file. The object form stays for overriding those. Adds fontFromUrl to
@takumi-rs/helpers.

Cap image decode dimensions and GIF frame volume

Decoders reject images beyond 8192x8192 (via image::Limits for PNG and JPEG,
dimension checks for WebP) and GIFs beyond a total-frame pixel budget, stopping
decode-bomb OOM.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​takumi-rs/​core@​2.3.2

View full report