[tannevaled]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/chromedp/cdproto	v0.0.0-20260922220944-a19bff23514f → v0.159.1			require	minor
github.com/chromedp/chromedp	v0.16.0 → v0.22.0			require	minor
github.com/dop251/goja	39ec265 → f5d1d00			require	digest
github.com/go-browserhttp/browserhttp	v0.2.0 → v0.3.0			require	minor
github.com/go-gfx/gfx	v0.37.0 → v0.41.0			require	minor
github.com/go-images/images	v0.1.1-0.20261026203936-4ac989d310a1 → v0.3.0			require	minor
github.com/go-opentype/opentype	5e69589 → 2c8922c			require	digest
github.com/go-pdfkit/reader	v0.9.0 → v0.10.0			require	minor
github.com/go-webengine/esbuildsandbox	v0.1.0 → v0.2.0			require	minor
github.com/go-widgets/painter	v0.16.0 → v0.16.1			require	patch

---

Release Notes

chromedp/cdproto (github.com/chromedp/cdproto)

v0.159.1

Compare Source

• Chromium: 159.0.8140.1 (was 159.0.8134.1)
• V8: 15.9.67 (was 15.9.58)
• API changes since v0.159.0: 3 incompatible, 5 compatible

By package, as removed, changed and added names:

browser 1 removed 0 changed 0 added
page 2 removed 0 changed 0 added
webmcp 0 removed 0 changed 5 added

v0.159.0

Compare Source

• Chromium: 159.0.8134.1 (was 158.0.8127.1)
• V8: 15.9.58 (was 15.8.62)
• API changes since v0.158.6: 0 incompatible, 4 compatible

By package, as removed, changed and added names:

page 0 removed 0 changed 4 added

v0.158.6

Compare Source

• Chromium: 158.0.8127.1 (was 158.0.8124.1)
• V8: 15.8.62 (was 15.8.47)
• API changes since v0.158.5: 0 incompatible, 1 compatible

By package, as removed, changed and added names:

preload 0 removed 0 changed 1 added

v0.158.5

Compare Source

• Chromium: 158.0.8124.1 (was 158.0.8115.1)
• V8: 15.8.47 (was 15.8.24)
• API changes since v0.158.4: 0 incompatible, 1 compatible

By package, as removed, changed and added names:

network 0 removed 0 changed 1 added

v0.158.4

Compare Source

• Chromium: 158.0.8115.1 (was 158.0.8111.1)
• V8: 15.8.24 (was 15.8.18)
• API changes since v0.158.3: 0 incompatible, 2 compatible

By package, as removed, changed and added names:

network 0 removed 0 changed 2 added

v0.158.3

Compare Source

• Chromium: 158.0.8111.1 (was 158.0.8110.1)
• V8: 15.8.18 (was 15.8.17)
• API changes since v0.158.2: 0 incompatible, 0 compatible

v0.158.2

Compare Source

• Chromium: 158.0.8110.1 (was 158.0.8108.1)
• V8: 15.8.17
• API changes since v0.158.1: 0 incompatible, 0 compatible

v0.158.1

Compare Source

• Chromium: 158.0.8108.1 (was 158.0.8104.1)
• V8: 15.8.17 (was 15.7.112)
• API changes since v0.158.0: 0 incompatible, 1 compatible

By package, as removed, changed and added names:

network 0 removed 0 changed 1 added

v0.158.0

Compare Source

• Chromium: 158.0.8104.1 (was 157.0.8103.0)
• V8: 15.7.112
• API changes since v0.157.11: 0 incompatible, 1 compatible

By package, as removed, changed and added names:

page 0 removed 0 changed 1 added

v0.157.11

Compare Source

• Chromium: 157.0.8103.0 (was 157.0.8100.1)
• V8: 15.7.112 (was 15.7.108)
• API changes since v0.157.10: 5 incompatible, 4 compatible

By package, as removed, changed and added names:

cdproto 1 removed 0 changed 1 added
io 4 removed 0 changed 0 added
page 0 removed 0 changed 3 added

v0.157.10

Compare Source

• Chromium: 157.0.8100.1 (was 157.0.8086.1)
• V8: 15.7.108 (was 15.7.37)
• API changes since v0.157.9: 2 incompatible, 8 compatible

By package, as removed, changed and added names:

audits 0 removed 0 changed 1 added
cdproto 0 removed 0 changed 1 added
debugger 0 removed 0 changed 1 added
network 0 removed 0 changed 1 added
page 2 removed 0 changed 4 added

v0.157.9

Compare Source

v0.157.8

Compare Source

v0.157.7

Compare Source

• Chromium: 157.0.8086.1 (was 157.0.8085.3)
• V8: 15.7.37 (was 15.7.33)
• API changes since v0.157.6: 0 incompatible, 0 compatible

v0.157.6

Compare Source

• Chromium: 157.0.8085.3 (was 157.0.8085.2)
• V8: 15.7.33
• API changes since v0.157.5: 0 incompatible, 0 compatible

v0.157.5

Compare Source

• Chromium: 157.0.8085.2 (was 157.0.8085.1)
• V8: 15.7.33
• API changes since v0.157.4: 0 incompatible, 0 compatible

v0.157.4

Compare Source

• Chromium: 157.0.8085.1
• V8: 15.7.33
• API changes since v0.157.3: 72 incompatible, 1 compatible

By package, as removed, changed and added names:

accessibility 0 removed 1 changed 0 added
animation 0 removed 1 changed 0 added
audits 0 removed 1 changed 0 added
browser 0 removed 2 changed 0 added
cdp 1 removed 0 changed 0 added
css 0 removed 1 changed 0 added
debugger 0 removed 2 changed 0 added
dom 0 removed 3 changed 0 added
domdebugger 0 removed 1 changed 0 added
emulation 0 removed 19 changed 0 added
har 0 removed 7 changed 0 added
headlessexperimental 0 removed 1 changed 0 added
indexeddb 0 removed 2 changed 0 added
input 0 removed 8 changed 0 added
io 0 removed 1 changed 0 added
layertree 0 removed 1 changed 0 added
network 0 removed 5 changed 1 added
overlay 0 removed 2 changed 0 added
page 0 removed 6 changed 0 added
runtime 0 removed 1 changed 0 added
storage 0 removed 1 changed 0 added
target 0 removed 2 changed 0 added
webauthn 0 removed 3 changed 0 added

v0.157.3

Compare Source

• Chromium: 157.0.8085.1
• V8: 15.7.33
• API changes since v0.157.2: 2237 incompatible, 1079 compatible

By package, as removed, changed and added names:

accessibility 30 removed 17 changed 8 added
ads 4 removed 4 changed 2 added
animation 15 removed 20 changed 7 added
audits 8 removed 9 changed 3 added
autofill 7 removed 8 changed 1 added
backgroundservice 4 removed 8 changed 2 added
bluetoothemulation 20 removed 40 changed 6 added
browser 45 removed 47 changed 10 added
cachestorage 14 removed 12 changed 3 added
cast 7 removed 12 changed 2 added
cdp 4 removed 0 changed 6 added
crashreportcontext 2 removed 2 changed 1 added
css 76 removed 79 changed 35 added
debugger 69 removed 71 changed 16 added
deviceaccess 4 removed 8 changed 1 added
deviceorientation 2 removed 4 changed 0 added
digitalcredentials 4 removed 2 changed 0 added
dom 136 removed 116 changed 51 added
domdebugger 13 removed 17 changed 1 added
domsnapshot 8 removed 10 changed 1 added
domstorage 7 removed 12 changed 5 added
emulation 105 removed 98 changed 7 added
eventbreakpoints 3 removed 6 changed 0 added
extensions 13 removed 17 changed 3 added
fedcm 9 removed 16 changed 2 added
fetch 26 removed 24 changed 4 added
filesystem 2 removed 2 changed 1 added
findinpage 4 removed 8 changed 0 added
har 0 removed 2 changed 1 added
headlessexperimental 6 removed 3 changed 1 added
heapprofiler 28 removed 33 changed 9 added
indexeddb 36 removed 18 changed 4 added
input 65 removed 30 changed 1 added
inspector 2 removed 4 changed 4 added
io 7 removed 6 changed 2 added
layertree 21 removed 20 changed 8 added
log 5 removed 10 changed 1 added
media 2 removed 4 changed 5 added
memory 18 removed 23 changed 5 added
network 69 removed 96 changed 54 added
overlay 51 removed 59 changed 9 added
page 133 removed 132 changed 47 added
performance 5 removed 6 changed 2 added
performancetimeline 1 removed 2 changed 1 added
preload 2 removed 4 changed 6 added
profiler 16 removed 21 changed 7 added
pwa 14 removed 15 changed 3 added
runtime 77 removed 71 changed 19 added
security 3 removed 6 changed 1 added
serviceworker 12 removed 24 changed 3 added
smartcardemulation 14 removed 36 changed 14 added
storage 39 removed 54 changed 15 added
systeminfo 6 removed 6 changed 3 added
target 54 removed 46 changed 16 added
tethering 2 removed 4 changed 1 added
tracing 20 removed 17 changed 6 added
webaudio 4 removed 6 changed 14 added
webauthn 25 removed 46 changed 7 added
webmcp 5 removed 8 changed 5 added

v0.157.2

Compare Source

• Chromium: 157.0.8085.1 (was 157.0.8084.3)
• V8: 15.7.33 (was 15.7.23)
• API changes since v0.157.1: 0 incompatible, 0 compatible

v0.157.1

Compare Source

• Chromium: 157.0.8103.0 (was 157.0.8100.1)
• V8: 15.7.112 (was 15.7.108)
• API changes since v0.157.10: 5 incompatible, 4 compatible

By package, as removed, changed and added names:

cdproto 1 removed 0 changed 1 added
io 4 removed 0 changed 0 added
page 0 removed 0 changed 3 added

chromedp/chromedp (github.com/chromedp/chromedp)

v0.22.0

Compare Source

New: Listen and ListenBrowser call a func for each event of the tab or the browser, in the order in which the events arrive from Chrome. The target calls the func before it reads the next message, so the func sees an event that arrived before the reply to a command before that command returns. Events and BrowserEvents give one iterator for each event type and give neither guarantee, so they stay the recommended API, and Listen is the lower level tool for code that needs the order across event types. The func gets the typed events of cdproto and no replies to commands. It runs in the loop that reads the messages of the tab, so it must return fast, must not run a command, must not call Listen and must not panic. See docs/API.md, example 28, and the decision docs/decisions/2026-11-04-export-the-ordered-event-listener.md. The idea comes from discussion #​1645 by onsi.

v0.21.1

Compare Source

Fix a panic, close of closed channel, in the handling of DOM.documentUpdated. When DOM.getDocument failed, for example because the tab was closing, the frame kept its old root node, and the next DOM.documentUpdated event closed the channel of that root again. The frame now clears the root first. Thanks to Dhruv Jain (#​1644). The module also requires cdproto v0.159.0 now.

v0.21.0

Compare Source

The package remote has its own WebSocket client, and it is a package of the core module now. The nested module remote and the dependency github.com/gobwas/ws are gone. The core module still needs only the standard library and cdproto.

The import path is the same: github.com/chromedp/chromedp/remote. The public API of the package is the same.

Upgrade: if your go.mod has a line for github.com/chromedp/chromedp/remote, remove it (go mod tidy does that). Go reports an ambiguous import while both the old nested module and the core module provide the package. The tag remote/v0.2.0 is the last version of the nested module.

The client follows RFC 6455: it checks the handshake, joins fragmented messages, checks UTF-8 and the size of a message, answers pings, and does the close handshake. It does not support extensions such as permessage-deflate. Go 1.25 and later are supported.

v0.20.1

Compare Source

Documentation only. The README, the package documentation and the docs have the current versions (chromedp v0.20.0, cdproto v0.157.8, remote v0.2.0), the CI matrix and the release history. The README describes termcast and the 43 programs of chromedp/examples.

v0.20.0

Compare Source

chromedp supports Go 1.25 and later. Before this release, the module needed Go 1.27 (see #​1536).

• The JSON types come from github.com/chromedp/cdproto/cdp/jsonv2. With Go 1.27 or GOEXPERIMENT=jsonv2 they are aliases of the types of the standard encoding/json/v2 and jsontext, so the public API is the same. With Go 1.25 and 1.26 they come from github.com/go-json-experiment/json.
• The modules chromedp, remote and test use go 1.25 and cdproto v0.157.8.
• The CI runs Go 1.25, 1.26 and stable on Linux, stable on Windows and macOS, and the experiment and the compatibility tag.

v0.19.1

Compare Source

Documentation only. The README and the package documentation describe termcast, which draws the screen of a page in a terminal, and the 43 programs of chromedp/examples.

v0.19.0

Compare Source

This release adds new actions and options, fixes bugs, and works on Linux, Windows and macOS in CI. See docs/MIGRATION.md for every change.

New

• Tap and TapXY send a touch tap.
• DragAndDrop and DragAndDropXY drag and drop with the mouse and with HTML5 drag and drop.
• Console reads the console, the uncaught exceptions and the browser log of a page as one iterator.
• ExposeFunc calls a Go function from the page, like exposeFunction in Puppeteer.
• PrintToPDF takes options for the paper, the margins, the scale, the page ranges, the header and the footer, the outline and a stream.
• WithNewWindow chooses a window or a tab for a new target. NoInheritEnv starts the browser with only the given variables. WithDetachOnCancel leaves the tab open when the context ends.
• EvalAwaitPromise waits for a promise that an expression returns.

Fixed

• Call on a Target or a Browser returns an error when the connection to the browser is lost, and does not hang.
• The exec allocator keeps the order of the flags.
• WaitNotPresent works with a JSPath that gives null or an empty list.
• Evaluate returns ErrJSNull for null when the type cannot be nil, and Text works on a text node.
• The pipe transport, the allocator and the tests work on Windows and macOS, and the default browser lookup on Windows falls back to Microsoft Edge.

Notes

• Use errors.Is(err, context.Canceled) and not == for the error of a call after the connection was lost.
• The tests run on Linux, Windows and macOS in CI, and every night against the stable, beta and dev channels of headless-shell.
• The module github.com/chromedp/chromedp/remote is unchanged and stays at remote/v0.1.0.

v0.18.0

Compare Source

v0.17.1

Compare Source

v0.17.0

Compare Source

go-browserhttp/browserhttp (github.com/go-browserhttp/browserhttp)

v0.3.0

Compare Source

v0.2.1

Compare Source

go-gfx/gfx (github.com/go-gfx/gfx)

v0.41.0

Compare Source

What's Changed

• ci: move the Go pin from 1.27.2 to 1.27.3 by @​tannevaled in #​85
• svg: honour opacity as group compositing (#​77) by @​tannevaled in #​91

Full Changelog: go-gfx/gfx@v0.40.0...v0.41.0

v0.40.0

Compare Source

One path-data parser, shared by three formats

vector.ParseData reads the syntax of SVG's d attribute and returns the outline, with a geometry.Matrix applied on the way. It was svg's private parser until now.

It moved because three formats write the same syntax. SVG 1.1 §8.3 defines it; ODF's draw:path carries it verbatim in svg:d; and ECMA-388 Annex C gives OpenXPS's abbreviated geometry syntax as an algorithm which, read against it, is a strict subset with a prefix:

	SVG d	ODF draw:path	OpenXPS
commands	M L H V C S Q T A Z	the same (svg:d)	the same, minus T
arc operands	rx ry rot large sweep x y	the same	the same order
sweep sense	positive-angle	the same	FLAG2 == 1 ? Clockwise — the same
fill rule	on the shape	on the shape	an F0/F1 prefix on the data

Left where it was, the arc maths and the smooth-curve reflection would have been transcribed a second and a third time by whoever read those formats next. The F0/F1 prefix is deliberately not handled: a fill rule belongs to the shape, not to the outline, so an XPS reader strips it and chooses EvenOdd or NonZero itself.

⛔ The suite passing was not evidence the move was safe

[a b c d e f] — the form SVG's matrix(), XPS's RenderTransform, ODF's draw:transform and PDF's cm all write — is not a row-major 2×3 matrix. Read as one, b and c swap, which leaves every unrotated drawing correct and every rotated one mirrored.

Planting exactly that swap left the whole of svg's test suite green, because every drawing in it is axis-aligned and b == c == 0 there.

So the move was proved against a control rather than against the suite: the parser as it stood before it, over 20 030 inputs (every command letter in both cases, the compact number forms, the arc flags run into the next coordinate, the malformed data that must be refused, and 20 000 generated paths) × 6 matrices including a rotation, a shear and a mirror, compared with math.Float64bits — exact, because the move was meant to reorder no arithmetic:

  agreed exactly : 115518      points differ : 0
  both refused   :   4662      verdict differ: 0

The same probe reports 57 518 differing with the mutant in place, which is the only reason that zero means anything. TestAShearedTransformTellsBFromC now keeps the witness in the repository, with b = 0.25 and c = 0.75.

ParseData takes a geometry.Matrix rather than a flat six-tuple, so the transposition is not expressible: its entries are named Xx, Yx, X0 / Xy, Yy, Y0, and b and c are not adjacent.

Also

• vector now imports geometry, which the documentation had described as the design for some time while the code did not do it.
• The docs site named geometry.Affine and Concat — neither exists. Corrected to Matrix / Mul (go-gfx/docs#18).
• 0 uncovered blocks of 2090 across the module.

Compatibility: ParseData is an addition; no existing API changed. (Path.Each and Path.Len, which a consumer of this parser usually wants next, shipped in v0.39.0 — checked against the tag rather than remembered.)

v0.39.0

Compare Source

What's Changed

• svg: walk a document into shapes instead of pixels by @​tannevaled in #​87

Full Changelog: go-gfx/gfx@v0.38.0...v0.39.0

v0.38.0

Compare Source

What's Changed

• vector: a path can be read back, curves and all by @​tannevaled in #​86

Full Changelog: go-gfx/gfx@v0.37.0...v0.38.0

go-images/images (github.com/go-images/images)

v0.3.0

Compare Source

What's Changed

• Add DecodeWith/DecodeOptions: bound PNG and JPEG by their header by @​tannevaled in #​36

Full Changelog: go-images/images@v0.2.1...v0.3.0

v0.2.1

Compare Source

What's Changed

• chore(deps): update dependency go to v1.27.3 by @​tannevaled in #​31
• Bump go-gfx/gfx to v0.37.0 and document the 40 Mpx decode limit by @​tannevaled in #​35

Full Changelog: go-images/images@v0.2.0...v0.2.1

go-pdfkit/reader (github.com/go-pdfkit/reader)

v0.10.0

Compare Source

What's Changed

• ci: install qemu-user, and resolve the emulator this matrix names by @​tannevaled in #​36
• reader: read and check a file's linearization (ISO 32000-1 Annex F) by @​tannevaled in #​37

Full Changelog: go-pdfkit/reader@v0.9.0...v0.10.0

go-webengine/esbuildsandbox (github.com/go-webengine/esbuildsandbox)

v0.2.0

Compare Source

v0.1.1

Compare Source

go-widgets/painter (github.com/go-widgets/painter)

v0.16.1

Compare Source

What's Changed

• fix(deps): update module github.com/go-gfx/gfx to v0.36.0 by @​tannevaled in #​37
• fix(deps): update module github.com/go-gfx/gfx to v0.36.1 by @​tannevaled in #​39
• chore(deps): update dependency go to v1.27.3 by @​tannevaled in #​38
• Bump go-gfx/gfx to v0.37.0 by @​tannevaled in #​40

Full Changelog: go-widgets/painter@v0.16.0...v0.16.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[tannevaled]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/dlclark/regexp2/v2	v2.5.2 -> v2.11.0