chore: sync upstream (8 Commits) #8

Merged

alf merged 8 commits from chore/sync-upstream-20261024 into main 2026-10-24 10:00:08 +00:00

Conversation 0 Commits 8 Files changed 82 +951 -3114

alf commented 2026-10-24 10:00:07 +00:00

Owner

Copy link

Upstream-Sync von upstream/main (8 Commits). Fast-Forward.

• c894928e fix(demo): showcase font-display, distinct link text, SVG accessible names (Sonar) (#4402)
• 86730ed1 Tests: UI tests wait for background work by time, not frame count (#4186) (#4242)
• 0b670caf fix(deps): bump crypto-bigint to 0.7.6 (RUSTSEC-2026-0387) (#4366)
• a047c6ba chore: resolve SonarCloud maintainability issues (#4356)
• 0c748e34 fix(render): bound xref streams, JBIG2 referred-to counts, saved graphics states and /W2 runs (#4350)
• a2ec27b4 ci(sonar): don't cancel superseded runs on main, so coverage is published (#4321)
• c4a6dd6b Assets: don't hash translation catalogs in ATTRIBUTION.toml (#4284)
• 8d99a5ce Translations: a missing string never fails a test; xtask ci prints the gaps (#4302)

Upstream-Sync von `upstream/main` (8 Commits). Fast-Forward. - c894928e fix(demo): showcase font-display, distinct link text, SVG accessible names (Sonar) (#4402) - 86730ed1 Tests: UI tests wait for background work by time, not frame count (#4186) (#4242) - 0b670caf fix(deps): bump crypto-bigint to 0.7.6 (RUSTSEC-2026-0387) (#4366) - a047c6ba chore: resolve SonarCloud maintainability issues (#4356) - 0c748e34 fix(render): bound xref streams, JBIG2 referred-to counts, saved graphics states and /W2 runs (#4350) - a2ec27b4 ci(sonar): don't cancel superseded runs on main, so coverage is published (#4321) - c4a6dd6b Assets: don't hash translation catalogs in ATTRIBUTION.toml (#4284) - 8d99a5ce Translations: a missing string never fails a test; xtask ci prints the gaps (#4302)

alf added 8 commits 2026-10-24 10:00:07 +00:00

Translations: a missing string never fails a test; xtask ci prints the gaps (#4302) ... 8d99a5ce1f

Delete the translation coverage tests and the tests of one language's
wording. Keep catalog validation (format, duplicates, placeholders, plural
forms, command ids) and the tests that use a language (registration,
plural rules, RTL order, glyphs, casing, font fallback).

cargo xtask i18n-report runs i18n::tests::translation_gaps_report, which
prints each language's missing count and first few keys and always
passes; xtask ci runs it after the tests.

Assets: don't hash translation catalogs in ATTRIBUTION.toml (#4284) ... c4a6dd6be3

* Assets: translation catalogs aren't hashed

The 33 UI translation catalogs are project files under the project
licence, and git history records their provenance. Their ATTRIBUTION.toml
entries keep title, author, source and licence but carry no sha256, so a
PR that changes UI text no longer has to edit ATTRIBUTION.toml.

cargo xtask assets accepts a kind = "translation" entry for a .tsv under
crates/ui-egui/src/i18n/ without a hash, rejects one that has a hash, and
still requires a hash for every other entry.

* Assets: a leftover hash on a translation catalog is a note, not an error

ci(sonar): don't cancel superseded runs on main, so coverage is published (#4321) a2ec27b477

fix(render): bound xref streams, JBIG2 referred-to counts, saved graphics states and /W2 runs (#4350) ... 0c748e34a8

* fix(render): bound xref streams, JBIG2 referred-to counts, saved graphics states and /W2 runs

Input bounds and crash fixes in the vendored hayro crates, ported from
the snapshot craft-libs carries (storytold/craft-libs#176, #239, #241):

- hayro-syntax: an xref stream subsection must be backed by its decoded
  data. All-zero /W widths and a count longer than the data are refused
  before any entry is inserted; a tiny stream with a large /Size or
  /Index count inserted that many entries.
- hayro-syntax: a subsection running past object number u32::MAX is
  refused; start + i overflowed.
- hayro-syntax: the xref stream type field is read big-endian at its
  full /W[0] width, and /W[0] over 8 bytes is refused like /W[1].
- hayro-jbig2: the long-form referred-to segment count is capped at
  u16::MAX before its retention bytes are read; the 29-bit count went
  straight to Vec::with_capacity (about 2 GiB) and aborted the process.
- hayro-interpret: at most 4096 saved graphics states holding at most
  64 MiB together. A q past either limit is counted but not copied, and
  its Q still removes the clips added since.
- hayro-interpret: a /W2 run whose first CID is past MAX_CID stops there,
  as /W does; a first CID of 4294967295 discarded the whole /W2 table.

Each patch is marked in the source, has a regression test in its crate,
and is listed in vendor/README.md.

* fix(render): a binary usecmap counts against the CMap nesting limit; /W2 checks the CID first

- hayro-cmap: a binary CMap's usecmap passed its own depth to the nested
  parse, so a self-referencing binary CMap recursed until the stack
  overflowed. It now counts like a text usecmap (ledger hayro-cmap 2).
- hayro-interpret: the /W2 first-CID check runs before the run's metrics
  are read, so an incomplete run past MAX_CID no longer discards the rest
  of the table (ledger 52).

* fix(render): refuse xref-stream object numbers past i32::MAX

ObjectIdentifier stores an i32; a number between i32::MAX and u32::MAX
was cast to a negative object number (ledger hayro-syntax 26).

chore: resolve SonarCloud maintainability issues (#4356) ... a047c6ba09

* chore: resolve SonarCloud maintainability issues

* fix(packaging): use verify_sha256 helper function

* style: cargo fmt

* fix: restore wildcard imports and fix method-reference type errors

Revert the glob-import expansions (they missed SomIndices and left unused
imports), revert char::is_ascii_digit where the iterator yields char by
value, and pass the content slice to prune_doomed_xobjects as &[Vec<u8>].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Keep XObject decodability check without binding content in interp

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Dylan Taylor <dylan@craftmaker.dev>

fix(deps): bump crypto-bigint to 0.7.6 (RUSTSEC-2026-0387) (#4366) ... 0b670caf4a

cargo deny refuses crypto-bigint 0.7.5, which pdfcraft-sign uses through
rsa and crypto-primes. 0.7.6 is a semver-compatible patch release with the
fix.

Tests: UI tests wait for background work by time, not frame count (#4186) (#4242) ... 86730ed144

* Tests: UI tests wait for background work by time, not frame count (#4186)

A frame count is not a time: on a busy runner the worker had not finished
the open, or the page text had not arrived, within 30 frames or 50 hover
rounds. support::step_until (#[must_use]) steps frames until a condition
holds or 30 s pass, sleeping briefly between frames, and says whether it
held; each test asserts on that with its own message.

- control_open_replies_pending_while_the_worker_opens_and_focuses_once_it_has
  and mode_tabs_keep_the_hand_over_page_text_scrolled_under_them wait with it,
  and so does control.rs call() for its reply.
- support::settle waits for every pending render and fails if the pages are
  not rendered within 30 s. It replaces all the render-pending settle loops
  (40 to 3000 frames) and the local settle/wait_for_pages wrappers, except
  text_select's double-click wait, which is held to 8 frames on purpose to
  stay inside egui's multi-click window, and view.rs's loops that already
  wait by a deadline.
- wait_until is built on step_until, keeping its diagnostic message.
- tabbing_back_to_the_same_field_then_saving_keeps_the_committed_value already
  waited 30 s for its file. It failed because its "same-frame" case shared
  its scratch directory with typing_and_saving_in_the_same_frame_saves_the_last_keystrokes,
  which runs in the same test process (since ee1ee704, #1045) and deleted
  the directory mid-save. forms' and pickers' scratch() now give every call
  a directory of its own.

Fixes #4186

* M14: update ctutils to 0.4.5 for RUSTSEC-2026-0385

The dependency-advisory gate rejects ctutils 0.4.2 (non-constant-time
mask generation and u128 comparisons, fixed in 0.4.4). It comes in
through crypto-bigint for the signing crates. Only its version and
checksum change in Cargo.lock.

(cherry picked from commit 1f8811761a)

fix(demo): showcase font-display, distinct link text, SVG accessible names (Sonar) (#4402) ... c894928e6f

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

alf merged commit c894928e6f into main 2026-10-24 10:00:08 +00:00

alf deleted branch chore/sync-upstream-20261024 2026-10-24 10:00:08 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

  

herkunft/alpha-feedback

Aus Rückmeldungen der Alpha-Tester

  

status

blockiert

Wartet auf etwas anderes

  

status

zu-testen

Gebaut, aber noch nicht im echten Einsatz geprüft

  

typ

bug

Fehler

  

typ

docs

Dokumentation

  

typ

enhancement

Verbesserung einer vorhandenen Funktion

  

typ

feature

Neue Funktion

  

typ

idea

Idee, noch nicht entschieden

No labels

herkunft/alpha-feedback

status

blockiert

status

zu-testen

typ

bug

typ

docs

typ

enhancement

typ

feature

typ

idea

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

iris/pdfcraft!8

No description provided.