chore(deps): bump the hayro group across 1 directory with 3 updates

Bumps the hayro group with 3 updates in the / directory: [hayro-syntax](https://github.com/LaurenzV/hayro), [hayro-interpret](https://github.com/LaurenzV/hayro) and [hayro-cmap](https://github.com/LaurenzV/hayro). Updates `hayro-syntax` from 0.7.2 to 0.9.0 - [Release notes](https://github.com/LaurenzV/hayro/releases) - [Commits](https://github.com/LaurenzV/hayro/commits/hayro-syntax-v0.9.0) Updates `hayro-interpret` from 0.7.0 to 0.8.0 - [Release notes](https://github.com/LaurenzV/hayro/releases) - [Commits](https://github.com/LaurenzV/hayro/compare/hayro-interpret-v0.7.0...hayro-interpret-v0.8.0) Updates `hayro-cmap` from 0.1.0 to 0.1.1 - [Release notes](https://github.com/LaurenzV/hayro/releases) - [Commits](https://github.com/LaurenzV/hayro/compare/hayro-cmap-v0.1.0...hayro-cmap-v0.1.1) --- updated-dependencies: - dependency-name: hayro-cmap dependency-version: 0.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: hayro - dependency-name: hayro-interpret dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: hayro - dependency-name: hayro-syntax dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: hayro ... Signed-off-by: dependabot[bot] <support@github.com>
2026-11-13 01:17:11 -06:00 · 2026-11-12 11:07:12 +00:00
7 changed files with 74 additions and 134 deletions
@@ -1,57 +0,0 @@
-# This file is machine-generated by `gh actions-lock`.
-# Do not edit by hand; run `gh actions-lock` to update.
-# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.3'
-workflows:
-    '.github/workflows/ci.yml': []
-    '.github/workflows/freebsd.yml': []
-    '.github/workflows/house-rules.yml': []
-    '.github/workflows/lockfile.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/nix.yml': []
-    '.github/workflows/packaging-lint.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/printing.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/dtolnay-rust-toolchain@v1.0.0'
-        - 'step-security/harden-runner@v2.22.4'
-        - 'step-security/rust-cache@v2.9.2'
-        - 'storytold/craft-common-actions@main'
-    '.github/workflows/release.yml': []
-    '.github/workflows/sonarcloud.yml': []
-    '.github/workflows/windows-arm64.yml': []
-dependencies:
-    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'actions/checkout@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'step-security/dtolnay-rust-toolchain@v1.0.0':
-        ref: 'v1.0.0'
-        commit: 'sha1-8dd607977d06adf4ed49b190381e74c17a9dd25f'
-        owner_id: 88700172
-        repo_id: 1249865941
-    'step-security/harden-runner@v2.22.4':
-        ref: 'v2.22.4'
-        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
-        owner_id: 88700172
-        repo_id: 422287306
-    'step-security/rust-cache@v2.9.2':
-        ref: 'v2.9.2'
-        commit: 'sha1-8871c8ba063416da7c32246932ea6ae08700453e'
-        owner_id: 88700172
-        repo_id: 822636713
-    'storytold/craft-common-actions@main':
-        ref: 'main'
-        commit: 'sha1-293de72429d3ed5d9fa92aded5e500544c0fa28f'
-        owner_id: 76897702
-        repo_id: 1414429108
-        uses:
-            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
@@ -1,34 +0,0 @@
-name: Lockfile
-
-# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
-# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
-# Docs: https://gh.io/actions-lockfile
-on:
-  pull_request:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  GH_TOKEN: ${{ github.token }}
-
-jobs:
-  lockfile:
-    name: Lockfile is in sync
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install gh-actions-lock
-        run: gh extension install github/gh-actions-lock --pin v0.4.1
-      - name: Verify the lockfile
-        run: gh actions-lock --verify
@@ -28,10 +28,10 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install the pinned packaging toolchain
@@ -43,10 +43,10 @@ jobs:
      CARGO_INCREMENTAL: '0'
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -81,13 +81,13 @@ jobs:
            pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
            libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers

-      - uses: step-security/dtolnay-rust-toolchain@v1.0.0
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
        with:
          toolchain: stable
          components: rustfmt, clippy
          targets: wasm32-unknown-unknown

-      - uses: step-security/rust-cache@v2.9.2
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}

@@ -2338,12 +2338,6 @@ dependencies = [
 "foldhash 0.2.0",
 ]

-[[package]]
-name = "hayro-ccitt"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
-
 [[package]]
 name = "hayro-ccitt"
 version = "0.4.0"
@@ -2351,10 +2345,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2866f0d976e76497480b853d5e258dab6e4b89ecfe991124e08f15dfa8fd03ad"

 [[package]]
-name = "hayro-cmap"
-version = "0.1.0"
+name = "hayro-ccitt"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d285dc30731c8485de5fa732fbdf2b3affdf01e4da7c2135022ca6fa664bf6"
+checksum = "adbed896e99325bc312778bb9c9c289d795d51c12775c44dd5e4352f679c7e46"
+
+[[package]]
+name = "hayro-cmap"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a14afde3344be69225fec4f6f44f6a219a3a492f9d8301eb25ef608fe4b7014c"
 dependencies = [
 "brotli",
 "hayro-postscript",
@@ -2362,19 +2362,19 @@ dependencies = [

 [[package]]
 name = "hayro-interpret"
-version = "0.7.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2613d0406898995042d0794c4245b2f2fba1246490c8ac593769bba6551129d"
+checksum = "ac9df074ff163a63864cec9b0bf640ccbff8abf4e44481df7369ce0ac172ffbe"
 dependencies = [
 "bitflags 2.13.2",
 "hayro-cmap",
- "hayro-syntax",
+ "hayro-syntax 0.8.0",
 "kurbo",
 "moxcms",
 "phf 0.13.1",
 "rustc-hash 2.1.3",
 "siphasher",
- "skrifa 0.42.1",
+ "skrifa 0.46.2",
 "smallvec",
 "yoke",
 ]
@@ -2390,36 +2390,65 @@ dependencies = [
 ]

 [[package]]
-name = "hayro-jpeg2000"
-version = "0.3.5"
+name = "hayro-jbig2"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c75ab947623ef4ccaa7acf0579edf7cbb5a73838e3839a7be73335e522f433a1"
+checksum = "eb5c7f3a4eb551c2bb7fa16e268f728d4bc2a5c9b090554b8dc0ee2503fb5840"
 dependencies = [
- "fearless_simd 0.4.1",
+ "hayro-ccitt 0.5.0",
 ]

 [[package]]
-name = "hayro-postscript"
-version = "0.1.0"
+name = "hayro-jpeg2000"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "885c5ef0654933139a9b9546fc2c69e18d37f38aa2520f079092b1be18f1fcaa"
+checksum = "122c5f834c37a2260b9c851bb8be685cf539b2a8b94b704a931ef7d2525d5835"
+dependencies = [
+ "fearless_simd 1.1.0",
+]
+
+[[package]]
+name = "hayro-jpeg2000"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e5e5f2b3de970707fc22fd956d8f44211602939d5e4588603afa919cb7b3740"
+
+[[package]]
+name = "hayro-postscript"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc2d80da85f31c3fdc0366431f44cfd645a9da1e242ed1f4a61f213d9765660f"

 [[package]]
 name = "hayro-syntax"
-version = "0.7.2"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0edeafd70aa2db743de8ede8637d07ec87db05efe69cde371d03f1b185fcef27"
+checksum = "6cdc818d8d265dcb42081d488f7599df4f73fb79e9d347ecedcd3c23809d2026"
 dependencies = [
 "flate2",
- "hayro-ccitt 0.3.0",
- "hayro-jbig2",
- "hayro-jpeg2000",
+ "hayro-ccitt 0.4.0",
+ "hayro-jbig2 0.3.1",
+ "hayro-jpeg2000 0.4.1",
 "memchr",
 "rustc-hash 2.1.3",
 "smallvec",
 "zune-jpeg",
 ]

+[[package]]
+name = "hayro-syntax"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ced8279487b029813f6cc05399099fa34df6fa23d8f7b0d41d972c49d5b30d"
+dependencies = [
+ "hayro-ccitt 0.5.0",
+ "hayro-jbig2 0.4.0",
+ "hayro-jpeg2000 0.5.0",
+ "rustc-hash 2.1.3",
+ "smallvec",
+ "zune-jpeg",
+]
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -5115,6 +5144,16 @@ dependencies = [
 "read-fonts 0.41.0",
 ]

+[[package]]
+name = "skrifa"
+version = "0.46.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4febebda507fb889c545a37a135517769d1391941013561292897961d1887d6"
+dependencies = [
+ "bytemuck",
+ "read-fonts 0.43.3",
+]
+
 [[package]]
 name = "skrifa"
 version = "0.47.0"
@@ -7052,7 +7091,7 @@ dependencies = [
 "craft-pdf",
 "hayro-cmap",
 "hayro-interpret",
- "hayro-syntax",
+ "hayro-syntax 0.9.0",
 "image",
 "js-sys",
 "kurbo",
@@ -26,6 +26,6 @@ chrono = { workspace = true }
 js-sys = "0.3"

 [dev-dependencies]
-hayro-syntax = "0.7.2"
-hayro-interpret = { version = "0.7.0", default-features = false, features = ["embed-fonts"] }
+hayro-syntax = "0.9.0"
+hayro-interpret = { version = "0.8.0", default-features = false, features = ["embed-fonts"] }
 hayro-cmap = "0.1"
@@ -4,14 +4,6 @@ sonar.organization=storytold
 # S4790 (weak hash): SHA-1 is a start-key and "SHA1/1K" checksum algorithm that ODF package
 # encryption (ODF 1.3 Part 2 §4.16) names, and older office suites wrote it. It is needed to open
 # those files, not chosen for new security: WordCraft writes a SHA-256 start key and checksum.
-sonar.issue.ignore.multicriteria=odt_sha1,gha-lockfile
+sonar.issue.ignore.multicriteria=odt_sha1
 sonar.issue.ignore.multicriteria.odt_sha1.ruleKey=rust:S4790
 sonar.issue.ignore.multicriteria.odt_sha1.resourceKey=crates/formats/src/odt/crypt.rs
-
-# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
-# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
-# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
-# the rule flags the tag refs anyway:
-# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
-sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
-sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**