Upgrading @takumi-rs/core 1 to 2
Breaking1.8.7 → 2.19.0Breaking43Security5Platform1Deprecated2New67Changed148Fixed151Other7
Fetching 99 releases from GitHub…96 / 99
SecurityfromJsx escapes text inside <svg> elements to prevent markup injection, and throws on invalid XML names and unsafe style values.Advisory ↗
BreakingUpgrade verdict
36 breaking changes and a platform requirement change and 5 security fixes.
In plain terms
- Building the Rust crate with fewer features changes what works: animated images need a format feature, and without the png feature PNG images cannot be drawn and PNG encoding is unavailable.
- The wasm and PDF packages no longer load WOFF1 fonts, so convert them to WOFF2, TTF, or OTF.
- Code using the GIF-specific type and error names must switch to the new animation-wide names.
- Some list behaviours change: reversed ordered lists no longer count down, gradient bullet images fall back to the counter style, and menu/dir elements no longer start their own list numbering.
Must act Top 5 of 44 that need code or config changes
Node.js requirement changed in 2.0.0-beta.9: >= 12.22.0 < 13 || >= 14.17.0 < 15 || >= 15.12.0 < 16 || >= 16.0.0 → >=18.
What you must change
Breaking36
Splits takumi's Cargo features so ImageSource::Animated needs gif, png or webp, and png is only on by default via image-decoding.
ImageSource::Animatedimage-decodingpnggifwebpsvg-sizingsvgImageBuffer::encode_pngDrops WOFF1 support from @takumi-rs/wasm and takumi-pdf; @takumi-rs/core keeps WOFF1.
@takumi-rs/wasmtakumi-pdf@takumi-rs/coreRenames ImageSource::Gif to ImageSource::Animated, GifSource to AnimatedSource, and ImageError::InvalidGif to ImageError::InvalidAnimation.
ImageSource::GifImageSource::AnimatedGifSourceAnimatedSourceImageError::InvalidGifImageError::InvalidAnimationDrops
reversed handling, gradient list-style-image markers, and menu/dir list counting; <ol reversed> now counts up and only ul/ol scope counts.olreversedlist-style-imageulmenudirReplaces ImageCache with ResourceCache sharing one byte budget across images, SVG sources, rasters and stylesheets; default budget drops from 64 MiB to 16 MiB.
ImageCacheResourceCacheResourceCache::newRenderercacheMaxBytesRenderOptions.stylesheetArc<StyleSheet>Drops the preact-render-to-string optional import; Preact trees traverse natively and components calling Preact hooks no longer render.
preact-render-to-stringThe
background shorthand no longer parses or resets background-blend-mode, and Background.blend_mode is removed.backgroundbackground-blend-modeblend_modeBackgroundRemoves the
./wasm export; import from @takumi-rs/image-response instead.@takumi-rs/image-response/wasm@takumi-rs/image-responseMakes
BuiltInlineLayout layout fields private and removes several public inline-layout functions.BuiltInlineLayout::layoutBuiltInlineLayout::custom_inline_boxesBuiltInlineLayout::measure_runsMeasuredInlineRunMeasuredInlineBoxget_parent_font_metricsresolve_inline_line_metricsresolve_inline_line_statesparley::LayoutRenames the
svg feature to svg-source; svg-backend is unchanged.svgsvg-sourcesvg-backendRemoves Renderer.encodeFrames and its EncodeFramesOptions and AnimationFrameSource types.
Renderer.encodeFramesEncodeFramesOptionsAnimationFrameSourcerenderAnimationRenames the
googleFonts family field from family to name; bare string families are unchanged.googleFontsGoogleFontFamilyfamiliesnamefamilyRemoves the
text option from googleFonts because it stripped unicode-range and made glyph routing ambiguous.googleFontstextunicode-rangeRemoves the createImageResponse factory; pass options straight to ImageResponse.
createImageResponseImageResponseRenames the raster feature to raster-backend, mirroring svg-backend, and rayon no longer enables it implicitly.
rasterraster-backendsvg-backendrayonModels image output quality per format: Jpeg/WebP carry a Quality, WebPLossless replaces lossless WebP, and write_image drops its quality argument.
ImageOutputFormat::JpegImageOutputFormat::WebPQualityWebPLosslesswrite_imagelosslessResolvedOutlineGlyph::Plain and ResolvedOutlineGlyph::Color gain an ink field computed by outline_ink from their paths.
ResolvedOutlineGlyph::PlainResolvedOutlineGlyph::Coloroutline_inkShares computed style groups between boxes behind Rc, changing ComputedStyle fields and RenderContext::style to Rc<ComputedStyle>.
ComputedStyleRcRenderContext::styleRenderContextBuilder::stylebox_datainherited_database::resources::glyph::draw_outline replaces ErasedPen, drawing a skrifa OutlineGlyph through &mut dyn OutlinePen.base::resources::glyph::draw_outlineErasedPenOutlineGlyphOutlinePenNode trees nested deeper than 512 levels now fail with
nodes nest deeper than 512 levels instead of crashing the process.takumi_html::DEFAULT_MAX_DEPTHtakumi_core::layout::node::MAXIMUM_DOM_TREE_DEPTHtakumi::DEFAULT_MAX_DEPTHSceneRequest::build replaces build_stacking_contexts; set paint_bounds: false to skip paint bounds and the text shaping they need.
SceneRequest::buildbuild_stacking_contextspaint_boundsApplies text-overflow: ellipsis only to boxes that clip, matching Chrome, so overflow other than visible is now required.
text-overflowoverflowline-clampMerges custom_properties and registered_custom_properties into one custom_properties: CustomProperties field on ComputedStyle, read via get(name).
ComputedStylecustom_propertiesregistered_custom_propertiesCustomPropertiesgetStylesheet rules now win over
tw utilities because utilities sit in the last cascade layer.tw@layer!Rejects style values with trailing content instead of silently applying a prefix.
stylewidthvar()Returns css from fromJsx and fromHtml, deprecating the stylesheets field.
fromJsxfromHtmlcssstylesheetsObject.keysStores calc() as non-zero terms, shrinking Length to 20 bytes; calc() expressions mixing more than four distinct units now fail to parse.
Lengthcalc()Types KeyframesMap and KeyframeRule declarations with csstype Properties instead of DOM's CSSStyleDeclaration.
KeyframesMapKeyframeRuleCSSStyleDeclarationPropertiescsstypefont_families and lang options now take resolved values instead of raw strings.font_familieslangReplaces extractResourceUrls and fetchResources with prepareImages, which collects and fetches a node tree's remote images.
prepareImagesextractResourceUrlsfetchResourcesfetchCacheimagessourcesfetchtimeoutChanges
max-width and max-height to a MaxSize value with initial None, and column-gap, row-gap and gap to a Gap value with initial Normal.max-widthmax-heightMaxSizecolumn-gaprow-gapgapGapto_cssReplaces fetchResources and extractResourceUrls with prepareImages in @takumi-rs/helpers.
fetchResourcesextractResourceUrlsprepareImagesfetchCacheimagesReplaces
googleFont and googleFontSubsets with one object-shaped googleFonts.googleFontgoogleFontSubsetsgoogleFontsMakes fonts and images explicit per-render resources, dropping the persistent image store and GlobalContext.
GlobalContextregisterFontloadFontloadFontSyncloadFontsfontFamiliesimagesfetchedResourcesMakes the Renderer constructor parameterless and registers fonts with registerFont.
RendererregisterFontMinimizes the public API: prelude exposes stable data structures, entry points at crate root, backends behind unstable feature, internals pub(crate).
takumi::preludeunstablepub(crate)Security5
fromJsx escapes text inside <svg> elements to prevent markup injection, and throws on invalid XML names and unsafe style values.
fromJsxsvgstyleEnforces allowUrl and maxBytes fetch policies on shared fetchCache hits.
fetchCacheallowUrlmaxBytesEnforces allowUrl on every redirect hop, following redirects manually up to 5 hops and re-checking each resolved target.
fetchOkallowUrlCaps image decode dimensions at 8192x8192 and limits GIF total-frame pixels to prevent decode-bomb OOM.
image::LimitsDecoders reject images beyond 8192x8192 and GIFs beyond a total-frame pixel budget, stopping decode-bomb OOM.
image::LimitsPlatform1
These packages, plus takumi-js and @takumi-rs/image-response, now require Node 20.19 or newer.
takumi-js@takumi-rs/image-responseDeprecations to plan for
Deprecated2
Deprecates
subsetOf and subsetRank; subsetOf now only sets the family name and subsetRank does nothing.googleFontssubsetOfsubsetRankFontResource::unicode_rangeRenames the
stylesheets render option to css; the old name still works and warns once.stylesheetscsstakumi-jstakumi-pdf