v2.19.0

Highlights

• Streaming I/O: new LoadImageFromReader, SaveToWriter, and TranscodeStream for working with io.Reader/io.Writer instead of whole buffers (#539). Stream loads sniff the file signature, so sub-formats like AVIF vs HEIF are still reported correctly (#540)
• NewImageFromMemory: build an ImageRef from a raw pixel buffer (#528)
• WebP TargetSize: new option on WebpExportParams, requires libvips 8.17.4+ (#535)
• Kill flag: SetKill exposes libvips' image evaluation kill flag, for cancelling long-running work (#537)
• BigTIFF image type detection (#527)

Fixes

Several of these are memory-safety bugs that could crash a process. Upgrading is recommended.

• Fix SIGSEGV after a failed DrawRect: the error path unref'd the caller's image, so the later Close() or GC finalizer was a double-unref. Reachable from truncated JPEGs (#547, #549)
• Fix input double-unref in Join, which caused intermittent use-after-free crashes at unrelated call sites (#531)
• Fix SetBlob: it passed the slice header to C instead of the backing array and panicked under cgocheck on any non-empty input (#545, #549)
• Fix a C string leak on every ExportMagick call (#546, #549)
• Keep ImageRef arguments alive across cgo calls in two-image ops (Composite, Insert, Join, ArrayJoin, BandJoin, Mapim, Maplut, Add, Subtract, Multiply, Divide), closing a GC finalization hazard (#543)
• Fix background colors on 1 and 2-band greyscale images for Embed and friends (#534, #538)

Housekeeping

• Add AGENTS.md with contributor and agent guidance: cgo/memory rules, testing conventions, known local quirks (#541, #542)
• CI installs the libheif HEVC plugin so HEIC fixtures run (#529)
• Bump golang.org/x/image to 0.41.0 and golang.org/x/net to 0.55.0 (#533, #532)
• Bump sharp in examples/tiff (#536, #548)

Thanks to @antst, @alon-ne, @goodmartian, and @joecorall for patches, and to @svkoskin and @OvOhao for detailed bug reports.