v5.0.0-rc.13

v5.0.0-rc.13

SVG support (new)

• ImageOutputFormat::Svg variant (wire tag "svg"). Gated by new svg Cargo feature; included in no-ort-target, formats, full. Ships in WASM + Android.
• SvgOptions { sanitize: bool, render_dpi: f32 } — defaults: sanitize = true, render_dpi = 96.0 (clamped 1.0–600.0).
• SVG → PNG / JPEG / WebP / HEIF rasterization via resvg + usvg + tiny-skia.
• SVG → SVG sanitize on Native target strips <script>, external xlink:href/href, <foreignObject>, and JS event handlers.
• Raster → SVG returns new EncodeWarning::UnsupportedDirection. No auto-vectorization.
• Security caps: input ≤ 10 MB, render output ≤ 16384² pixels (~1 GB peak), render_dpi clamped. usvg image_href_resolver no-op blocks SSRF / filesystem reads.
• Sync pipeline path now also applies the image output format pass (closes WASM bypass).

CI / publish fixes

• EncoderUnavailable gated on heic (silences -D warnings dead-code on 9+ publish builds).
• Three Dockerfile.musl-* builds: cargo build --locked → --offline so the sed-trimmed manifest reconciles with the lock (unblocks 4 musl native builds).
• ci-e2e: prepend /usr/local/lib to LD_LIBRARY_PATH so the source-built libheif 1.23 takes precedence over apt's older version on the Zig job.
• Elixir + Ruby NIF Cargo.toml: pin alloc-stdlib = "=0.2.2" (brotli 8 trait drift fix).

alef pin 0.25.2 → 0.25.5

• 0.25.3: R extendr struct field escaping (pub r#type for serde-tagged enums).
• 0.25.4: Dart per-target feature #[cfg(feature = "X")] guards on enum variants (mobile Android/iOS cargo check now sees the correct ImageOutputFormat variant set).
• 0.25.5: trait-bridge adapter regression coverage across all 14 language bindings; before-hooks documentation and test.

Other

• kreuzberg-libheif bootstrapped on crates.io.