Refresh compatible dependencies for NetPdf 1.1.0 - #355
Merged
Conversation
Copilot created this pull request from a session on behalf of
raroche
July 27, 2026 18:40
View session
There was a problem hiding this comment.
Pull request overview
Consolidates dependency-refresh work for a NetPdf 1.1.0 release, updating core runtime/test/tooling packages and adjusting SkiaSharp call sites to remain compatible with SkiaSharp 4.x, while updating CI actions accordingly.
Changes:
- Bumped runtime dependencies (AngleSharp, SkiaSharp, HarfBuzzSharp) and refreshed test/build tooling versions.
- Updated SkiaSharp call sites to use SkiaSharp 4.x-compatible APIs (text drawing, path construction, bitmap/image sampling).
- Bumped release/version surfaces to 1.1.0 and updated CI workflows to newer actions.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/NetPdf.UnitTests/Pdf/Images/TextShadowRasterizerTests.cs | Adjusts glyph lookup to use SKFont for SkiaSharp 4.x compatibility. |
| tests/NetPdf.UnitTests/HtmlPdfFacadeTests.cs | Updates version surface assertion to 1.1.0. |
| src/NetPdf.Svg/SvgText.cs | Migrates text drawing calls to SkiaSharp 4.x overloads. |
| src/NetPdf.Svg/SvgRasterizer.cs | Switches shape construction to SKPathBuilder; updates image drawing overloads with sampling options. |
| src/NetPdf.Svg/SvgClipMask.cs | Migrates clip-path geometry union to SKPathBuilder. |
| src/NetPdf.Pdf/Images/TextShadowRasterizer.cs | Updates glyph-union path construction to SKPathBuilder APIs. |
| src/NetPdf.Pdf/Images/ImageMaskApplier.cs | Updates bitmap drawing calls to SkiaSharp 4.x overloads with sampling options. |
| src/NetPdf.Pdf/Images/ImageFilterApplier.cs | Updates bitmap drawing calls to SkiaSharp 4.x overloads with sampling options. |
| Directory.Packages.props | Refreshes central package versions (runtime + tooling). |
| Directory.Build.props | Bumps VersionPrefix to 1.1.0 and updates package validation baseline version. |
| CHANGELOG.md | Adds 1.1.0 entry and updates compare links. |
| build/version.json | Bumps informational version and last-updated date. |
| .github/workflows/release.yml | Updates setup-dotnet action to v6. |
| .github/workflows/fuzz-smoke.yml | Updates setup-dotnet action to v6. |
| .github/workflows/docs.yml | Updates setup-dotnet action to v6. |
| .github/workflows/codeql.yml | Updates setup-dotnet to v6 and codeql-action to v4. |
| .github/workflows/ci.yml | Updates setup-dotnet action to v6. |
| .github/workflows/capture-benchmark-baseline.yml | Updates setup-dotnet action to v6. |
Comments suppressed due to low confidence (1)
Directory.Packages.props:45
- The visual-regression harness comment still says the repo-wide SkiaSharp pin "matches" PDFtoImage’s SkiaSharp floor (3.119.2). Since SkiaSharp is now pinned to 4.150.1, this comment is misleading and should be updated to reflect that the pin satisfies the minimum requirement rather than matching it.
<!-- Visual-regression harness (PR 8): PDFium (via PDFtoImage, ships bblanchon.PDFium native for
macOS/Linux/Win) rasterizes the NetPdf PDF -> RGBA; SkiaSharp only WRITES PDF. Its SkiaSharp floor is
3.119.2 — the repo-wide SkiaSharp pin above matches it, so the harness measures the same renderer
dependency set as production. -->
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
PR #355 review follow-up. [P2] The 1.1.0 package still shipped v1.0 launch copy. Directory.Build.props claimed the release notes "carry no version string", but the value was "First stable release." — true for exactly one release, and the generated NetPdf.1.1.0.nuspec confirmed it shipped. build/version.json likewise still described phase 5 as "Packaging & release (v1.0 launch)" at version 1.1.0. Both are now release-agnostic, and a new ReleaseVersionParityTests guard (Release_metadata_carries_no_version_specific_language) fails on a semver-ish token or a "first/initial release" claim in either surface, so this cannot recur silently. Verified non-vacuous: reintroducing each original string fails the guard with an actionable message. [P3] The visual-regression dependency comment went stale with the SkiaSharp 4.x bump — it said PDFtoImage's 3.119.2 floor "matches" the repo-wide pin, which is now 4.150.1. Rewritten to state the floor, the intentional 4.150.1 production pin, why NuGet unification keeps the harness representative, and the real tradeoff (PDFtoImage runs against a newer SkiaSharp than it compiled against, so RenderingCorpus is what proves no 3.x API was removed). Verified: build 0 errors; UnitTests 8607 passed / 3 skipped; RenderingCorpus 41 passed; RealDocuments 105 passed; dotnet pack re-checked — the 1.1.0 nuspec now carries the corrected notes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
raroche
marked this pull request as ready for review
July 27, 2026 19:17
raroche
added a commit
that referenced
this pull request
Jul 27, 2026
…deferral The `ci-nonblocking-platform-native-deps` deferral's own removal condition — "both non-blocking legs pass the Test step in CI (green)" — is now met, and its premise is obsolete. It was written when libSkiaSharp genuinely would not load on those images (arm64: `undefined symbol: uuid_generate_random`, then FT_Get_BDF_Property; alpine: musl native-load failure). That is fixed: the fontconfig-hardening step plus the apk prerequisites, together with the SkiaSharp 4.150.1 bump (#355), load the native cleanly. The evidence is that both legs were running 8604 of 8609 tests, and their only failures were two font-dependent ASSERTIONS — AutoHeightFlexTimelineFooterTests, fixed in #356 — never a native-load error. Both have since run the full suite green. - linux-arm64 loses `nonblocking: true`; the alpine job loses `continue-on-error: true`. Both are renamed accordingly (the ", non-blocking" suffix is part of the check name). Neither name is in branch protection's required contexts today, so no existing required check breaks. - macos-x64 stays non-blocking and keeps its own deferral: hosted Intel-mac runner availability, which nothing in this repo can fix. - Deferral removed from docs/deferrals.md + DeferralsParityTests (the documented convention for picking one up), and the macos-x64 entry's cross-reference rewritten so it no longer points at a deleted anchor. NOTE for the maintainer: making these legs enforcing turns the WORKFLOW red on failure, but it does not block a merge until the two renamed contexts are added to branch protection's required checks — worth doing alongside `benchmark gate (linux-x64)`, which is still not required. (PROGRESS.md was also rolled, but it is gitignored — untracked deliberately in #284 as an internal doc — so it stays local and out of this PR.) Verified: build 0 errors; UnitTests 8614 passed / 3 skipped (incl. DeferralsParityTests); git diff --check clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
raroche
added a commit
that referenced
this pull request
Jul 27, 2026
…deps deferral (#357) * ci: promote linux-arm64 + alpine to enforcing; close the native-deps deferral The `ci-nonblocking-platform-native-deps` deferral's own removal condition — "both non-blocking legs pass the Test step in CI (green)" — is now met, and its premise is obsolete. It was written when libSkiaSharp genuinely would not load on those images (arm64: `undefined symbol: uuid_generate_random`, then FT_Get_BDF_Property; alpine: musl native-load failure). That is fixed: the fontconfig-hardening step plus the apk prerequisites, together with the SkiaSharp 4.150.1 bump (#355), load the native cleanly. The evidence is that both legs were running 8604 of 8609 tests, and their only failures were two font-dependent ASSERTIONS — AutoHeightFlexTimelineFooterTests, fixed in #356 — never a native-load error. Both have since run the full suite green. - linux-arm64 loses `nonblocking: true`; the alpine job loses `continue-on-error: true`. Both are renamed accordingly (the ", non-blocking" suffix is part of the check name). Neither name is in branch protection's required contexts today, so no existing required check breaks. - macos-x64 stays non-blocking and keeps its own deferral: hosted Intel-mac runner availability, which nothing in this repo can fix. - Deferral removed from docs/deferrals.md + DeferralsParityTests (the documented convention for picking one up), and the macos-x64 entry's cross-reference rewritten so it no longer points at a deleted anchor. NOTE for the maintainer: making these legs enforcing turns the WORKFLOW red on failure, but it does not block a merge until the two renamed contexts are added to branch protection's required checks — worth doing alongside `benchmark gate (linux-x64)`, which is still not required. (PROGRESS.md was also rolled, but it is gitignored — untracked deliberately in #284 as an internal doc — so it stays local and out of this PR.) Verified: build 0 errors; UnitTests 8614 passed / 3 skipped (incl. DeferralsParityTests); git diff --check clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(ci): track the un-applied branch-protection contexts as a deferral PR #357 review [P2] — valid, and it names a gap this PR itself created. Promoting linux-arm64 + alpine made them WORKFLOW-enforcing (a failure turns the run red) but NOT merge-enforcing: `main`'s branch protection still requires only build+test (linux-x64) / (windows-x64) / (macos-arm64), security-gate and dependency-scan — verified against the live API. Deleting the old `ci-nonblocking-platform-native-deps` entry removed the only thing tracking the remaining step, so it could quietly be forgotten. The reviewer offered either applying the setting or keeping a tracked follow-up. Applying it is a repository SETTING that needs admin rights and cannot land through a PR, so this takes the tracked-follow-up option and records it properly: - New deferral `ci-branch-protection-required-contexts` (P2) states the current required list, the three checks missing from it, and the exact `gh api` command — including the trap that the API REPLACES the context list, so all eight must be sent, and that the two renamed checks must not be re-added under their old ", non-blocking" names. - Rated P2, not P3, because the third missing context is `benchmark gate (linux-x64)`: until it is required, a genuine perf regression reports red and still merges, which silently weakens the CLAUDE.md performance contract. - ci.yml now carries a CAVEAT next to "Enforcing matrix" pointing at the deferral, so the distinction is visible where the enforcement is declared. - Registered in DeferralsParityTests (IDs + P2 priority), which is what makes the entry impossible to drop silently. Verified: build 0 errors; UnitTests 8614 passed / 3 skipped; branch-protection contexts re-read from the API to confirm the entry's factual claims. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reviews and consolidates the stale open dependency PRs into a single minor-version refresh. Applies compatible runtime, tooling, and CI updates while holding updates that currently regress behavior.
Dependency updates
Held updates
Release/versioning
Compatibility cleanup