[yhay81]

Closes #617

Brings every dependency and pinned development tool to its newest release, except where a recorded reason holds it back. This awaits the owner's review.

Updates

Group	Changes
Rust	harfrust 0.13.3 → 0.15.0, skrifa 0.46.2 → 0.49.0, cms 0.3.0-rc.0 → 0.3.0-rc.1, aes 0.9.3 → 0.9.4, jpeg-encoder 0.7.0 → 0.7.1, unicode-script 0.5 → 0.5.9, libfuzzer-sys 0.4.12 → 0.4.13, and the transitive crates in both lockfiles
Python	pytest 9.1.1 → 9.2.0, ruff 0.17.2 → 0.17.3, ty 0.0.91 → 0.0.96, zensical 0.0.73 → 0.0.74, pyHanko 0.38.0 → 0.38.1, the maturin floor 1.15 → 1.16
Node	pdfjs-dist 6.4.299 → 6.5.438
Workflows	uv 0.13.5 → 0.13.7, maturin 1.15.0 → 1.16.0, rust-cache v2.9.3, setup-python v7.1.0, setup-uv v10.3.3, gh-action-pypi-publish v1.14.3 (fixes GHSA-5xjx-3w67-w9x9), the fuzz nightly 2026-10-10 → 2026-11-03, veraPDF greenfield-apps 1.28.1 → 1.28.2 and greenfield-apps-arlington 1.26.6 → 1.28.2

Already at the newest release: Rust 1.99.1, cargo-audit 0.22.2, actionlint 1.7.12, cargo-fuzz 0.13.2, the other actions, and the Arlington model.

Code that the releases required

• harfrust 0.15 owns its font data. ShapingFace no longer borrows the program, so Face.program becomes an Arc<Vec<u8>> that the shaper's font shares. Copying the program for each shaping call would have cost a whole font per call.
• Exhausted runs are now visible. harfrust reports a run that outgrows its allowance through Buffer::allocation_successful, and a face's own tables can provoke that. Shaping now refuses such a run as ShapeError::Font instead of reading a partial buffer. A new test builds a face whose GSUB multiplies one glyph far past that allowance, and it fails without the check.
• read-fonts 0.46 moved the charstring module, which fonts/cff.rs follows.
• Cargo.lock loses read-fonts 0.43.3 and skrifa 0.46.2. harfrust and skrifa now use the read-fonts that hayro uses, as DESIGN.md section 15 asks.

Held back

• pymupdf stays below 2. Its requirement on onnxruntime is unconditional, and onnxruntime 1.31.1 still has no wheel for Python 3.15, which the cap's comment names as the reason.
• The hayro patch stays, because hayro-interpret: Expose the font dictionary of a glyph run LaurenzV/hayro#1734 is still open (Build against released hayro again: remove the [patch.crates-io] of LaurenzV/hayro#1734 #603).
• evidence/ keeps its crates and lockfiles, which record what each measurement ran.
• harfrust's caller-set limits are not adopted: 0.15.0 has no public setter for them (Adopt harfrust's caller-set shaping limits once harfrust#571 ships #580).

Acceptance

• Each direct Rust dependency of the workspace and fuzz/ requires its newest release, on the prerelease line where the manifest already follows one.
• harfrust and skrifa use the read-fonts that hayro uses, so that Cargo.lock holds no copy of read-fonts for the engine alone.
• uv.lock and tools/pdfjs/package-lock.json hold the newest versions that their requirements allow, and the floors in pyproject.toml follow them.
• Each action pin names the commit of the newest release's tag, and the veraPDF digests come from the jars on Maven Central, each checked against its published SHA-1.
• python3 tools/check.py --locked, cargo-audit audit --deny warnings, and actionlint pass.
• CI, Fuzz, Docs, and Windows pass on the current head.

Checks beyond the acceptance list

• Shaping against the previous build: 182 cases of 14 texts in 13 fonts, with Latin, combining marks, Hebrew, Arabic, CJK, Hangul, Thai, Devanagari, Bengali, and Tamil. Widths and missing-glyph errors are identical, and the 60 cases that draw save byte-identical PDFs.
• tools/oracles.py --readers pdfjs: 21 documents and 798 saves, with no unexplained differences.
• Both documentation sites build in strict mode with zensical 0.0.74.

This makes no performance claim.

Not exercised here

• The local run is on Windows without qpdf or poppler, and 691 tests skip there. CI installs both on Linux. veraPDF and the fuzz nightly also run only in CI, and a new veraPDF rejection needs a fix or a REJECTED entry with an issue.
• release.yml runs only on tags and by hand, so no pull request exercises its new pins. workflow_dispatch builds and smoke-tests every platform without publishing, at the cost of macOS and Windows minutes.

🤖 Generated with Claude Code