Skip to content

fix(deps): update dependencies - #21

Open
tannevaled wants to merge 1 commit into
mainfrom
renovate/deps
Open

fix(deps): update dependencies#21
tannevaled wants to merge 1 commit into
mainfrom
renovate/deps

Conversation

@tannevaled

@tannevaled tannevaled commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
github.com/go-ndarray/ndarray v0.34.0 → v0.41.0 age confidence require minor
github.com/go-notebook/notebook v0.12.0 → v0.14.0 age confidence indirect minor
github.com/go-statistics/stats v0.1.0 → v0.1.1 age confidence require patch
hugo 0.169.0 → 0.170.0 age confidence uses-with minor

Release Notes

go-ndarray/ndarray (github.com/go-ndarray/ndarray)

v0.41.0

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.40.3...v0.41.0

v0.40.3

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.40.2...v0.40.3

v0.40.2

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.40.1...v0.40.2

v0.40.1

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.40.0...v0.40.1

v0.40.0

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.39.0...v0.40.0

v0.39.0

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.38.1...v0.39.0

v0.38.1

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.38.0...v0.38.1

v0.38.0

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.37.5...v0.38.0

v0.37.5

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.37.4...v0.37.5

v0.37.4

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.37.3...v0.37.4

v0.37.3

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.37.2...v0.37.3

v0.37.2

Compare Source

What's Changed

  • floats v0.10.0: drop the max/min zero fallback and the moved sum/elementwise assembly by @​tannevaled in #​100

Full Changelog: go-ndarray/ndarray@v0.37.1...v0.37.2

v0.37.1

Compare Source

SumP runs on several cores again, with the bits of floats.SumPairwise (NumPy order) whatever the core count: it cuts the NumPy pairwise tree where NumPy cuts it and adds the subtrees back up the same tree (#​99). Results are unchanged from v0.37.0.

v0.37.0

Compare Source

K1 of the go-scikit performance campaign (go-scikit/roadmap#27): ndarray imports go-simd/floats v0.9.0.

Changed result: Sum (and mean, var, std built on it) is now NumPy's pairwise sum (floats.SumPairwise), bit-identical to np.sum of a contiguous 1-D float64 array on every architecture. It replaces lane-parallel sums whose last bits differed from NumPy's and between architectures; it is serial at every size.

Exp, Log and the correctly rounded float32 Exp/Log, and on amd64/arm64 the float64 add/sub/mul/div/sqrt/max/min/clip kernels, are go-simd/floats' (the AVX2 and NEON exp/log kernels written here moved down: #​94, #​95, #​96).

v0.36.0

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.35.0...v0.36.0

v0.35.0

Compare Source

What's Changed

Full Changelog: go-ndarray/ndarray@v0.34.0...v0.35.0

go-notebook/notebook (github.com/go-notebook/notebook)

v0.14.0

Compare Source

What's Changed

Full Changelog: go-notebook/notebook@v0.13.1...v0.14.0

v0.13.1

Compare Source

What's Changed

Full Changelog: go-notebook/notebook@v0.13.0...v0.13.1

v0.13.0

Compare Source

What's Changed

Full Changelog: go-notebook/notebook@v0.12.0...v0.13.0

go-statistics/stats (github.com/go-statistics/stats)

v0.1.1

Compare Source

Allocation fixes found by the new SciPy comparison harness (bench/, refbench v0.1.2); results unchanged.

  • Dirichlet.LogPDFPoints/PDFPoints: one buffer instead of a copy per point (50003 -> 4 allocations for 100000 points).
  • Requires go-numerics/special v0.5.3: t/f/beta ppf and isf no longer allocate per call.
  • bench/: 452 rows against scipy.stats 1.18.1 (migrated from the previous harness), checked data parity, perf CI job, docs/perf-exempt.md counted from the module's registry. No timing verdict (load above the gate, #​18).

Refs #​18, #​19, #​20.

gohugoio/hugo (hugo)

v0.170.0

Compare Source

The big change in this release is that the extended edition of Hugo is gone. LibSass has been deprecated for a long time, and it was the only remaining reason we needed a CGO-enabled extended build. There is now only one Hugo binary, and apart from LibSass it has all the features the extended build had.

Notes
  • Setting transpiler to libsass in css.Sass now returns an error. Dart Sass is now the default and the only transpiler, so you need to install it if you use Sass.
  • We no longer publish hugo_extended_* archives. To avoid breaking existing CI setups, we publish aliases for the most downloaded extended archives (e.g. hugo_extended_<version>_linux-amd64.tar.gz, hugo_extended_<version>_Linux-64bit.tar.gz, the linux-amd64.deb, linux-arm64.tar.gz and windows-amd64.zip), but you should update your scripts to use the standard archives. The extended_withdeploy builds are also removed. See Installation.
  • hugo.IsExtended now always returns false, and the module config setting hugoVersion.extended is deprecated and has no effect.
  • Command-line flags (e.g. --buildDrafts) now override OS environment variables (e.g. HUGO_BUILDDRAFTS). This also fixes HUGO_ENVIRONMENT=qa hugo build -e staging loading the staging config but reporting qa in hugo.Environment.
  • strings.Truncate has been rewritten on top of a proper HTML scanner. It now handles comments, void elements, quoted attributes with > and raw text elements such as script correctly, and it's faster and allocates less. On a curious note, the old version was implemented by Mathias Biilmann, the Netlify CEO.
  • time.Time values now keep their named time zone, and eq, ne, in and uniq compare time.Time values by instant.
  • resources.Match and friends now preserve the directory casing in the matched paths, so e.g. resources.Match "gallery/Travel/Iceland/*" now works on case-sensitive file systems.
  • Syncing of static files is much faster for big unchanged files, as we now skip the content check for files with the same size and modification time.
  • Several fixes and hardening of the WASM based image codecs (AVIF crash at encoderSpeed 6 and lower, recovering from broken WASM instances in the server).
Security
Hugo
  • Passthrough content is now HTML escaped when no passthrough render hook is set, unless markup.goldmark.renderer.unsafe is enabled. Before this, e.g. \(<img src=x onerror=alert(1)>\) in a content file emitted raw HTML.
  • The wrapperClass option, settable from the highlight shortcode and transform.Highlight, is now escaped.
  • Vendored module paths are now restricted to the _vendor directory (symlinks pointing outside are rejected).

Thanks to @​R0X4R for finding and reporting the last two issues.

Go

This release is built with Go 1.27.4, which includes 12 security fixes. The one most relevant for Hugo is a crash in the net/http HTTP/1 server (used by hugo server) caused by a race in MaxBytesReader. The other 11 are in the cmd/go toolchain (cgo flag and linker injection at build time) and mainly matter if you build Hugo from source with untrusted dependencies.

Dependencies
  • golang.org/x/net v0.62.0 fixes two issues in the html package: quadratic complexity when coalescing text nodes, and a namespace issue when rendering raw text. Hugo uses this package when collecting HTML elements for hugo_stats.json and in the AsciiDoc integration.
  • github.com/go-jose/go-jose/v4 v4.1.6 (indirect dependency) contains a number of security fixes, among them GHSA-mgcc-cww5-fp2q (RSA modulus size limit when parsing JWKs) and a stack depth limit in the JSON decoder.
Changes
Dependency Updates
Documentation

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@tannevaled

tannevaled commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: example/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
github.com/go-embedded-c/c v0.2.0 -> v0.2.1
github.com/go-embedded-r/r v0.4.0 -> v0.13.1
github.com/go-numerics/optimize v0.1.0 -> v0.6.0
github.com/go-numerics/special v0.1.0 -> v0.5.3
github.com/go-regexp/engine v0.3.2 -> v0.4.2
github.com/go-rouge/rouge v0.8.1 -> v0.9.0
github.com/go-ruby-regexp/regexp v0.1.1 -> v0.2.1

@tannevaled
tannevaled force-pushed the renovate/deps branch 5 times, most recently from 4674aff to 1d724b7 Compare November 13, 2026 21:25

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tannevaled