fix(deps): update bump-dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
debian (source)	final	digest	34cd9e9 → 9cc0800
debian (source)	stage	digest	34cd9e9 → 9cc0800
docker/dockerfile	syntax	minor	1.26 → 1.27
github.com/davidbyttow/govips/v2	require	minor	v2.18.0 → v2.19.0
github.com/go-sql-driver/mysql	require	patch	v1.10.0 → v1.10.1
golang (source)	stage	digest	484ef60 → 69a7b97
libops/.github (changelog)	workflow	digest	7277eac → 782ba8f
libvips		patch	8.18.5 → 8.18.6
mariadb (source)		digest	dd9b303 → 805c8e1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

davidbyttow/govips (github.com/davidbyttow/govips/v2)

v2.19.0

Compare Source

Highlights

• Streaming I/O: new LoadImageFromReader, SaveToWriter, and TranscodeStream for working with io.Reader/io.Writer instead of whole buffers (#​539). Stream loads sniff the file signature, so sub-formats like AVIF vs HEIF are still reported correctly (#​540)
• NewImageFromMemory: build an ImageRef from a raw pixel buffer (#​528)
• WebP TargetSize: new option on WebpExportParams, requires libvips 8.17.4+ (#​535)
• Kill flag: SetKill exposes libvips' image evaluation kill flag, for cancelling long-running work (#​537)
• BigTIFF image type detection (#​527)

Fixes

Several of these are memory-safety bugs that could crash a process. Upgrading is recommended.

• Fix SIGSEGV after a failed DrawRect: the error path unref'd the caller's image, so the later Close() or GC finalizer was a double-unref. Reachable from truncated JPEGs (#​547, #​549)
• Fix input double-unref in Join, which caused intermittent use-after-free crashes at unrelated call sites (#​531)
• Fix SetBlob: it passed the slice header to C instead of the backing array and panicked under cgocheck on any non-empty input (#​545, #​549)
• Fix a C string leak on every ExportMagick call (#​546, #​549)
• Keep ImageRef arguments alive across cgo calls in two-image ops (Composite, Insert, Join, ArrayJoin, BandJoin, Mapim, Maplut, Add, Subtract, Multiply, Divide), closing a GC finalization hazard (#​543)
• Fix background colors on 1 and 2-band greyscale images for Embed and friends (#​534, #​538)

Housekeeping

• Add AGENTS.md with contributor and agent guidance: cgo/memory rules, testing conventions, known local quirks (#​541, #​542)
• CI installs the libheif HEVC plugin so HEIC fixtures run (#​529)
• Bump golang.org/x/image to 0.41.0 and golang.org/x/net to 0.55.0 (#​533, #​532)
• Bump sharp in examples/tiff (#​536, #​548)

Thanks to @​antst, @​alon-ne, @​goodmartian, and @​joecorall for patches, and to @​svkoskin and @​OvOhao for detailed bug reports.

go-sql-driver/mysql (github.com/go-sql-driver/mysql)

v1.10.1

Compare Source

• Fix Config.FormatDSN() dropping Addr when Net is empty.
  It now uses the default tcp network so configs with only Addr round-trip correctly. (#​1770)

• Fix typed-nil json.RawMessage with interpolateParams=true being interpolated as an empty string.
  It is now interpolated as SQL NULL, matching server-side prepared statements. (#​1782)

• Add MariaDB 11.8 and 12.3 to the test matrix. (#​1774)

libvips/libvips (libvips)

v8.18.6

Compare Source

Changes since 8.18.5:

• openexrload: more validation [Hygge Halcyon]
• heifload: tag as UNTRUSTED for libheif before 1.23.2

Windows binaries here:

https://github.com/libvips/build-win64-mxe/releases/tag/v8.18.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.