build(deps): bump github.com/davidbyttow/govips/v2 from 2.18.0 to 2.19.0

[dependabot]

Bumps github.com/davidbyttow/govips/v2 from 2.18.0 to 2.19.0.

Release notes

Sourced from github.com/davidbyttow/govips/v2's releases.

v2.19.0

Highlights

• Streaming I/O: new LoadImageFromReader, SaveToWriter, and TranscodeStream for working with io.Reader/io.Writer instead of whole buffers (#539). Stream loads sniff the file signature, so sub-formats like AVIF vs HEIF are still reported correctly (#540)
• NewImageFromMemory: build an ImageRef from a raw pixel buffer (#528)
• WebP TargetSize: new option on WebpExportParams, requires libvips 8.17.4+ (#535)
• Kill flag: SetKill exposes libvips' image evaluation kill flag, for cancelling long-running work (#537)
• BigTIFF image type detection (#527)

Fixes

Several of these are memory-safety bugs that could crash a process. Upgrading is recommended.

• Fix SIGSEGV after a failed DrawRect: the error path unref'd the caller's image, so the later Close() or GC finalizer was a double-unref. Reachable from truncated JPEGs (#547, #549)
• Fix input double-unref in Join, which caused intermittent use-after-free crashes at unrelated call sites (#531)
• Fix SetBlob: it passed the slice header to C instead of the backing array and panicked under cgocheck on any non-empty input (#545, #549)
• Fix a C string leak on every ExportMagick call (#546, #549)
• Keep ImageRef arguments alive across cgo calls in two-image ops (Composite, Insert, Join, ArrayJoin, BandJoin, Mapim, Maplut, Add, Subtract, Multiply, Divide), closing a GC finalization hazard (#543)
• Fix background colors on 1 and 2-band greyscale images for Embed and friends (#534, #538)

Housekeeping

• Add AGENTS.md with contributor and agent guidance: cgo/memory rules, testing conventions, known local quirks (#541, #542)
• CI installs the libheif HEVC plugin so HEIC fixtures run (#529)
• Bump golang.org/x/image to 0.41.0 and golang.org/x/net to 0.55.0 (#533, #532)
• Bump sharp in examples/tiff (#536, #548)

Thanks to @​antst, @​alon-ne, @​goodmartian, and @​joecorall for patches, and to @​svkoskin and @​OvOhao for detailed bug reports.

Commits

• f1d8d53 Fix three cgo memory bugs: DrawRect double-unref, SetBlob pointer, magick for...
• f005cdb Bump sharp from 0.35.0 to 0.35.4 in /examples/tiff (#548)
• ea03fac Add runtime.KeepAlive for ImageRef arguments in two-image ops (#543)
• 1159365 Correct AGENTS.md on ImageRef locking (#542)
• 67c3214 Add AGENTS.md with agent/contributor guidance (#541)
• 33bd986 Sniff stream signature to preserve sub-format detection (#540)
• 78f9044 Add streaming I/O: LoadImageFromReader, SaveToWriter, TranscodeStream (#539)
• 6a7b264 Bump golang.org/x/image from 0.38.0 to 0.41.0 (#533)
• ef9141c Fix background colors for 1/2-band greyscale images (#538)
• f181186 Bump golang.org/x/net from 0.52.0 to 0.55.0 (#532)
• Additional commits viewable in compare view

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[butonic]

@dependabot rebase