build(deps): bump github.com/davidbyttow/govips/v2 from 2.18.0 to 2.19.0

[dependabot]

Bumps github.com/davidbyttow/govips/v2 from 2.18.0 to 2.19.0.

Release notes

Sourced from github.com/davidbyttow/govips/v2's releases.

v2.19.0

Highlights

• Streaming I/O: new LoadImageFromReader, SaveToWriter, and TranscodeStream for working with io.Reader/io.Writer instead of whole buffers (#539). Stream loads sniff the file signature, so sub-formats like AVIF vs HEIF are still reported correctly (#540)
• NewImageFromMemory: build an ImageRef from a raw pixel buffer (#528)
• WebP TargetSize: new option on WebpExportParams, requires libvips 8.17.4+ (#535)
• Kill flag: SetKill exposes libvips' image evaluation kill flag, for cancelling long-running work (#537)
• BigTIFF image type detection (#527)

Fixes

Several of these are memory-safety bugs that could crash a process. Upgrading is recommended.

• Fix SIGSEGV after a failed DrawRect: the error path unref'd the caller's image, so the later Close() or GC finalizer was a double-unref. Reachable from truncated JPEGs (#547, #549)
• Fix input double-unref in Join, which caused intermittent use-after-free crashes at unrelated call sites (#531)
• Fix SetBlob: it passed the slice header to C instead of the backing array and panicked under cgocheck on any non-empty input (#545, #549)
• Fix a C string leak on every ExportMagick call (#546, #549)
• Keep ImageRef arguments alive across cgo calls in two-image ops (Composite, Insert, Join, ArrayJoin, BandJoin, Mapim, Maplut, Add, Subtract, Multiply, Divide), closing a GC finalization hazard (#543)
• Fix background colors on 1 and 2-band greyscale images for Embed and friends (#534, #538)

Housekeeping

• Add AGENTS.md with contributor and agent guidance: cgo/memory rules, testing conventions, known local quirks (#541, #542)
• CI installs the libheif HEVC plugin so HEIC fixtures run (#529)
• Bump golang.org/x/image to 0.41.0 and golang.org/x/net to 0.55.0 (#533, #532)
• Bump sharp in examples/tiff (#536, #548)

Thanks to @​antst, @​alon-ne, @​goodmartian, and @​joecorall for patches, and to @​svkoskin and @​OvOhao for detailed bug reports.

Commits

• f1d8d53 Fix three cgo memory bugs: DrawRect double-unref, SetBlob pointer, magick for...
• f005cdb Bump sharp from 0.35.0 to 0.35.4 in /examples/tiff (#548)
• ea03fac Add runtime.KeepAlive for ImageRef arguments in two-image ops (#543)
• 1159365 Correct AGENTS.md on ImageRef locking (#542)
• 67c3214 Add AGENTS.md with agent/contributor guidance (#541)
• 33bd986 Sniff stream signature to preserve sub-format detection (#540)
• 78f9044 Add streaming I/O: LoadImageFromReader, SaveToWriter, TranscodeStream (#539)
• 6a7b264 Bump golang.org/x/image from 0.38.0 to 0.41.0 (#533)
• ef9141c Fix background colors for 1/2-band greyscale images (#538)
• f181186 Bump golang.org/x/net from 0.52.0 to 0.55.0 (#532)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

🟢 Coverage ∅ diff coverage · +0.01% coverage variation

Metric	Results
Coverage variation	✅ +0.01% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (f7e6d5d)	89085	21492	24.13%
Head commit (687693a)	89085 (+0)	21502 (+10)	24.14% (+0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#3597)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}