go.mod

module github.com/donislawdev/TestingFilesGenerator

// The compiler takes part in producing bytes, so its version is part of the
// byte stability contract (D11). This line is the floor: the oldest compiler
// the module admits, and the only one of the two below it that the compiler
// itself enforces.
//
// It is held equal to the toolchain line rather than left lower, and that is
// the whole point of it. A floor below the pin is a hole, because the toolchain
// line is consulted only when GOTOOLCHAIN allows a switch. Measured on
// 2026-09-06 with the floor at 1.26.5: GOTOOLCHAIN=go1.26.8 built this module,
// the binary answered 0.3.0-rc1, wrote 0.3.0-rc1 into every manifest, and
// produced different bytes for png, docx and targz. Same source, same version
// number, different files - which is the failure D11 exists to prevent.
//
// The cost is stated rather than hidden: nobody on Go 1.26 can build this from
// source any more. That was the owner's decision on 2026-09-06, on the argument
// that the alternative was not a working build but a build that lies about
// which version it is. Kept honest by TestTheBuildFloorIsThePinnedToolchainAndTheReadmeSaysSo,
// which also holds the sentence in README.md against this number. See
// docs/STACK.md.
go 1.27.2

// How the line above got to the number it carries. There used to be a separate
// "toolchain" directive here saying which compiler produces our binaries, and
// it is gone rather than forgotten: measured on 2026-09-06, Go refuses to build
// a module whose toolchain directive is not newer than its go directive, and
// once the floor was raised to meet the pin the two were the same number. The
// build says "updates to go.mod needed" until the directive is taken out. The
// comment is kept because the directive was never the valuable part - these
// four decisions and what each of them cost were.
//
// What now carries the pin instead is GO_VERSION in the three CI workflows, and
// TestTheBuildFloorIsThePinnedToolchainAndTheReadmeSaysSo holds all of those
// against this line and against README.md.
//
// Raised to 1.26.6 on 2026-08-13 because govulncheck reported five standard
// library vulnerabilities reachable from the window binary under 1.26.5 - among
// them net/url, crypto/tls and encoding/xml - all of them fixed in 1.26.6. The
// command line binary was clean. The byte stability guards were run under the
// new toolchain before this line moved and none of them shifted, so D11 holds
// and no major version is owed.
//
// Raised again to 1.26.7 on 2026-08-25, and the reason is different. That
// release is not a security one - it went out on 2026-08-19 with fixes to
// net/http, which only the window binary links and only through the toolkit.
// What was actually wrong is that the machine this is written on had already
// moved to 1.26.7, while this line and the workflow both said 1.26.6: a
// toolchain line is a floor, so the local build quietly used a compiler no CI
// job ever ran. For a project whose bytes are part of its contract, "green
// here" and "green there" have to mean the same compiler. The byte stability
// guards were run under 1.26.7 before this line moved and none of them
// shifted, so D11 holds and no major version is owed.
//
// Raised to 1.27.0 on 2026-09-01, and this one IS owed a major version. Go
// 1.27 changed compress/flate, so every format that puts bytes through deflate
// produces different ones - eleven of the fifty one pinned cases moved, and all
// seven of the pinned standard library paths. Sizes are unchanged and the same
// sizes are reachable. Decision by the owner, and the reason was not that the
// release is better: this machine builds other projects that are already on
// 1.27, a toolchain setting belongs to the account rather than to a project, so
// the two were taking it in turns. Staying meant a check before every command
// forever. Written up in docs/GO-127-MIGRATION.md.
//
// TAR.GZ could not be produced at all under 1.27 until this move, because its
// size arithmetic carried the gzip framing as a constant and the block that
// closes a level zero stream went from five bytes to two. It measures the
// framing now, so the next release moves the bytes again but does not stop the
// format from being written.
//
// Raised to 1.27.2 on 2026-10-13 because govulncheck reported ten standard
// library vulnerabilities reachable from the window binary under 1.27.0, in
// net/http, net/textproto, crypto/tls and html/template, all fixed in 1.27.2.
// The command line binary links none of those packages. The byte stability
// guards were run under 1.27.2 the same day - all 104 golden values and every
// pinned standard library path - and none shifted, so D11 holds and no major
// version is owed.

require (
	fyne.io/fyne/v2 v2.8.1
	github.com/gen2brain/gav1d v0.2.5
	github.com/gen2brain/jxl v0.2.0
	github.com/goccy/go-yaml v1.19.2
	github.com/nicksnyder/go-i18n/v2 v2.6.1
	golang.org/x/sys v0.48.0
	golang.org/x/text v0.42.0
)

require (
	fyne.io/systray v1.12.3-0.20260810170012-af4e8e793ec4 // indirect
	github.com/BurntSushi/toml v1.6.0 // indirect
	github.com/FyshOS/fancyfs v0.0.1 // indirect
	github.com/anthonynsimon/bild v0.14.0 // indirect
	github.com/clipperhouse/uax29/v2 v2.2.0 // indirect
	github.com/davecgh/go-spew v1.1.1 // indirect
	github.com/fsnotify/fsnotify v1.9.0 // indirect
	github.com/fyne-io/gl-js v0.2.1-0.20260315212741-029c47fd27e8 // indirect
	github.com/fyne-io/glfw-js v0.4.0 // indirect
	github.com/fyne-io/image v0.1.1 // indirect
	github.com/fyne-io/oksvg v0.2.0 // indirect
	github.com/go-gl/gl v0.0.0-20260331235117-4566fea9a276 // indirect
	github.com/go-gl/glfw/v3.4/glfw v0.1.0-pre.1.0.20260707082822-2a407d02d01a // indirect
	github.com/go-text/render v0.2.1 // indirect
	github.com/go-text/typesetting v0.3.4 // indirect
	github.com/godbus/dbus/v5 v5.2.2 // indirect
	github.com/hack-pad/go-indexeddb v0.3.2 // indirect
	github.com/hack-pad/safejs v0.1.0 // indirect
	github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade // indirect
	github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 // indirect
	github.com/mattn/go-runewidth v0.0.24 // indirect
	github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
	github.com/pmezard/go-difflib v1.0.0 // indirect
	github.com/rymdport/portal v0.4.2 // indirect
	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c // indirect
	github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef // indirect
	github.com/stretchr/testify v1.11.1 // indirect
	github.com/yuin/goldmark v1.8.2 // indirect
	golang.org/x/image v0.46.0 // indirect
	golang.org/x/net v0.57.0 // indirect
	gopkg.in/yaml.v3 v3.0.1 // indirect
)

// The OpenGL binding, with one change: the window binary must not import
// opengl32.dll at load time. Measured on 2026-09-17 (docs/GUI-NO-OPENGL
// section 7): the upstream module links -lopengl32 and calls wglGetProcAddress
// directly, so the loader maps the system's opengl32.dll before a line of our
// code runs, and a software renderer loaded by path afterwards can never be
// the one the toolkit finds under that name. The copy under third_party looks
// the one symbol up at run time instead, which is the whole of the change -
// PATCH.md there says what was taken out and TestTheOpenGLBindingIsThePinnedModulePlusExactlyThePatch
// holds the copy to the pinned version plus that. Only two of its packages are
// carried, because only those two are imported. Dependabot does not bump a
// replaced module, so this line pins it as much as the version above does.
replace github.com/go-gl/gl => ./third_party/go-gl-gl