Skip to content

Trim native and image runtime payloads - #182

Open
balazs-szucs wants to merge 1 commit into
Stirling-Tools:mainfrom
balazs-szucs:perf/trim-native-deps
Open

balazs-szucs wants to merge 1 commit into
Stirling-Tools:mainfrom
balazs-szucs:perf/trim-native-deps

Conversation

@balazs-szucs

@balazs-szucs balazs-szucs commented Oct 21, 2026 •

Copy link
Copy Markdown
Collaborator

Description of Changes

Platform Core upstream/main (MiB) Core trimmed (MiB) Core Δ Vips upstream/main (MiB) Vips trimmed (MiB) Vips Δ Core+Vips Δ
darwin-arm64 27.67 23.34 -4.33 28.15 17.56 -10.59 -14.92
darwin-x64 31.31 26.77 -4.54 31.58 20.57 -11.01 -15.55
linux-arm64 36.03 32.74 -3.29 36.16 23.81 -12.35 -15.64
linux-x64 37.79 34.31 -3.48 36.72 25.13 -11.58 -15.06
linux-musl-arm64 36.19 32.86 -3.33 28.83 26.21 -2.62 -5.95
linux-musl-x64 38.58 35.18 -3.40 30.05 27.26 -2.79 -6.19
windows-arm64 34.87 33.15 -1.72 23.07 23.86 +0.79 -0.93
windows-x64 38.29 36.38 -1.91 26.89 24.86 -2.02 -3.93
8-platform total 280.73 254.73 -26.00 241.45 189.26 -52.19 -78.19

Checklist

General

  • I have read the Contributing Guide
  • I have performed a self-review of my own code
  • My changes generate no new warnings
  • Notable user-facing changes are recorded under ## [Unreleased] in CHANGELOG.md

Library changes

  • Javadoc covers any new or changed public type or member
  • Public API changes are additive, or .github/workflows/compatibility.yml excludes the break with a reason
  • Version references stay consistent across the README, docs/installation.md, and the POMs

Native or FFM changes

  • Rebuilt the bridge with bash native/build-real.sh
  • Ran ./gradlew :jpdfium:integrationTest
  • Updated native/bridge/include/jpdfium.h and the ABI notes for any ABI change

Testing

  • Added or updated tests that cover the change
  • ./gradlew test passes

@coderabbitai

coderabbitai Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • ✅ Review completed - (🔄 Check again to review again)

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between c2b30ab and 80a8dcb.

Files selected for processing: 2
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details
Additional context used
Code guidelines: 1
.github/CODERABBIT_REVIEW.md — configured
Path-based instructions: 3
Enforce meaningful assertions, deterministic concurrency, failure-path cleanup, and explicit native/stub requirements.

CodeRabbit configuration file

Files:

  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
Apply the Java 25 and FFM rules from .github/CODERABBIT_REVIEW.md.

CodeRabbit configuration file

Files:

  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
Source excerpt: Use imports rather than package-qualified type names in method bodies and signatures.

CodeRabbit inference engine (.github/CODERABBIT_REVIEW.md)

Files:

  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
📝 Summary

Summary by CodeRabbit

  • New Features

    • Added multi-page TIFF encoding through the optional libvips module.
    • Added optional libvips native builds for Linux musl and FreeBSD x64. FreeBSD is available as a prebuild; release availability depends on a pinned asset.
    • Added FreeBSD installation guidance.
  • Improvements

    • jpdfium no longer publishes a platform-native dependency; select a native module for your platform.
    • Baseline and multi-page TIFF output use JDK ImageIO by default. Use libvips or an ImageIO plugin for advanced TIFF variants.
    • Improved AVIF codec support in libvips builds.
  • Documentation

    • Updated platform and TIFF compatibility guidance and added bundled third-party license notices.

This pull request adds multi-page TIFF encoding through the image codec API and expands native artifact building and packaging, including FreeBSD libvips support. It also updates native dependency checks, CI workflows, release publishing, and documentation.

Changes: TIFF encoding

Layer / File(s) Summary
Codec contract and TIFF dispatch
jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java, jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
The codec SPI adds optional multi-page TIFF methods. Core TIFF writing uses a registered codec when supported and falls back to ImageIO.
libvips TIFF encoding and validation
jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/*, jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
The libvips codec encodes RGBA frames as TIFF pages. Tests cover round-trips, image layouts, and subimages.
TIFF support documentation
CHANGELOG.md, docs/compatibility.md, docs/images.md, docs/rendering.md
The documentation describes JDK ImageIO support, libvips encoding, and plugin requirements for advanced TIFF variants.

Native artifacts and workflows

Layer / File(s) Summary
Native dependency and codec builds
native/build-*.sh, native/vips-build.env, native/vcpkg-vips/vcpkg.json
Build scripts configure qpdf, HarfBuzz, ICU, libvips, AOM, and dav1d. They add FreeBSD handling and remove PDFium integration from libvips.
Runtime bundling and validation
native/bundle-runtime-deps.sh, native/check-bundle-*, native/check-no-execstack.sh, native/check-vips-codecs.sh, .github/scripts/check-native-symbols.sh, native/library-size-budgets.txt
The bundler updates platform dependency lookup and macOS dependency checks. Validation adds per-library size ceilings and staged libvips codec checks.
Native packaging and platform setup
buildSrc/src/main/kotlin/jpdfium.natives-conventions.gradle.kts, jpdfium/build.gradle.kts, jpdfium-bom/build.gradle.kts, jpdfium-natives/..., jpdfium-vips/build.gradle.kts, settings.gradle.kts, native/licenses/*, native/size-budgets.txt, README.md, docs/installation.md
Gradle stages platform-specific licenses, gates publication on staged native files, and adds FreeBSD vips artifacts. Native notices, size budgets, and platform documentation are updated.
Prebuild, release, and CI workflows
.github/workflows/*, native/ci/musl.sh, native/fetch-prebuilt-pdfium.sh
Workflows add FreeBSD builds, repository fallbacks, checksum verification, and dry-run publishing. Drift workflows handle issue-creation failures based on repository settings.

Possibly related issues

  • Stirling-Tools/Stirling-PDF#6386: The changes add native export checks, but do not describe changes addressing missing EPDFAnnot_* exports in the signing path.
  • Stirling-Tools/Stirling-PDF#8321: The changes update native artifact packaging and platform payloads, but do not specifically address the missing Windows x64 runtime artifact.

Priority: Normal

Change: Feature

Merge Risk: High · up to 80a8d

Native packaging and release risks remain unresolved, including paths that may publish incorrect artifacts or skip validation. Resolve the material build and release concerns before merging.

Pre-merge checks: Passed 4
Check name Status Explanation
Title check Passed The title clearly summarizes the primary objective: reducing native and image runtime payload sizes.
Description check Passed The description provides detailed size results and covers most template sections. Several checklist items remain unchecked, including integration tests and the full test suite, but the description is …
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description provides detailed size results and covers most template sections. Several checklist items remain unchecked, including integration tests and the full test suite, but the description is not largely incomplete.

Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

coderabbitai[bot]

This comment was marked as resolved.

@balazs-szucs
balazs-szucs force-pushed the perf/trim-native-deps branch 2 times, most recently from 4536149 to 5cda0d3 Compare October 21, 2026 17:17
@balazs-szucs

Copy link
Copy Markdown
Collaborator Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Oct 21, 2026 •

Copy link
Copy Markdown
✅ Action performed

Full review finished.

coderabbitai[bot]

This comment was marked as resolved.

@balazs-szucs
balazs-szucs force-pushed the perf/trim-native-deps branch 12 times, most recently from 1a54bd4 to ee940e7 Compare October 22, 2026 23:37
@balazs-szucs

Copy link
Copy Markdown
Collaborator Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •

Copy link
Copy Markdown
✅ Action performed

Full review finished.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 10


ℹ️ Review info
⚙️ Run configuration
📥 Commits

Reviewing files that changed from the base of the PR and between 5a35fef and ee940e7.

📒 Files selected for processing: 65
  • .github/scripts/check-native-symbols.sh
  • .github/workflows/ci.yml
  • .github/workflows/pdfium-drift.yml
  • .github/workflows/prebuild-vips.yml
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • .github/workflows/vips-drift.yml
  • CHANGELOG.md
  • README.md
  • buildSrc/src/main/kotlin/jpdfium.natives-conventions.gradle.kts
  • docs/compatibility.md
  • docs/images.md
  • docs/installation.md
  • docs/rendering.md
  • jpdfium-bom/build.gradle.kts
  • jpdfium-natives/jpdfium-natives-vips-freebsd-x64/build.gradle.kts
  • jpdfium-vips/build.gradle.kts
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsAvailability.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsEncoder.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsImageCodec.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsSmokeTest.java
  • jpdfium/build.gradle.kts
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • native/build-harfbuzz-no-glib.sh
  • native/build-minimal-icu.sh
  • native/build-qpdf-native-crypto.sh
  • native/build-vips-full-codecs.sh
  • native/build-vips.sh
  • native/bundle-runtime-deps.sh
  • native/check-bundle-hermetic.sh
  • native/check-bundle-lean.sh
  • native/check-bundle-orphans.sh
  • native/check-bundle-size.sh
  • native/check-no-execstack.sh
  • native/check-vips-codecs.sh
  • native/ci/musl.sh
  • native/fetch-prebuilt-pdfium.sh
  • native/library-size-budgets.txt
  • native/licenses/ABSEIL-APACHE-2.0.txt
  • native/licenses/AOM-BSD-2.txt
  • native/licenses/BROTLI-MIT.txt
  • native/licenses/BZIP2.txt
  • native/licenses/DAV1D-BSD-2.txt
  • native/licenses/DAV1D-ISC.txt
  • native/licenses/GETTEXT-LGPL-2.1.txt
  • native/licenses/LIBDEFLATE-MIT.txt
  • native/licenses/LIBEXIF-LGPL-2.1.txt
  • native/licenses/LIBEXPAT-MIT.txt
  • native/licenses/LIBFFI-MIT.txt
  • native/licenses/LIBICONV-LGPL-2.1.txt
  • native/licenses/LIBINOTIFY-MIT.txt
  • native/licenses/LIBLZMA-0BSD.txt
  • native/licenses/LIBSELINUX-PUBLIC-DOMAIN.txt
  • native/licenses/LIBUNIBREAK-ZLIB.txt
  • native/licenses/NOTICE.txt
  • native/licenses/PCRE2-BSD-3.txt
  • native/licenses/PUGIXML-MIT.txt
  • native/licenses/UTIL-LINUX-LGPL-2.1.txt
  • native/setup-pdfium.sh
  • native/size-budgets.txt
  • native/vcpkg-vips/vcpkg.json
  • native/vips-build.env
  • settings.gradle.kts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Review details
🧰 Additional context used
📚 Code guidelines: 1
.github/CODERABBIT_REVIEW.md — configured
📓 Path-based instructions: 3
Enforce meaningful assertions, deterministic concurrency, failure-path cleanup, and explicit native/stub requirements.

⚙️ CodeRabbit configuration file

Files:

  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsSmokeTest.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
Apply the Java 25 and FFM rules from .github/CODERABBIT_REVIEW.md.

⚙️ CodeRabbit configuration file

Files:

  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsSmokeTest.java
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsAvailability.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsImageCodec.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsEncoder.java
Source excerpt: Use imports rather than package-qualified type names in method bodies and signatures.

📄 CodeRabbit inference engine (.github/CODERABBIT_REVIEW.md)

Files:

  • jpdfium-natives/jpdfium-natives-vips-freebsd-x64/build.gradle.kts
  • native/licenses/LIBSELINUX-PUBLIC-DOMAIN.txt
  • native/licenses/PUGIXML-MIT.txt
  • native/licenses/LIBFFI-MIT.txt
  • native/licenses/BZIP2.txt
  • native/licenses/BROTLI-MIT.txt
  • native/licenses/LIBDEFLATE-MIT.txt
  • settings.gradle.kts
  • native/licenses/LIBEXPAT-MIT.txt
  • native/licenses/LIBLZMA-0BSD.txt
  • native/licenses/ABSEIL-APACHE-2.0.txt
  • native/check-no-execstack.sh
  • native/licenses/LIBINOTIFY-MIT.txt
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsSmokeTest.java
  • native/vcpkg-vips/vcpkg.json
  • native/licenses/AOM-BSD-2.txt
  • native/licenses/LIBUNIBREAK-ZLIB.txt
  • native/licenses/LIBICONV-LGPL-2.1.txt
  • native/licenses/PCRE2-BSD-3.txt
  • native/licenses/DAV1D-ISC.txt
  • native/licenses/DAV1D-BSD-2.txt
  • native/library-size-budgets.txt
  • native/check-bundle-orphans.sh
  • docs/installation.md
  • native/setup-pdfium.sh
  • native/size-budgets.txt
  • native/check-bundle-lean.sh
  • CHANGELOG.md
  • native/check-bundle-size.sh
  • docs/rendering.md
  • native/licenses/UTIL-LINUX-LGPL-2.1.txt
  • native/licenses/NOTICE.txt
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • native/licenses/LIBEXIF-LGPL-2.1.txt
  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsAvailability.java
  • docs/images.md
  • native/licenses/GETTEXT-LGPL-2.1.txt
  • native/build-vips.sh
  • native/build-minimal-icu.sh
  • native/check-vips-codecs.sh
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsImageCodec.java
  • jpdfium-vips/build.gradle.kts
  • native/check-bundle-hermetic.sh
  • README.md
  • native/ci/musl.sh
  • jpdfium/build.gradle.kts
  • native/build-harfbuzz-no-glib.sh
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium-bom/build.gradle.kts
  • native/bundle-runtime-deps.sh
  • native/build-qpdf-native-crypto.sh
  • docs/compatibility.md
  • buildSrc/src/main/kotlin/jpdfium.natives-conventions.gradle.kts
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsEncoder.java
  • native/vips-build.env
  • native/fetch-prebuilt-pdfium.sh
  • native/build-vips-full-codecs.sh
🪛 LanguageTool
native/licenses/LIBSELINUX-PUBLIC-DOMAIN.txt

[style] ~10-~10: ‘with respect to’ might be wordy. Consider a shorter alternative.
Context: ...press, implied, statutory, or otherwise with respect to the software, including noninfringement...

(EN_WORDINESS_PREMIUM_WITH_RESPECT_TO)

native/licenses/LIBEXPAT-MIT.txt

[uncategorized] ~1-~1: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: Copyright (c) 1998-2000 Thai Open Source Software Center Ltd and Clark Cooper Co...

(EN_COMPOUND_ADJECTIVE_INTERNAL)

native/licenses/LIBLZMA-0BSD.txt

[style] ~5-~5: ‘WITH REGARD TO’ might be wordy. Consider a shorter alternative.
Context: ...AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WAR...

(EN_WORDINESS_PREMIUM_WITH_REGARD_TO)

native/licenses/ABSEIL-APACHE-2.0.txt

[style] ~162-~162: ‘any and all’ might be wordy. Consider a shorter alternative.
Context: ...ge, computer failure or malfunction, or any and all other commercial damages or losse...

(EN_WORDINESS_PREMIUM_ANY_AND_ALL)

native/licenses/LIBICONV-LGPL-2.1.txt

[style] ~16-~16: Consider using only “Public” to avoid wordiness.
Context: ...re and change it. By contrast, the GNU General Public Licenses are intended to guarantee your...

(GENERAL_XX)


[style] ~28-~28: Consider using only “Public” to avoid wordiness.
Context: ...ring to freedom of use, not price. Our General Public Licenses are designed to make sure that...

(GENERAL_XX)


[style] ~45-~45: Consider shortening or rephrasing this to strengthen your wording.
Context: ... can relink them with the library after making changes to the library and recompiling it. And yo...

(MAKE_CHANGES)


[style] ~52-~52: As an alternative to the over-used intensifier ‘very’, consider replacing this phrase.
Context: ...ct each distributor, we want to make it very clear that there is no warranty for the free ...

(EN_WEAK_ADJECTIVE)


[style] ~70-~70: Consider a more concise word here.
Context: ... use this license for certain libraries in order to permit linking those libraries into non...

(IN_ORDER_TO_PREMIUM)


[style] ~98-~98: The word ‘greater’ tends to be overused in this context. Consider an alternative.
Context: ... library in non-free programs enables a greater number of people to use a large body of free s...

(A_GREAT_NUMBER)


[style] ~113-~113: Consider a more concise word here.
Context: ...atter must be combined with the library in order to run. GNU LESSER GEN...

(IN_ORDER_TO_PREMIUM)


[style] ~125-~125: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...software functions and/or data prepared so as to be conveniently linked with application...

(SO_AS_TO)


[style] ~198-~198: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus,...

(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)


[style] ~212-~212: Consider a more expressive alternative.
Context: ...nse to a given copy of the Library. To do this, you must alter all the notices th...

(DO_ACHIEVE)


[style] ~269-~269: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ...ng that work also fall under Section 6, whether or not they are linked directly with the Libra...

(WHETHER)


[style] ~327-~327: For conciseness, try rephrasing this sentence.
Context: ...t itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other propr...

(MAY_MIGHT_BE)


[style] ~374-~374: To make your writing clearer, consider a shorter, more direct phrase.
Context: ... parties with this License. 11. If, as a consequence of a court judgment or allegation of paten...

(AS_A_CONSEQUENCE_OF)


[style] ~379-~379: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...this License. If you cannot distribute so as to satisfy simultaneously your obligations...

(SO_AS_TO)

native/licenses/PCRE2-BSD-3.txt

[grammar] ~1-~1: Ensure spelling is correct
Context: PCRE2 Licence ============= | SPDX-License-Identifier: | BSD-3-Claus...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)


[grammar] ~11-~11: Ensure spelling is correct
Context: ...istributed under the terms of the "BSD" licence, as specified below, with one exemption...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)


[grammar] ~20-~20: Ensure spelling is correct
Context: ...ately licensed under the "2-clause BSD" licence. COPYRIGHT --------- ### The basic libra...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)


[grammar] ~67-~67: Ensure spelling is correct
Context: ...tributor or their employer. THE "BSD" LICENCE ----------------- Redistribution and use in source and bin...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)


[grammar] ~100-~100: Ensure spelling is correct
Context: ...------ The second condition in the BSD licence (covering binary redistributions) does ...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

native/licenses/DAV1D-ISC.txt

[style] ~9-~9: ‘WITH REGARD TO’ might be wordy. Consider a shorter alternative.
Context: ...AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WAR...

(EN_WORDINESS_PREMIUM_WITH_REGARD_TO)

native/licenses/UTIL-LINUX-LGPL-2.1.txt

[style] ~16-~16: Consider using only “Public” to avoid wordiness.
Context: ...re and change it. By contrast, the GNU General Public Licenses are intended to guarantee your...

(GENERAL_XX)


[style] ~28-~28: Consider using only “Public” to avoid wordiness.
Context: ...ring to freedom of use, not price. Our General Public Licenses are designed to make sure that...

(GENERAL_XX)


[style] ~45-~45: Consider shortening or rephrasing this to strengthen your wording.
Context: ... can relink them with the library after making changes to the library and recompiling it. And yo...

(MAKE_CHANGES)


[style] ~52-~52: As an alternative to the over-used intensifier ‘very’, consider replacing this phrase.
Context: ...ct each distributor, we want to make it very clear that there is no warranty for the free ...

(EN_WEAK_ADJECTIVE)


[style] ~70-~70: Consider a more concise word here.
Context: ... use this license for certain libraries in order to permit linking those libraries into non...

(IN_ORDER_TO_PREMIUM)


[style] ~98-~98: The word ‘greater’ tends to be overused in this context. Consider an alternative.
Context: ... library in non-free programs enables a greater number of people to use a large body of free s...

(A_GREAT_NUMBER)


[style] ~113-~113: Consider a more concise word here.
Context: ...atter must be combined with the library in order to run. GNU LESSER GEN...

(IN_ORDER_TO_PREMIUM)


[style] ~125-~125: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...software functions and/or data prepared so as to be conveniently linked with application...

(SO_AS_TO)


[style] ~198-~198: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus,...

(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)


[style] ~212-~212: Consider a more expressive alternative.
Context: ...nse to a given copy of the Library. To do this, you must alter all the notices th...

(DO_ACHIEVE)


[style] ~269-~269: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ...ng that work also fall under Section 6, whether or not they are linked directly with the Libra...

(WHETHER)


[style] ~327-~327: For conciseness, try rephrasing this sentence.
Context: ...t itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other propr...

(MAY_MIGHT_BE)


[style] ~374-~374: To make your writing clearer, consider a shorter, more direct phrase.
Context: ... parties with this License. 11. If, as a consequence of a court judgment or allegation of paten...

(AS_A_CONSEQUENCE_OF)


[style] ~379-~379: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...this License. If you cannot distribute so as to satisfy simultaneously your obligations...

(SO_AS_TO)

native/licenses/LIBEXIF-LGPL-2.1.txt

[style] ~16-~16: Consider using only “Public” to avoid wordiness.
Context: ...re and change it. By contrast, the GNU General Public Licenses are intended to guarantee your...

(GENERAL_XX)


[style] ~28-~28: Consider using only “Public” to avoid wordiness.
Context: ...ring to freedom of use, not price. Our General Public Licenses are designed to make sure that...

(GENERAL_XX)


[style] ~45-~45: Consider shortening or rephrasing this to strengthen your wording.
Context: ... can relink them with the library after making changes to the library and recompiling it. And yo...

(MAKE_CHANGES)


[style] ~52-~52: As an alternative to the over-used intensifier ‘very’, consider replacing this phrase.
Context: ...ct each distributor, we want to make it very clear that there is no warranty for the free ...

(EN_WEAK_ADJECTIVE)


[style] ~70-~70: Consider a more concise word here.
Context: ... use this license for certain libraries in order to permit linking those libraries into non...

(IN_ORDER_TO_PREMIUM)


[style] ~98-~98: The word ‘greater’ tends to be overused in this context. Consider an alternative.
Context: ... library in non-free programs enables a greater number of people to use a large body of free s...

(A_GREAT_NUMBER)


[style] ~113-~113: Consider a more concise word here.
Context: ...atter must be combined with the library in order to run. GNU LESSER GENERAL PUBLIC LI...

(IN_ORDER_TO_PREMIUM)


[style] ~125-~125: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...software functions and/or data prepared so as to be conveniently linked with application...

(SO_AS_TO)


[style] ~198-~198: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus,...

(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)


[style] ~212-~212: Consider a more expressive alternative.
Context: ...nse to a given copy of the Library. To do this, you must alter all the notices th...

(DO_ACHIEVE)


[style] ~269-~269: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ...ng that work also fall under Section 6, whether or not they are linked directly with the Libra...

(WHETHER)


[style] ~327-~327: For conciseness, try rephrasing this sentence.
Context: ...t itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other propr...

(MAY_MIGHT_BE)


[style] ~374-~374: To make your writing clearer, consider a shorter, more direct phrase.
Context: ... parties with this License. 11. If, as a consequence of a court judgment or allegation of paten...

(AS_A_CONSEQUENCE_OF)


[style] ~379-~379: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...this License. If you cannot distribute so as to satisfy simultaneously your obligations...

(SO_AS_TO)

native/licenses/GETTEXT-LGPL-2.1.txt

[style] ~16-~16: Consider using only “Public” to avoid wordiness.
Context: ...re and change it. By contrast, the GNU General Public Licenses are intended to guarantee your...

(GENERAL_XX)


[style] ~28-~28: Consider using only “Public” to avoid wordiness.
Context: ...ring to freedom of use, not price. Our General Public Licenses are designed to make sure that...

(GENERAL_XX)


[style] ~45-~45: Consider shortening or rephrasing this to strengthen your wording.
Context: ... can relink them with the library after making changes to the library and recompiling it. And yo...

(MAKE_CHANGES)


[style] ~52-~52: As an alternative to the over-used intensifier ‘very’, consider replacing this phrase.
Context: ...ct each distributor, we want to make it very clear that there is no warranty for the free ...

(EN_WEAK_ADJECTIVE)


[style] ~70-~70: Consider a more concise word here.
Context: ... use this license for certain libraries in order to permit linking those libraries into non...

(IN_ORDER_TO_PREMIUM)


[style] ~98-~98: The word ‘greater’ tends to be overused in this context. Consider an alternative.
Context: ... library in non-free programs enables a greater number of people to use a large body of free s...

(A_GREAT_NUMBER)


[style] ~113-~113: Consider a more concise word here.
Context: ...atter must be combined with the library in order to run. GNU LESSER GEN...

(IN_ORDER_TO_PREMIUM)


[style] ~125-~125: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...software functions and/or data prepared so as to be conveniently linked with application...

(SO_AS_TO)


[style] ~198-~198: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus,...

(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)


[style] ~212-~212: Consider a more expressive alternative.
Context: ...nse to a given copy of the Library. To do this, you must alter all the notices th...

(DO_ACHIEVE)


[style] ~269-~269: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ...ng that work also fall under Section 6, whether or not they are linked directly with the Libra...

(WHETHER)


[style] ~327-~327: For conciseness, try rephrasing this sentence.
Context: ...t itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other propr...

(MAY_MIGHT_BE)


[style] ~374-~374: To make your writing clearer, consider a shorter, more direct phrase.
Context: ... parties with this License. 11. If, as a consequence of a court judgment or allegation of paten...

(AS_A_CONSEQUENCE_OF)


[style] ~379-~379: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...this License. If you cannot distribute so as to satisfy simultaneously your obligations...

(SO_AS_TO)

docs/compatibility.md

[uncategorized] ~72-~72: The official name of this software platform is spelled with a capital “H”.
Context: ...un in the release CI matrix, defined in [.github/workflows/ci.yml](../.github/workflows...

(GITHUB)

🪛 zizmor (1.30.1)
.github/workflows/snapshot.yml

[warning] 728-728: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 740-740: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 852-852: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/release.yml

[warning] 738-738: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 750-750: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 912-912: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)


[warning] 967-967: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 990-990: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 1027-1027: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 1032-1032: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 1070-1070: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 1118-1118: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/prebuild-vips.yml

[info] 76-76: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)


[warning] 546-546: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🔇 Additional comments: 23
native/build-qpdf-native-crypto.sh: 1

21-22: LGTM!

Also applies to: 36-38, 105-106, 111-112, 120-121, 141-162, 165-165, 170-172, 177-224

native/build-harfbuzz-no-glib.sh: 1

31-31: LGTM!

Also applies to: 35-35, 138-138, 166-168, 224-224

native/build-minimal-icu.sh: 1

44-53: LGTM!

Also applies to: 205-209, 228-232

native/build-vips-full-codecs.sh: 1

2-5: LGTM!

Also applies to: 13-13, 25-29, 77-77, 124-139, 154-304, 337-337, 350-359, 378-441, 471-485, 497-503, 513-515, 524-527, 576-576, 590-590

native/build-vips.sh: 1

14-14: LGTM!

Also applies to: 20-24, 48-53, 77-77

native/vips-build.env: 1

13-25: LGTM!

native/vcpkg-vips/vcpkg.json: 1

5-5: LGTM!

Also applies to: 17-22

native/setup-pdfium.sh: 1

424-432: LGTM!

.github/workflows/prebuild-vips.yml: 1

76-76: LGTM!

Also applies to: 95-96, 178-179, 201-213, 215-259, 293-297, 316-316, 321-347, 361-362, 546-546, 583-583

.github/workflows/release.yml: 1

21-28: LGTM!

Also applies to: 341-345, 514-514, 718-737, 742-761, 911-912, 964-968, 981-1002, 1024-1044, 1067-1071, 1092-1092, 1115-1119

.github/workflows/snapshot.yml: 1

47-47: LGTM!

Also applies to: 53-60, 372-376, 584-584, 732-751, 851-851, 856-856

.github/workflows/vips-drift.yml: 1

145-158: LGTM!

.github/workflows/pdfium-drift.yml: 1

102-115: LGTM!

native/ci/musl.sh: 1

69-75: LGTM!

Also applies to: 108-108

native/fetch-prebuilt-pdfium.sh: 1

40-47: LGTM!

Also applies to: 57-108

native/bundle-runtime-deps.sh: 1

49-49: LGTM!

Also applies to: 62-62, 69-76, 105-105, 128-128, 139-139, 259-295, 552-552, 620-625, 657-657

native/check-bundle-hermetic.sh: 1

5-6: LGTM!

Also applies to: 13-17, 29-29

native/check-bundle-lean.sh: 1

9-9: LGTM!

Also applies to: 36-36, 68-68, 78-78, 84-84, 91-91

native/check-bundle-orphans.sh: 1

9-9: LGTM!

Also applies to: 72-72, 82-82

native/check-bundle-size.sh: 1

22-22: LGTM!

Also applies to: 83-101

native/check-no-execstack.sh: 1

17-17: LGTM!

native/library-size-budgets.txt: 1

1-37: LGTM!

.github/scripts/check-native-symbols.sh: 1

39-45: LGTM!

Comment thread .github/workflows/ci.yml
Comment on lines +488 to +498
# Consumers must choose their platform. The core artifact must never
# publish a jpdfium-natives-* dependency (that used to force Linux
# x64 onto every macOS/Windows/ARM user).
for meta in $(find ~/.m2/repository/com/stirling/jpdfium -maxdepth 2 \
\( -name 'jpdfium-*.pom' -o -name 'jpdfium-*.module' \)); do
if grep -q 'jpdfium-natives' "$meta"; then
echo "ERROR: published metadata contains a native dependency: $meta"
grep -n 'jpdfium-natives' "$meta" || true
missing=1
fi
done

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Fail the check when no metadata files are found.

The find runs against ~/.m2/repository/com/stirling/jpdfium. If that directory is missing or the file names change, the loop body never runs and the step passes. The guard against jpdfium-natives dependencies then checks nothing. Count the inspected files and fail when the count is zero.

Proposed fix
+          meta_count=0
           for meta in $(find ~/.m2/repository/com/stirling/jpdfium -maxdepth 2 \
               \( -name 'jpdfium-*.pom' -o -name 'jpdfium-*.module' \)); do
+            meta_count=$((meta_count + 1))
             if grep -q 'jpdfium-natives' "$meta"; then
               echo "ERROR: published metadata contains a native dependency: $meta"
               grep -n 'jpdfium-natives' "$meta" || true
               missing=1
             fi
           done
+          if [ "$meta_count" -eq 0 ]; then
+            echo "ERROR: no jpdfium POM/module metadata found to inspect"
+            missing=1
+          fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Consumers must choose their platform. The core artifact must never
# publish a jpdfium-natives-* dependency (that used to force Linux
# x64 onto every macOS/Windows/ARM user).
for meta in $(find ~/.m2/repository/com/stirling/jpdfium -maxdepth 2 \
\( -name 'jpdfium-*.pom' -o -name 'jpdfium-*.module' \)); do
if grep -q 'jpdfium-natives' "$meta"; then
echo "ERROR: published metadata contains a native dependency: $meta"
grep -n 'jpdfium-natives' "$meta" || true
missing=1
fi
done
# Consumers must choose their platform. The core artifact must never
# publish a jpdfium-natives-* dependency (that used to force Linux
# x64 onto every macOS/Windows/ARM user).
meta_count=0
for meta in $(find ~/.m2/repository/com/stirling/jpdfium -maxdepth 2 \
\( -name 'jpdfium-*.pom' -o -name 'jpdfium-*.module' \)); do
meta_count=$((meta_count + 1))
if grep -q 'jpdfium-natives' "$meta"; then
echo "ERROR: published metadata contains a native dependency: $meta"
grep -n 'jpdfium-natives' "$meta" || true
missing=1
fi
done
if [ "$meta_count" -eq 0 ]; then
echo "ERROR: no jpdfium POM/module metadata found to inspect"
missing=1
fi

Comment thread .github/workflows/prebuild-vips.yml Outdated
Comment on lines +304 to +307
if ! grep -q '^DAV1D_LIBRARY' heif-build/CMakeCache.txt; then
echo "ERROR: libheif did not find dav1d; refusing to build without an AV1 decoder" >&2
exit 1
fi

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Fix the dav1d guard in the Windows libheif step.

grep -q '^DAV1D_LIBRARY' matches the DAV1D_LIBRARY:FILEPATH=DAV1D_LIBRARY-NOTFOUND entry that find_library writes when dav1d is missing. The guard does not block a build without an AV1 decoder. This is the same root cause as in native/build-vips-full-codecs.sh (libheif dav1d check). Check for a non-empty value that does not end in NOTFOUND.

Proposed fix
--- "a/.github/workflows/prebuild-vips.yml"
+++ "b/.github/workflows/prebuild-vips.yml"
@@ -301,7 +301,8 @@
             -DWITH_HEADER_COMPRESSION=ON -DWITH_UNCOMPRESSED_CODEC=OFF \
             -DKVAZAAR_INCLUDE_DIR="$(cygpath -m "$KVAZAAR_PREFIX/include")" \
             -DKVAZAAR_LIBRARY="$(cygpath -m "$KVAZAAR_PREFIX/lib/kvazaar.lib")"
-          if ! grep -q '^DAV1D_LIBRARY' heif-build/CMakeCache.txt; then
+          DAV1D_LIB="$(sed -n 's/^DAV1D_LIBRARY:[A-Z]*=//p' heif-build/CMakeCache.txt)"
+          if [ -z "$DAV1D_LIB" ] || [[ "$DAV1D_LIB" == *NOTFOUND ]]; then
             echo "ERROR: libheif did not find dav1d; refusing to build without an AV1 decoder" >&2
             exit 1
           fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if ! grep -q '^DAV1D_LIBRARY' heif-build/CMakeCache.txt; then
echo "ERROR: libheif did not find dav1d; refusing to build without an AV1 decoder" >&2
exit 1
fi
DAV1D_LIB="$(sed -n 's/^DAV1D_LIBRARY:[A-Z]*=//p' heif-build/CMakeCache.txt)"
if [ -z "$DAV1D_LIB" ] || [[ "$DAV1D_LIB" == *NOTFOUND ]]; then
echo "ERROR: libheif did not find dav1d; refusing to build without an AV1 decoder" >&2
exit 1
fi

Comment thread .github/workflows/release.yml Outdated

- name: Download core natives for ${{ matrix.platform }}
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.1
continue-on-error: ${{ matrix.platform == 'freebsd-x64' }} # no Java smoke on FreeBSD

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🔎 Supported by static analysis

🏁 Script executed:

#!/bin/bash
rg -n 'freebsd' settings.gradle.kts jpdfium-bom/build.gradle.kts jpdfium-natives/jpdfium-natives-vips-freebsd-x64/build.gradle.kts
rg -n 'freebsd-x64' .github/workflows/release.yml .github/workflows/snapshot.yml

Repository: Stirling-Tools/JPDFium

Length of output: 5164


🏁 Script executed:

set -eu
printf '%s\n' '--- release matrix/job definitions ---'
nl -ba .github/workflows/release.yml | sed -n '100,145p;640,715p;840,900p;900,945p'
printf '%s\n' '--- snapshot matrix/job definitions ---'
nl -ba .github/workflows/snapshot.yml | sed -n '55,110p;800,870p;920,950p'
printf '%s\n' '--- vips/native Gradle publication conditions ---'
nl -ba jpdfium-bom/build.gradle.kts | sed -n '1,45p'
nl -ba jpdfium-natives/jpdfium-natives-vips-freebsd-x64/build.gradle.kts | sed -n '1,160p'

Repository: Stirling-Tools/JPDFium

Length of output: 24878


Fix the release vips matrix or remove the release-only guards.

The release build-vips-natives matrix omits freebsd-x64, so the FreeBSD conditions at .github/workflows/release.yml:699 and :878 can never match. If the FreeBSD vips JAR must ship, add a supported entry to that matrix. Otherwise, remove those release-only conditions.

The snapshot matrix does include freebsd-x64; its guards are not dead and should remain.

Comment thread .github/workflows/snapshot.yml Outdated
Comment on lines +718 to +724
if ! gh release view "$PIN" --repo "$RELEASE_REPO" >/dev/null 2>&1; then
UPSTREAM_REPO=$(gh api "repos/$GITHUB_REPOSITORY" --jq '.parent.full_name // empty' 2>/dev/null || true)
if [ -n "$UPSTREAM_REPO" ] && gh release view "$PIN" --repo "$UPSTREAM_REPO" >/dev/null 2>&1; then
echo "Pinned libvips release $PIN is missing from $GITHUB_REPOSITORY; using $UPSTREAM_REPO."
RELEASE_REPO="$UPSTREAM_REPO"
fi
fi

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Check for the platform assets, not only for the release.

This fallback selects the fork when gh release view "$PIN" succeeds. If the fork has the release but lacks $ASSET or $ASSET.sha256, the parent repository is never tried. gh release download then fails.

.github/workflows/release.yml already uses a has_asset helper that checks both files. Use the same helper here. This job is continue-on-error, so the effect is a lost vips leg on forks, not a red run.

Proposed fix
--- "a/.github/workflows/snapshot.yml"
+++ "b/.github/workflows/snapshot.yml"
@@ -715,9 +715,15 @@
           # workflow. Forks do not carry it, so fall back to the parent
           # repository before giving up: the assets are public and identical.
           RELEASE_REPO="$GITHUB_REPOSITORY"
-          if ! gh release view "$PIN" --repo "$RELEASE_REPO" >/dev/null 2>&1; then
+          has_asset() {
+            local assets
+            assets=$(gh release view "$PIN" --repo "$1" --json assets --jq '.assets[].name' 2>/dev/null || true)
+            grep -Fx "$ASSET" <<<"$assets" >/dev/null && \
+              grep -Fx "$ASSET.sha256" <<<"$assets" >/dev/null
+          }
+          if ! has_asset "$RELEASE_REPO"; then
             UPSTREAM_REPO=$(gh api "repos/$GITHUB_REPOSITORY" --jq '.parent.full_name // empty' 2>/dev/null || true)
-            if [ -n "$UPSTREAM_REPO" ] && gh release view "$PIN" --repo "$UPSTREAM_REPO" >/dev/null 2>&1; then
+            if [ -n "$UPSTREAM_REPO" ] && has_asset "$UPSTREAM_REPO"; then
               echo "Pinned libvips release $PIN is missing from $GITHUB_REPOSITORY; using $UPSTREAM_REPO."
               RELEASE_REPO="$UPSTREAM_REPO"
             fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if ! gh release view "$PIN" --repo "$RELEASE_REPO" >/dev/null 2>&1; then
UPSTREAM_REPO=$(gh api "repos/$GITHUB_REPOSITORY" --jq '.parent.full_name // empty' 2>/dev/null || true)
if [ -n "$UPSTREAM_REPO" ] && gh release view "$PIN" --repo "$UPSTREAM_REPO" >/dev/null 2>&1; then
echo "Pinned libvips release $PIN is missing from $GITHUB_REPOSITORY; using $UPSTREAM_REPO."
RELEASE_REPO="$UPSTREAM_REPO"
fi
fi
has_asset() {
local assets
assets=$(gh release view "$PIN" --repo "$1" --json assets --jq '.assets[].name' 2>/dev/null || true)
grep -Fx "$ASSET" <<<"$assets" >/dev/null && \
grep -Fx "$ASSET.sha256" <<<"$assets" >/dev/null
}
if ! has_asset "$RELEASE_REPO"; then
UPSTREAM_REPO=$(gh api "repos/$GITHUB_REPOSITORY" --jq '.parent.full_name // empty' 2>/dev/null || true)
if [ -n "$UPSTREAM_REPO" ] && has_asset "$UPSTREAM_REPO"; then
echo "Pinned libvips release $PIN is missing from $GITHUB_REPOSITORY; using $UPSTREAM_REPO."
RELEASE_REPO="$UPSTREAM_REPO"
fi
fi

Comment on lines +152 to +160
if ((image.getType() == BufferedImage.TYPE_INT_ARGB
|| image.getType() == BufferedImage.TYPE_INT_RGB)
&& image.getRaster().getSampleModel() instanceof SinglePixelPackedSampleModel sppsm
&& sppsm.getScanlineStride() == width
&& image.getRaster().getDataBuffer() instanceof DataBufferInt dbi
&& dbi.getOffset() == 0
&& image.getRaster().getMinX() == 0
&& image.getRaster().getMinY() == 0
&& dbi.getData().length >= width * height) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Account for raster translation before copying packed pixels.

If a caller passes a full-width vertical BufferedImage.getSubimage(...), this fast path can pass every listed check. The subimage shares its parent’s array, but its raster has a translated origin. Line 169 then reads the parent’s first row instead of the subimage’s first row. The resulting TIFF silently contains the wrong pixels. Require zero sample-model translation for direct indexing, or calculate the translated array offset. Add a round-trip assertion using a subimage cropped below row zero. As per path instructions, “Every defect fix needs a focused regression with an observable result.” (docs.oracle.com)

Source: Path instructions

Comment thread native/build-harfbuzz-no-glib.sh
Comment on lines +443 to +448
# Do not silently ship an AVIF encoder without an AV1 decoder. dav1d is
# mandatory for every platform in this build.
if ! grep -q '^DAV1D_LIBRARY' "$work/build/CMakeCache.txt"; then
echo "build-vips-full-codecs.sh: libheif did not find dav1d; refusing to continue" >&2
exit 1
fi

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Fix the dav1d guard. It passes when dav1d is not found.

FindDAV1D uses find_library(DAV1D_LIBRARY ...). CMake caches the result even when the search fails. A failed search writes DAV1D_LIBRARY:FILEPATH=DAV1D_LIBRARY-NOTFOUND, and grep -q '^DAV1D_LIBRARY' matches that line.

The guard exists to prevent an AVIF encoder without an AV1 decoder. As written, it does not stop that build. The smoke tests only encode, so they would not catch the missing decoder either.

Check that the cached value is non-empty and not *-NOTFOUND. Apply the same fix to .github/workflows/prebuild-vips.yml (Windows libheif step).

Proposed fix
-    if ! grep -q '^DAV1D_LIBRARY' "$work/build/CMakeCache.txt"; then
+    local dav1d_lib
+    dav1d_lib="$(sed -n 's/^DAV1D_LIBRARY:[A-Z]*=//p' "$work/build/CMakeCache.txt")"
+    if [ -z "$dav1d_lib" ] || [[ "$dav1d_lib" == *NOTFOUND ]]; then
         echo "build-vips-full-codecs.sh: libheif did not find dav1d; refusing to continue" >&2
         exit 1
     fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Do not silently ship an AVIF encoder without an AV1 decoder. dav1d is
# mandatory for every platform in this build.
if ! grep -q '^DAV1D_LIBRARY' "$work/build/CMakeCache.txt"; then
echo "build-vips-full-codecs.sh: libheif did not find dav1d; refusing to continue" >&2
exit 1
fi
# Do not silently ship an AVIF encoder without an AV1 decoder. dav1d is
# mandatory for every platform in this build.
local dav1d_lib
dav1d_lib="$(sed -n 's/^DAV1D_LIBRARY:[A-Z]*=//p' "$work/build/CMakeCache.txt")"
if [ -z "$dav1d_lib" ] || [[ "$dav1d_lib" == *NOTFOUND ]]; then
echo "build-vips-full-codecs.sh: libheif did not find dav1d; refusing to continue" >&2
exit 1
fi

Comment thread native/bundle-runtime-deps.sh
Comment thread native/bundle-runtime-deps.sh Outdated
Comment thread native/check-vips-codecs.sh Outdated
@balazs-szucs
balazs-szucs force-pushed the perf/trim-native-deps branch from ee940e7 to a8484ad Compare October 23, 2026 13:07
@balazs-szucs

Copy link
Copy Markdown
Collaborator Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
✅ Action performed

Full review finished.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5


Review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 5a35fef and a8484ad.

Files selected for processing: 65
  • .github/scripts/check-native-symbols.sh
  • .github/workflows/ci.yml
  • .github/workflows/pdfium-drift.yml
  • .github/workflows/prebuild-vips.yml
  • .github/workflows/release.yml
  • .github/workflows/snapshot.yml
  • .github/workflows/vips-drift.yml
  • CHANGELOG.md
  • README.md
  • buildSrc/src/main/kotlin/jpdfium.natives-conventions.gradle.kts
  • docs/compatibility.md
  • docs/images.md
  • docs/installation.md
  • docs/rendering.md
  • jpdfium-bom/build.gradle.kts
  • jpdfium-natives/jpdfium-natives-vips-freebsd-x64/build.gradle.kts
  • jpdfium-vips/build.gradle.kts
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsAvailability.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsEncoder.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsImageCodec.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsSmokeTest.java
  • jpdfium/build.gradle.kts
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • native/build-harfbuzz-no-glib.sh
  • native/build-minimal-icu.sh
  • native/build-qpdf-native-crypto.sh
  • native/build-vips-full-codecs.sh
  • native/build-vips.sh
  • native/bundle-runtime-deps.sh
  • native/check-bundle-hermetic.sh
  • native/check-bundle-lean.sh
  • native/check-bundle-orphans.sh
  • native/check-bundle-size.sh
  • native/check-no-execstack.sh
  • native/check-vips-codecs.sh
  • native/ci/musl.sh
  • native/fetch-prebuilt-pdfium.sh
  • native/library-size-budgets.txt
  • native/licenses/ABSEIL-APACHE-2.0.txt
  • native/licenses/AOM-BSD-2.txt
  • native/licenses/BROTLI-MIT.txt
  • native/licenses/BZIP2.txt
  • native/licenses/DAV1D-BSD-2.txt
  • native/licenses/DAV1D-ISC.txt
  • native/licenses/GETTEXT-LGPL-2.1.txt
  • native/licenses/LIBDEFLATE-MIT.txt
  • native/licenses/LIBEXIF-LGPL-2.1.txt
  • native/licenses/LIBEXPAT-MIT.txt
  • native/licenses/LIBFFI-MIT.txt
  • native/licenses/LIBICONV-LGPL-2.1.txt
  • native/licenses/LIBINOTIFY-MIT.txt
  • native/licenses/LIBLZMA-0BSD.txt
  • native/licenses/LIBSELINUX-PUBLIC-DOMAIN.txt
  • native/licenses/LIBUNIBREAK-ZLIB.txt
  • native/licenses/NOTICE.txt
  • native/licenses/PCRE2-BSD-3.txt
  • native/licenses/PUGIXML-MIT.txt
  • native/licenses/UTIL-LINUX-LGPL-2.1.txt
  • native/setup-pdfium.sh
  • native/size-budgets.txt
  • native/vcpkg-vips/vcpkg.json
  • native/vips-build.env
  • settings.gradle.kts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Review details
Additional context used
Code guidelines: 1
.github/CODERABBIT_REVIEW.md — configured
Path-based instructions: 3
Enforce meaningful assertions, deterministic concurrency, failure-path cleanup, and explicit native/stub requirements.

CodeRabbit configuration file

Files:

  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsSmokeTest.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
Apply the Java 25 and FFM rules from .github/CODERABBIT_REVIEW.md.

CodeRabbit configuration file

Files:

  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsAvailability.java
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsSmokeTest.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsImageCodec.java
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsEncoder.java
Source excerpt: Use imports rather than package-qualified type names in method bodies and signatures.

CodeRabbit inference engine (.github/CODERABBIT_REVIEW.md)

Files:

  • native/licenses/DAV1D-ISC.txt
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsAvailability.java
  • native/licenses/LIBDEFLATE-MIT.txt
  • native/licenses/BROTLI-MIT.txt
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • native/licenses/AOM-BSD-2.txt
  • native/check-bundle-orphans.sh
  • settings.gradle.kts
  • native/vcpkg-vips/vcpkg.json
  • native/licenses/BZIP2.txt
  • docs/rendering.md
  • native/build-vips.sh
  • native/licenses/LIBUNIBREAK-ZLIB.txt
  • docs/installation.md
  • native/check-no-execstack.sh
  • native/licenses/LIBSELINUX-PUBLIC-DOMAIN.txt
  • CHANGELOG.md
  • native/build-minimal-icu.sh
  • README.md
  • native/licenses/PCRE2-BSD-3.txt
  • native/setup-pdfium.sh
  • native/licenses/UTIL-LINUX-LGPL-2.1.txt
  • native/check-bundle-size.sh
  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • jpdfium-bom/build.gradle.kts
  • native/ci/musl.sh
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsSmokeTest.java
  • docs/compatibility.md
  • native/vips-build.env
  • native/licenses/NOTICE.txt
  • native/size-budgets.txt
  • native/check-bundle-hermetic.sh
  • jpdfium-vips/build.gradle.kts
  • native/licenses/LIBICONV-LGPL-2.1.txt
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • native/licenses/LIBLZMA-0BSD.txt
  • jpdfium/build.gradle.kts
  • docs/images.md
  • native/check-bundle-lean.sh
  • native/licenses/LIBINOTIFY-MIT.txt
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsImageCodec.java
  • native/licenses/LIBEXPAT-MIT.txt
  • native/licenses/DAV1D-BSD-2.txt
  • native/build-harfbuzz-no-glib.sh
  • native/fetch-prebuilt-pdfium.sh
  • jpdfium-vips/src/main/java/stirling/software/jpdfium/vips/VipsEncoder.java
  • native/library-size-budgets.txt
  • buildSrc/src/main/kotlin/jpdfium.natives-conventions.gradle.kts
  • native/licenses/ABSEIL-APACHE-2.0.txt
  • native/build-qpdf-native-crypto.sh
  • native/bundle-runtime-deps.sh
  • native/licenses/LIBFFI-MIT.txt
  • native/licenses/PUGIXML-MIT.txt
  • native/licenses/GETTEXT-LGPL-2.1.txt
  • native/check-vips-codecs.sh
  • native/licenses/LIBEXIF-LGPL-2.1.txt
  • native/build-vips-full-codecs.sh
  • jpdfium-natives/jpdfium-natives-vips-freebsd-x64/build.gradle.kts
LanguageTool
native/licenses/DAV1D-ISC.txt

[style] ~9-~9: ‘WITH REGARD TO’ might be wordy. Consider a shorter alternative.
Context: ...AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WAR...

(EN_WORDINESS_PREMIUM_WITH_REGARD_TO)

native/licenses/LIBSELINUX-PUBLIC-DOMAIN.txt

[style] ~10-~10: ‘with respect to’ might be wordy. Consider a shorter alternative.
Context: ...press, implied, statutory, or otherwise with respect to the software, including noninfringement...

(EN_WORDINESS_PREMIUM_WITH_RESPECT_TO)

native/licenses/PCRE2-BSD-3.txt

[grammar] ~1-~1: Ensure spelling is correct
Context: PCRE2 Licence ============= | SPDX-License-Identifier: | BSD-3-Claus...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)


[grammar] ~11-~11: Ensure spelling is correct
Context: ...istributed under the terms of the "BSD" licence, as specified below, with one exemption...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)


[grammar] ~20-~20: Ensure spelling is correct
Context: ...ately licensed under the "2-clause BSD" licence. COPYRIGHT --------- ### The basic libra...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)


[grammar] ~67-~67: Ensure spelling is correct
Context: ...tributor or their employer. THE "BSD" LICENCE ----------------- Redistribution and use in source and bin...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)


[grammar] ~100-~100: Ensure spelling is correct
Context: ...------ The second condition in the BSD licence (covering binary redistributions) does ...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

native/licenses/UTIL-LINUX-LGPL-2.1.txt

[style] ~16-~16: Consider using only “Public” to avoid wordiness.
Context: ...re and change it. By contrast, the GNU General Public Licenses are intended to guarantee your...

(GENERAL_XX)


[style] ~28-~28: Consider using only “Public” to avoid wordiness.
Context: ...ring to freedom of use, not price. Our General Public Licenses are designed to make sure that...

(GENERAL_XX)


[style] ~45-~45: Consider shortening or rephrasing this to strengthen your wording.
Context: ... can relink them with the library after making changes to the library and recompiling it. And yo...

(MAKE_CHANGES)


[style] ~52-~52: As an alternative to the over-used intensifier ‘very’, consider replacing this phrase.
Context: ...ct each distributor, we want to make it very clear that there is no warranty for the free ...

(EN_WEAK_ADJECTIVE)


[style] ~70-~70: Consider a more concise word here.
Context: ... use this license for certain libraries in order to permit linking those libraries into non...

(IN_ORDER_TO_PREMIUM)


[style] ~98-~98: The word ‘greater’ tends to be overused in this context. Consider an alternative.
Context: ... library in non-free programs enables a greater number of people to use a large body of free s...

(A_GREAT_NUMBER)


[style] ~113-~113: Consider a more concise word here.
Context: ...atter must be combined with the library in order to run. GNU LESSER GEN...

(IN_ORDER_TO_PREMIUM)


[style] ~125-~125: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...software functions and/or data prepared so as to be conveniently linked with application...

(SO_AS_TO)


[style] ~198-~198: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus,...

(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)


[style] ~212-~212: Consider a more expressive alternative.
Context: ...nse to a given copy of the Library. To do this, you must alter all the notices th...

(DO_ACHIEVE)


[style] ~269-~269: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ...ng that work also fall under Section 6, whether or not they are linked directly with the Libra...

(WHETHER)


[style] ~327-~327: For conciseness, try rephrasing this sentence.
Context: ...t itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other propr...

(MAY_MIGHT_BE)


[style] ~374-~374: To make your writing clearer, consider a shorter, more direct phrase.
Context: ... parties with this License. 11. If, as a consequence of a court judgment or allegation of paten...

(AS_A_CONSEQUENCE_OF)


[style] ~379-~379: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...this License. If you cannot distribute so as to satisfy simultaneously your obligations...

(SO_AS_TO)

docs/compatibility.md

[uncategorized] ~72-~72: The official name of this software platform is spelled with a capital “H”.
Context: ...un in the release CI matrix, defined in [.github/workflows/ci.yml](../.github/workflows...

(GITHUB)

native/licenses/LIBICONV-LGPL-2.1.txt

[style] ~16-~16: Consider using only “Public” to avoid wordiness.
Context: ...re and change it. By contrast, the GNU General Public Licenses are intended to guarantee your...

(GENERAL_XX)


[style] ~28-~28: Consider using only “Public” to avoid wordiness.
Context: ...ring to freedom of use, not price. Our General Public Licenses are designed to make sure that...

(GENERAL_XX)


[style] ~45-~45: Consider shortening or rephrasing this to strengthen your wording.
Context: ... can relink them with the library after making changes to the library and recompiling it. And yo...

(MAKE_CHANGES)


[style] ~52-~52: As an alternative to the over-used intensifier ‘very’, consider replacing this phrase.
Context: ...ct each distributor, we want to make it very clear that there is no warranty for the free ...

(EN_WEAK_ADJECTIVE)


[style] ~70-~70: Consider a more concise word here.
Context: ... use this license for certain libraries in order to permit linking those libraries into non...

(IN_ORDER_TO_PREMIUM)


[style] ~98-~98: The word ‘greater’ tends to be overused in this context. Consider an alternative.
Context: ... library in non-free programs enables a greater number of people to use a large body of free s...

(A_GREAT_NUMBER)


[style] ~113-~113: Consider a more concise word here.
Context: ...atter must be combined with the library in order to run. GNU LESSER GEN...

(IN_ORDER_TO_PREMIUM)


[style] ~125-~125: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...software functions and/or data prepared so as to be conveniently linked with application...

(SO_AS_TO)


[style] ~198-~198: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus,...

(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)


[style] ~212-~212: Consider a more expressive alternative.
Context: ...nse to a given copy of the Library. To do this, you must alter all the notices th...

(DO_ACHIEVE)


[style] ~269-~269: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ...ng that work also fall under Section 6, whether or not they are linked directly with the Libra...

(WHETHER)


[style] ~327-~327: For conciseness, try rephrasing this sentence.
Context: ...t itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other propr...

(MAY_MIGHT_BE)


[style] ~374-~374: To make your writing clearer, consider a shorter, more direct phrase.
Context: ... parties with this License. 11. If, as a consequence of a court judgment or allegation of paten...

(AS_A_CONSEQUENCE_OF)


[style] ~379-~379: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...this License. If you cannot distribute so as to satisfy simultaneously your obligations...

(SO_AS_TO)

native/licenses/LIBLZMA-0BSD.txt

[style] ~5-~5: ‘WITH REGARD TO’ might be wordy. Consider a shorter alternative.
Context: ...AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WAR...

(EN_WORDINESS_PREMIUM_WITH_REGARD_TO)

native/licenses/LIBEXPAT-MIT.txt

[uncategorized] ~1-~1: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: Copyright (c) 1998-2000 Thai Open Source Software Center Ltd and Clark Cooper Co...

(EN_COMPOUND_ADJECTIVE_INTERNAL)

native/licenses/ABSEIL-APACHE-2.0.txt

[style] ~162-~162: ‘any and all’ might be wordy. Consider a shorter alternative.
Context: ...ge, computer failure or malfunction, or any and all other commercial damages or losse...

(EN_WORDINESS_PREMIUM_ANY_AND_ALL)

native/licenses/GETTEXT-LGPL-2.1.txt

[style] ~16-~16: Consider using only “Public” to avoid wordiness.
Context: ...re and change it. By contrast, the GNU General Public Licenses are intended to guarantee your...

(GENERAL_XX)


[style] ~28-~28: Consider using only “Public” to avoid wordiness.
Context: ...ring to freedom of use, not price. Our General Public Licenses are designed to make sure that...

(GENERAL_XX)


[style] ~45-~45: Consider shortening or rephrasing this to strengthen your wording.
Context: ... can relink them with the library after making changes to the library and recompiling it. And yo...

(MAKE_CHANGES)


[style] ~52-~52: As an alternative to the over-used intensifier ‘very’, consider replacing this phrase.
Context: ...ct each distributor, we want to make it very clear that there is no warranty for the free ...

(EN_WEAK_ADJECTIVE)


[style] ~70-~70: Consider a more concise word here.
Context: ... use this license for certain libraries in order to permit linking those libraries into non...

(IN_ORDER_TO_PREMIUM)


[style] ~98-~98: The word ‘greater’ tends to be overused in this context. Consider an alternative.
Context: ... library in non-free programs enables a greater number of people to use a large body of free s...

(A_GREAT_NUMBER)


[style] ~113-~113: Consider a more concise word here.
Context: ...atter must be combined with the library in order to run. GNU LESSER GEN...

(IN_ORDER_TO_PREMIUM)


[style] ~125-~125: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...software functions and/or data prepared so as to be conveniently linked with application...

(SO_AS_TO)


[style] ~198-~198: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus,...

(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)


[style] ~212-~212: Consider a more expressive alternative.
Context: ...nse to a given copy of the Library. To do this, you must alter all the notices th...

(DO_ACHIEVE)


[style] ~269-~269: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ...ng that work also fall under Section 6, whether or not they are linked directly with the Libra...

(WHETHER)


[style] ~327-~327: For conciseness, try rephrasing this sentence.
Context: ...t itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other propr...

(MAY_MIGHT_BE)


[style] ~374-~374: To make your writing clearer, consider a shorter, more direct phrase.
Context: ... parties with this License. 11. If, as a consequence of a court judgment or allegation of paten...

(AS_A_CONSEQUENCE_OF)


[style] ~379-~379: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...this License. If you cannot distribute so as to satisfy simultaneously your obligations...

(SO_AS_TO)

native/licenses/LIBEXIF-LGPL-2.1.txt

[style] ~16-~16: Consider using only “Public” to avoid wordiness.
Context: ...re and change it. By contrast, the GNU General Public Licenses are intended to guarantee your...

(GENERAL_XX)


[style] ~28-~28: Consider using only “Public” to avoid wordiness.
Context: ...ring to freedom of use, not price. Our General Public Licenses are designed to make sure that...

(GENERAL_XX)


[style] ~45-~45: Consider shortening or rephrasing this to strengthen your wording.
Context: ... can relink them with the library after making changes to the library and recompiling it. And yo...

(MAKE_CHANGES)


[style] ~52-~52: As an alternative to the over-used intensifier ‘very’, consider replacing this phrase.
Context: ...ct each distributor, we want to make it very clear that there is no warranty for the free ...

(EN_WEAK_ADJECTIVE)


[style] ~70-~70: Consider a more concise word here.
Context: ... use this license for certain libraries in order to permit linking those libraries into non...

(IN_ORDER_TO_PREMIUM)


[style] ~98-~98: The word ‘greater’ tends to be overused in this context. Consider an alternative.
Context: ... library in non-free programs enables a greater number of people to use a large body of free s...

(A_GREAT_NUMBER)


[style] ~113-~113: Consider a more concise word here.
Context: ...atter must be combined with the library in order to run. GNU LESSER GENERAL PUBLIC LI...

(IN_ORDER_TO_PREMIUM)


[style] ~125-~125: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...software functions and/or data prepared so as to be conveniently linked with application...

(SO_AS_TO)


[style] ~198-~198: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus,...

(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)


[style] ~212-~212: Consider a more expressive alternative.
Context: ...nse to a given copy of the Library. To do this, you must alter all the notices th...

(DO_ACHIEVE)


[style] ~269-~269: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ...ng that work also fall under Section 6, whether or not they are linked directly with the Libra...

(WHETHER)


[style] ~327-~327: For conciseness, try rephrasing this sentence.
Context: ...t itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other propr...

(MAY_MIGHT_BE)


[style] ~374-~374: To make your writing clearer, consider a shorter, more direct phrase.
Context: ... parties with this License. 11. If, as a consequence of a court judgment or allegation of paten...

(AS_A_CONSEQUENCE_OF)


[style] ~379-~379: ‘So as to’ expresses purpose and is used in formal texts. Consider using “to”.
Context: ...this License. If you cannot distribute so as to satisfy simultaneously your obligations...

(SO_AS_TO)

zizmor (1.30.1)
.github/workflows/snapshot.yml

[warning] 734-734: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 746-746: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/release.yml

[warning] 737-737: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 749-749: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 911-911: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)


[warning] 966-966: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 989-989: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 1026-1026: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 1031-1031: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 1069-1069: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)


[warning] 1117-1117: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/prebuild-vips.yml

[info] 76-76: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)


[warning] 547-547: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

Additional comments: 1
native/build-vips-full-codecs.sh: 1

278-282: 🩺 Stability & Availability

The concern does not hold for the darwin-x64 leg. The workflow runs the script on an Intel runner under an x86_64 process, so Meson detects an x86_64 host and builds an x86_64 dav1d without extra flags.

The comment's antecedent is that the darwin-x64 job runs this script as an arm64 process. The inspected release workflow contradicts that. The darwin-x64 leg uses the macos-15-intel runner and invokes the script through arch -x86_64. The script's own comment says the compilers resolve to x86_64 under Rosetta. Meson derives the host machine from that process, so the new meson setup call in build_dav1d does not produce arm64 code on this path. The CMAKE_OSX_ARCHITECTURES observation is accurate, but the failure it implies needs an arm64 host, and that does not occur in the inspected darwin-x64 job.

One residual limit remains. build-rust.sh describes an older darwin-x64 cross-compile on an arm64 host. The inspected workflow no longer matches that description. The prebuild-vips.yml path was not inspected directly, so no other arm64-host invocation of this script can be ruled out from the supplied evidence. That gap does not support the reported darwin-x64 failure.

Comment thread .github/workflows/snapshot.yml Outdated
Comment thread docs/installation.md Outdated
Add `com.stirling:jpdfium-vips` and the matching `jpdfium-natives-vips-<platform>` module to read and write WebP, HEIC, AVIF, JXL, and JPEG 2000. Without them, JPDFium uses `javax.imageio` and supports whatever your JDK supports. See [images.md](images.md).

The vips native artifacts are published for Linux x64 and arm64, macOS x64 and arm64, and Windows x64 and arm64. There is no musl build.
The vips native artifacts are published for Linux x64 and arm64, Linux musl x64 and arm64, macOS x64 and arm64, and Windows x64 and arm64. FreeBSD x64 is produced by the Prebuild libvips workflow and joins the release matrix once its prebuild asset is pinned.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Major · Data Integrity & Integration · Heavy lift

🔎 Supported by static analysis

Script executed:

#!/bin/bash
# Inspect project inclusion and release publication paths without running repository code.
rg -n -C 4 'vips-linux-musl|jpdfium-natives-vips|publish.*[Mm]aven|natives-vips-' settings.gradle.kts .github/workflows/release.yml

Repository: Stirling-Tools/JPDFium

Length of output: 5002


Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- musl/vips references across project ---'
rg -n -F --glob '!build/**' --glob '!**/.git/**' -e 'vips-linux-musl' -e 'musl' -e 'jpdfium-natives-vips' -e 'natives-vips-' . || test "$?" -eq 1

printf '%s\n' '--- settings.gradle.kts ---'
nl -ba settings.gradle.kts | sed -n '1,80p'

printf '%s\n' '--- release vips job and matrix ---'
nl -ba .github/workflows/release.yml | sed -n '760,930p'

printf '%s\n' '--- publication declarations ---'
rg -n -C 5 -e 'publishing' -e 'maven-publish' -e 'publication' -e 'repositories' --glob '*.gradle.kts' --glob '*.gradle' .

Repository: Stirling-Tools/JPDFium

Length of output: 41692


Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- release workflow vips matrix ---'
nl -ba .github/workflows/release.yml | sed -n '730,910p'

printf '%s\n' '--- native publication skip logic ---'
nl -ba buildSrc/src/main/kotlin/jpdfium.natives-conventions.gradle.kts | sed -n '145,185p'

printf '%s\n' '--- relevant changed documentation ---'
nl -ba docs/installation.md | sed -n '98,108p'
nl -ba README.md | sed -n '118,127p'

Repository: Stirling-Tools/JPDFium

Length of output: 14643


Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- vips job matrix declaration ---'
nl -ba .github/workflows/release.yml | sed -n '600,735p'
printf '%s\n' '--- publish fan-in ---'
nl -ba .github/workflows/release.yml | sed -n '906,1045p'

Repository: Stirling-Tools/JPDFium

Length of output: 14227


Remove the unsupported musl vips publication claims.

The release matrix contains no musl vips jobs, and settings.gradle.kts includes no musl vips projects. The publication task therefore cannot publish jpdfium-natives-vips-linux-musl-x64 or jpdfium-natives-vips-linux-musl-arm64. Add complete musl vips projects and release jobs, or remove the claims from both documents.

Suggested documentation fix
- The vips native artifacts are published for Linux x64 and arm64, Linux musl x64 and arm64, macOS x64 and arm64, and Windows x64 and arm64. FreeBSD x64 is produced by the Prebuild libvips workflow and joins the release matrix once its prebuild asset is pinned.
+ The vips native artifacts are published for Linux x64 and arm64, macOS x64 and arm64, and Windows x64 and arm64. FreeBSD x64 is produced by the Prebuild libvips workflow and joins the release matrix once its prebuild asset is pinned.
- Bundled vips natives are published for Linux (glibc and musl), macOS, and Windows. FreeBSD x64 is prebuild-only until its asset is pinned for release.
+ Bundled vips natives are published for Linux (glibc), macOS, and Windows. FreeBSD x64 is prebuild-only until its asset is pinned for release.

Comment thread jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java Outdated
Comment thread native/build-harfbuzz-no-glib.sh
Comment thread native/bundle-runtime-deps.sh Outdated
@balazs-szucs
balazs-szucs force-pushed the perf/trim-native-deps branch from a8484ad to c2b30ab Compare October 24, 2026 17:51
@balazs-szucs
balazs-szucs marked this pull request as ready for review October 24, 2026 22:04

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1


Review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between a8484ad and c2b30ab.

Files selected for processing: 10
  • .github/workflows/snapshot.yml
  • README.md
  • docs/compatibility.md
  • docs/images.md
  • docs/installation.md
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • native/build-harfbuzz-no-glib.sh
  • native/bundle-runtime-deps.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Review details
Additional context used
Code guidelines: 1
.github/CODERABBIT_REVIEW.md — configured
Path-based instructions: 3
Enforce meaningful assertions, deterministic concurrency, failure-path cleanup, and explicit native/stub requirements.

CodeRabbit configuration file

Files:

  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
Apply the Java 25 and FFM rules from .github/CODERABBIT_REVIEW.md.

CodeRabbit configuration file

Files:

  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
Source excerpt: Use imports rather than package-qualified type names in method bodies and signatures.

CodeRabbit inference engine (.github/CODERABBIT_REVIEW.md)

Files:

  • README.md
  • jpdfium/src/main/java/stirling/software/jpdfium/spi/ImageCodec.java
  • docs/images.md
  • jpdfium-vips/src/test/java/stirling/software/jpdfium/vips/VipsImageConverterTest.java
  • jpdfium/src/main/java/stirling/software/jpdfium/internal/ImageCodecs.java
  • docs/installation.md
  • native/build-harfbuzz-no-glib.sh
  • docs/compatibility.md
  • native/bundle-runtime-deps.sh
LanguageTool
docs/compatibility.md

[uncategorized] ~72-~72: The official name of this software platform is spelled with a capital “H”.
Context: ...un in the release CI matrix, defined in [.github/workflows/ci.yml](../.github/workflows...

(GITHUB)

Additional comments: 3
native/bundle-runtime-deps.sh: 1

259-321: LGTM!

README.md: 1

120-120: LGTM!

Also applies to: 124-124

docs/installation.md: 1

105-105: LGTM!

Comment on lines +566 to +569
@Override
public void write(byte[] b, int off, int len) throws IOException {
written = true;
super.write(b, off, len);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Major · Performance & Scalability · Quick win

Preserve bulk writes in TrackingOutputStream.

When libvips writes an encoded TIFF, super.write(b, off, len) invokes write(int) once per byte. On an unbuffered file stream, a multi-megabyte TIFF therefore causes millions of underlying writes instead of one bulk write. Call out.write(b, off, len) directly, and add a regression that counts bulk writes. Java 25 documents this superclass behavior. (docs.oracle.com)

As per path instructions, “Focus performance feedback on concrete hot paths.”

Proposed fix
         public void write(byte[] b, int off, int len) throws IOException {
             written = true;
-            super.write(b, off, len);
+            out.write(b, off, len);
         }
Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@Override
public void write(byte[] b, int off, int len) throws IOException {
written = true;
super.write(b, off, len);
@Override
public void write(byte[] b, int off, int len) throws IOException {
written = true;
out.write(b, off, len);

Source: Path instructions

@balazs-szucs
balazs-szucs force-pushed the perf/trim-native-deps branch from c2b30ab to 80a8dcb Compare October 24, 2026 22:11

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant