chore: update dependencies

.github/workflows/linux.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-24.04
     strategy:
       matrix:
-        node-version: [22.x]
+        node-version: [24.x]
     steps:
       - uses: actions/checkout@v4
       - name: Use Node.js ${{ matrix.node-version }}

.github/workflows/windows.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: windows-latest
     strategy:
       matrix:
-        node-version: [22.x]
+        node-version: [24.x]
     steps:
       - uses: actions/checkout@v4
       - name: Use Node.js ${{ matrix.node-version }}

.ncurc.js

@@ -8,10 +8,18 @@ const ignoredPackages = [];
  * Type: { [packageName]: reason }, i.e. { '@storybook/react': 'some reason' }
  */
 const ignoreMajorVersions = {
+  typescript: 'typescript-eslint supports typescript <6.1.0; TS 7 is the Go port and is not supported by it yet',
+  '@types/node': 'keep node typings aligned with the Node 24 runtime floor in engines.node',
 };
 
 module.exports = {
   upgrade: true,
+  /**
+   * Supply chain protection: only consider versions published at least 14 days
+   * ago. Mirrors `min-release-age=14` in .npmrc, so ncu never proposes a version
+   * that `npm install` would subsequently reject.
+   */
+  cooldown: 14,
   reject: ignoredPackages,
   packageManager: 'npm',
   /** Custom target that performs minor upgrades for selected packages.

.npmignore

@@ -1,3 +1,4 @@
+.claude
 .github
 .vscode
 bin

.npmrc

@@ -0,0 +1,10 @@
+# Reject packages younger than 14 days
+min-release-age=14
+# Skip lifecycle scripts — top npm-supply-chain malware vector
+ignore-scripts=true
+# Enforce engines.node / engines.npm instead of warning
+engine-strict=true
+# `npm install <pkg>` pins exact versions, no caret drift
+save-exact=true
+# Lockfile changes must be intentional
+package-lock=true

.nvmrc

@@ -1 +1 @@
-v22.21.1
+v24.20.0

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.16.0 / 2026-09-01
+
+### ⚠️ Expect to update your snapshots
+
+- chore: update `pdfjs-dist` to `v6.2.108` (was `v5.4.449`) and `@napi-rs/canvas` to `v1.0.6` (was `v0.1.84`).
+
+  Both packages changed how glyphs and vector edges are rasterized, so **existing snapshots will very likely no longer match** and must be regenerated. Page dimensions are unaffected — only edge/antialiasing pixels differ. In this repo's own fixtures the differing-pixel share was 0.0006%–0.63% of the image, concentrated at glyph and line boundaries, with rendered content otherwise identical.
+
+  To regenerate, delete the affected files under `__snapshots__/` and re-run your tests; `comparePdfToSnapshot` recreates a missing snapshot and returns `true`. Review the recreated images before committing them.
+
+  If you would rather not regenerate, raise `tolerance` in `CompareOptions`. Note this is a **per-pixel color threshold**, not an allowance on how many pixels may differ — a comparison fails if _any_ pixel still differs beyond the threshold, so a large enough renderer change will fail at any tolerance below the point where every affected pixel is absorbed.
+
+### 🐛 Bug Fix
+
+- fix: destroy the pdf.js loading task after rendering. `pdf2png` left the worker running, which kept the Node process alive after work finished — test runners would hang or report that the process did not exit cleanly.
+
+### :wrench: Internal
+
+- chore: update dev dependencies, notably TypeScript to `v6.0.3` and ESLint to `v10.8.1`.
+- fix: add `"types": ["node"]` to `tsconfig.json`. Under TypeScript 6, test files importing only Node builtins failed to compile with `TS2591: Cannot find name 'node:test'`.
+- test: regenerate `TAMReview`, `TAMReview_without_scaling`, `cmaps`, `two-page_png_per_page` and the jest smoke test fixtures for the new renderer output.
+
 ## 0.15.2 / 2025-12-18
 
 ### 🐛 Bug Fix