Update to BentoPDF v2.8.8; bundle the text editor's fallback fonts

[stupleb]

Updates BentoPDF v2.8.4 → v2.8.8, and bundles the new text editor's fallback fonts so the package keeps its "no CDN at runtime" guarantee. (The last shipped release is 2.8.4:1; the interim v2.8.7 bump never published — its tag was removed — so this supersedes it.)

Upstream — v2.8.8

• Includes the v2.8.7 security fixes (GHSA-wh78-rcw2-hhg9, GHSA-5xjf-rr5x-pcfj, GHSA-cx8x-7rrr-r9x8, affecting all versions ≤ v2.8.6) — the main reason to ship this.
• In-place PDF text editing (new), a fix for string rendering on the -simple image we use (#833), a WASM-init-timeout fix (#324), a PDF→TIFF OOM fix, duplex sort, non-Latin editor text, analytics removed.
• Kura / Hyper Compress are announced but not integrated in v2.8.8 — nothing new to bundle there.
• The three WASM libraries (PyMuPDF 0.11.16, Ghostscript 0.1.1, CoherentPDF 2.5.5) and their URL shapes are unchanged; only the Dockerfile FROM tag moves.

The one new CDN dependency — and why it's bundled

v2.8.8's text editor fetches seven Noto fallback fonts (@embedpdf/fonts-{latin,arabic,hebrew,jp,kr,sc,tc}@1.0.0, one Regular-weight file each) from jsdelivr on demand. The base URL is baked into three hash-suffixed chunks (edit-pdf-*, embedpdf-*, worker-engine-*) — both by BentoPDF's editor-fonts.ts and by the @embedpdf engine's own loader. Left alone, that silently breaks this package's core promise for its headline new feature. So:

• Dockerfile vendors the fonts — only the single Regular-weight file per package that upstream references (22.8 MB total, not the packages' 150 MB of unused weights), laid out as <pkg>@1.0.0/fonts/<file> under /usr/share/nginx/html/fonts/embedpdf/ so the rewritten base URL resolves unchanged.
• The rewrite-wasm-urls oneshot now also rewrites the @embedpdf base URL → /fonts/embedpdf in every chunk that carries it (found by content, so it survives chunk-hash changes), and deletes those chunks' .br copies. The engine's ${version} resolves to 1.0.0, so both font-loading paths land on the bundled files.

Package version 2.8.4:1 → 2.8.8:0. SDK stays 2.0.9. README, instructions, CONTRIBUTING and AGENTS updated; the AGENTS bump rule now says to read editor-fonts.ts alongside wasm-provider.ts.

Verification

• tsc + SDK lint clean.
• Both arches pack: version 2.8.8:0, sdkVersion 2.0.9; the x86_64 package grew 168 → 191 MB (= the fonts).
• Against the built v2.8.8 image, running the exact oneshot logic: zero jsdelivr WASM URLs survive; all 7 font files present at the expected local paths (~23 MB); the @embedpdf prefix rewritten in all 3 chunks with none surviving; rewritten chunks' .br removed. The scan for any other jsdelivr URL turned up one, pre-existing and out of scope here: the OCR tool (tesseract.js) still loads its worker/core/language data from public CDNs — its only configured workerPath is the library's jsdelivr default, BentoPDF overrides it only via build-time VITE_TESSERACT_*_URL (unset in the -simple image), and no local worker.min.js ships. Present since 2.8.4:1; README.md/instructions.md now state the exception, and bundling it is a follow-up issue.

🤖 Generated with Claude Code