matplotvite 0.6.0__tar.gz

matplotvite-0.6.0/.github/dependabot.yml

@@ -0,0 +1,21 @@
+# PDF output assembles svg2pdf/usvg chunks by hand. When either crate changes,
+# run the tight-PDF tests in tests/test_plt.py before merging the update.
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    ignore:
+      # svg2pdf pins pdf-writer's major version; update them together.
+      - dependency-name: "pdf-writer"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

matplotvite-0.6.0/.github/requirements-ci.txt

@@ -0,0 +1,13 @@
+# Constraints for CI's ad-hoc pip installs. Keep these exact-version pins in
+# sync with the supported Python matrix (3.9 through 3.14).
+maturin==1.16.0
+numpy==2.0.2; python_version < "3.12"
+numpy==2.5.4; python_version >= "3.12"
+pandas==2.2.3; python_version < "3.12"
+pandas==3.1.1; python_version >= "3.12"
+pytest==8.4.2
+matplotlib==3.11.2
+bandit==1.9.4
+pip-audit==2.10.1
+pypdfium2==4.30.0
+cairosvg==2.7.1

matplotvite-0.6.0/.github/workflows/ci.yml

@@ -0,0 +1,366 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  prek:
+    name: prek checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: j178/prek-action@44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d # v3.1.0
+
+  lint:
+    name: python lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - run: pip install ruff==0.17.4
+      - run: ruff check python tests tools examples
+
+  security:
+    name: security scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2 # v2.90.2
+        with:
+          tool: cargo-audit
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - name: Run Bandit static analysis
+        run: |
+          python -m pip install -c .github/requirements-ci.txt "bandit>=1.9" numpy
+          python -m bandit -q -r python/matplotvite
+
+      - name: Run dependency and static security checks
+        run: |
+          python -m pip install -c .github/requirements-ci.txt "pip-audit>=2.9"
+          python tools/security_audit.py
+
+  test:
+    name: test (python ${{ matrix.python }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        include:
+          # ubuntu-latest (26.04) has no python-versions build for 3.9 yet, so the
+          # oldest supported interpreter runs on 22.04 instead.
+          - os: ubuntu-22.04
+            python: "3.9"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - name: Build & Test
+        run: |
+          python -m venv .venv
+          . .venv/bin/activate
+          pip install -c .github/requirements-ci.txt maturin numpy pandas pytest
+          maturin develop --release
+          pytest -q
+
+  wheels:
+    name: wheel (${{ matrix.name }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: linux-x86_64
+            os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            manylinux: auto
+            interpreter: python3.13
+          - name: linux-aarch64
+            os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            manylinux: auto
+            interpreter: python3.13
+          - name: macos-arm64
+            os: macos-latest
+            target: aarch64-apple-darwin
+            interpreter: python
+          - name: macos-x86_64
+            os: macos-15-intel
+            target: x86_64-apple-darwin
+            interpreter: python
+          - name: windows-x86_64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+            interpreter: python
+          - name: windows-arm64
+            os: windows-11-arm
+            target: aarch64-pc-windows-msvc
+            interpreter: python
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          target: ${{ matrix.target }}
+          manylinux: ${{ matrix.manylinux }}
+          # The manylinux container does not see setup-python's interpreter, so
+          # select the matching container Python explicitly. The wheel is built
+          # against the stable ABI (cp39-abi3) and works on every version above 3.9.
+          args: --release --out dist --interpreter ${{ matrix.interpreter }}
+      - name: Build the sdist
+        # One matrix entry builds the source distribution: the tarball is
+        # platform independent, so every platform would only duplicate it.
+        if: matrix.name == 'linux-x86_64'
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: sdist
+          args: --out dist
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: wheel-${{ matrix.name }}
+          path: dist/*.whl
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: matrix.name == 'linux-x86_64'
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+
+  wheel-tests:
+    name: wheel test (py${{ matrix.python }}, ${{ matrix.os }})
+    needs: wheels
+    runs-on: ${{ matrix.os }}
+    # The wheel is stable-ABI, so the per-interpreter coverage comes from the
+    # Linux matrix. Hosted macOS runners are scarce: asking for one per Python
+    # version regularly left jobs queued until GitHub cancelled them ~15 minutes
+    # later, so macOS checks the newest interpreter only. No timeout setting
+    # covers that queue wait; reducing the number of macOS jobs is the fix.
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        exclude:
+          # Python 3.9 and 3.10 are no longer available on current hosted
+          # macOS/Windows images; the stable-ABI wheel still supports them.
+          - os: macos-latest
+            python: "3.10"
+          - os: macos-latest
+            python: "3.11"
+          - os: macos-latest
+            python: "3.12"
+          - os: macos-latest
+            python: "3.13"
+          - os: windows-latest
+            python: "3.10"
+        include:
+          - os: ubuntu-22.04
+            python: "3.9"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: wheel-*
+          path: dist
+          merge-multiple: true
+      - name: Install the built wheel
+        run: |
+          python -m pip install -c .github/requirements-ci.txt numpy pandas pytest
+          python -m pip install --no-index --find-links dist matplotvite
+      - name: Run the test suite against the installed wheel
+        # The repo root is not on sys.path ahead of site-packages, so these
+        # imports resolve to the installed wheel rather than the source tree.
+        # Keep this the same suite the `test` job runs, so a wheel-only break
+        # cannot hide behind a `maturin develop` build.
+        run: python -m pytest -q
+
+  sdist-wheel:
+    name: wheel from sdist
+    needs: wheels
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: sdist
+          path: dist
+      - name: Build a wheel from the sdist
+        # Same PEP 517 path a user gets from `pip install matplotvite` on a
+        # platform without a wheel, using the pinned maturin instead of an
+        # isolated resolution.
+        run: |
+          python -m pip install -c .github/requirements-ci.txt maturin
+          python -m pip wheel --no-deps --no-build-isolation --wheel-dir wheel dist/*.tar.gz
+      - name: Check the wheel built from the sdist
+        run: |
+          python - <<'PY'
+          import glob
+          import pathlib
+
+          wheels = glob.glob("wheel/*.whl")
+          assert len(wheels) == 1, wheels
+          # The sdist must keep the abi3 configuration, or every interpreter
+          # above 3.9 would lose its wheel.
+          assert "cp39-abi3" in pathlib.Path(wheels[0]).name, wheels[0]
+          print(f"built {wheels[0]}")
+          PY
+      - name: Install and smoke-test the sdist wheel
+        run: |
+          python -m pip install -c .github/requirements-ci.txt numpy pytest
+          python -m pip install --no-deps wheel/*.whl
+          python -m pytest -q tests/test_wheel.py
+
+  benchmarks:
+    name: benchmark regression guard
+    runs-on: ubuntu-latest
+    # Performance budgets are advisory: benchmark noise should never block CI.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - name: Run benchmarks and report the regression budget
+        env:
+          MPLBACKEND: Agg
+        run: |
+          python -m venv .venv
+          . .venv/bin/activate
+          pip install -c .github/requirements-ci.txt maturin numpy "matplotlib==3.11.2"
+          maturin develop --release
+          python tools/benchmark.py --quick --out dist/benchmarks.json
+          python tools/benchmark_guard.py --warn-only dist/benchmarks.json tools/benchmark_baseline.json
+          python tools/visual_compare.py dist/visual --json dist/visual_diff.json
+      - name: Upload the visual mismatch metrics
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: visual-diff-${{ github.sha }}
+          path: |
+            dist/visual
+            dist/visual_diff.json
+          retention-days: 90
+
+  galleries:
+    name: comparison galleries
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - name: Build
+        run: |
+          python -m venv .venv
+          . .venv/bin/activate
+          pip install -c .github/requirements-ci.txt maturin numpy "matplotlib==3.11.2" pypdfium2 cairosvg
+          maturin develop --release
+      - name: Fetch the harvested sources
+        run: |
+          pip download --no-binary :all: --no-deps "matplotlib==3.11.2" -d dist/sdist
+          mkdir -p dist/mpl-sdist
+          tar -xzf dist/sdist/matplotlib-3.11.2.tar.gz -C dist/mpl-sdist
+          git clone --depth 1 --filter=blob:none --sparse -b v3.11.2 \
+            https://github.com/matplotlib/matplotlib dist/mpl-src
+          git -C dist/mpl-src sparse-checkout set galleries/examples
+          git clone --depth 1 --filter=blob:none --sparse -b v0.13.2 \
+            https://github.com/mwaskom/seaborn dist/sns-src
+          git -C dist/sns-src sparse-checkout set examples
+      - name: Regenerate the galleries
+        env:
+          MPLBACKEND: Agg
+        run: |
+          . .venv/bin/activate
+          python tools/harvest_matplotlib.py --out dist/mpl-corpus
+          python tools/harvest_matplotlib.py --examples dist/mpl-src --out dist/mpl-examples
+          python tools/harvest_seaborn.py --out dist/seaborn-gallery
+      - name: Summarise the galleries
+        run: |
+          . .venv/bin/activate
+          python tools/gallery_summary.py --out dist >> "$GITHUB_STEP_SUMMARY"
+
+  criterion:
+    name: criterion output benchmarks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - name: Run the output-stage Criterion suite
+        run: cargo bench --bench render -- --quick
+      - name: Report the Criterion budget
+        run: python tools/criterion_guard.py --warn-only target/criterion benches/criterion_baseline.json
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: criterion-${{ github.sha }}
+          path: target/criterion
+          retention-days: 90
+
+  trace:
+    name: coverage trace
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - name: Check coverage against baseline
+        env:
+          MPLBACKEND: Agg
+        run: |
+          python -m venv .venv
+          . .venv/bin/activate
+          pip install -c .github/requirements-ci.txt maturin numpy "matplotlib==3.11.2"
+          maturin develop --release
+          TRACE_DIR=$(python -c "import matplotlib, pathlib; print(pathlib.Path(matplotlib.__file__).parent / 'tests')")
+          python tools/trace_unsupported.py --check "$TRACE_DIR"

matplotvite-0.6.0/.github/workflows/pages.yml

@@ -0,0 +1,84 @@
+name: Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build Example Gallery
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.12"
+
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+
+      - name: Build matplotvite
+        run: |
+          python -m venv .venv
+          . .venv/bin/activate
+          pip install -c .github/requirements-ci.txt maturin numpy pandas "matplotlib==3.11.2" pypdfium2 cairosvg
+          maturin develop --release
+
+      - name: Fetch the harvested sources
+        run: |
+          . .venv/bin/activate
+          mkdir -p /tmp/mpl-sdist /tmp/sdist
+          pip download --no-binary :all: --no-deps "matplotlib==3.11.2" -d /tmp/sdist
+          tar -xzf /tmp/sdist/matplotlib-3.11.2.tar.gz -C /tmp/mpl-sdist
+          git clone --depth 1 --filter=blob:none --sparse -b v3.11.2 \
+            https://github.com/matplotlib/matplotlib /tmp/mpl-src
+          git -C /tmp/mpl-src sparse-checkout set galleries/examples
+          git clone --depth 1 --filter=blob:none --sparse -b v0.13.2 \
+            https://github.com/mwaskom/seaborn /tmp/sns-src
+          git -C /tmp/sns-src sparse-checkout set examples
+
+      - name: Generate comparison galleries
+        env:
+          MPLBACKEND: Agg
+        run: |
+          . .venv/bin/activate
+          python tools/harvest_matplotlib.py --source /tmp/mpl-sdist --out dist/mpl-corpus
+          python tools/harvest_matplotlib.py --examples /tmp/mpl-src --out dist/mpl-examples
+          python tools/harvest_seaborn.py --source /tmp/sns-src --out dist/seaborn-gallery
+          python tools/visual_compare.py dist/visual-svg --format svg
+          # Built after the galleries so the coverage section can summarise them.
+          python tools/build_pages.py --out dist
+
+      - name: Setup Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: dist
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

matplotvite-0.6.0/.github/workflows/publish.yml

@@ -0,0 +1,146 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - "v*"
+  # Re-run an interrupted upload for an existing tag without tagging again.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check-version:
+    name: tag matches package version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - name: Compare the tag with the version in pyproject.toml, Cargo.toml and Cargo.lock
+        # PyPI rejects a duplicate version, so a mistyped tag would build every
+        # wheel and only fail at the upload. Stop before the matrix starts, and
+        # make sure the three manifests agree so the published metadata is not
+        # split between different versions.
+        if: github.ref_type == 'tag'
+        run: |
+          python - <<'PY'
+          import os
+          import pathlib
+          import sys
+          import tomllib
+
+          def load(path):
+              return tomllib.loads(pathlib.Path(path).read_text())
+
+          tag = os.environ["GITHUB_REF_NAME"]
+          wanted = tag[1:] if tag.startswith("v") else tag
+          cargo = load("Cargo.toml")["package"]
+          locked = next(
+              (item["version"] for item in load("Cargo.lock")["package"] if item["name"] == cargo["name"]),
+              None,
+          )
+          if locked is None:
+              sys.exit(f"{cargo['name']} is missing from Cargo.lock")
+          versions = {
+              "pyproject.toml": load("pyproject.toml")["project"]["version"],
+              "Cargo.toml": cargo["version"],
+              "Cargo.lock": locked,
+          }
+          mismatched = {path: version for path, version in versions.items() if version != wanted}
+          if mismatched:
+              found = ", ".join(f"{path} says {version}" for path, version in mismatched.items())
+              sys.exit(f"tag {tag} does not match: {found}")
+          print(f"tag {tag} matches " + ", ".join(f"{path} {version}" for path, version in versions.items()))
+          PY
+
+  wheels:
+    name: wheel (${{ matrix.name }})
+    needs: check-version
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: linux-x86_64
+            os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            manylinux: auto
+            interpreter: python3.13
+          - name: linux-aarch64
+            os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            manylinux: auto
+            interpreter: python3.13
+          - name: macos-arm64
+            os: macos-latest
+            target: aarch64-apple-darwin
+            interpreter: python
+          - name: macos-x86_64
+            os: macos-15-intel
+            target: x86_64-apple-darwin
+            interpreter: python
+          - name: windows-x86_64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+            interpreter: python
+          - name: windows-arm64
+            os: windows-11-arm
+            target: aarch64-pc-windows-msvc
+            interpreter: python
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          target: ${{ matrix.target }}
+          manylinux: ${{ matrix.manylinux }}
+          # Same stable-ABI wheel as CI: one cp39-abi3 build serves every
+          # interpreter above 3.9, so the matrix only varies by platform.
+          args: --release --out dist --interpreter ${{ matrix.interpreter }}
+      - name: Build the sdist
+        # The tarball is platform independent, so exactly one job builds it.
+        if: matrix.name == 'linux-x86_64'
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: sdist
+          args: --out dist
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: wheel-${{ matrix.name }}
+          path: dist/*.whl
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: matrix.name == 'linux-x86_64'
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+
+  publish:
+    name: Publish to PyPI
+    needs: wheels
+    runs-on: ubuntu-latest
+    # Must match the environment name registered in the PyPI trusted publisher.
+    environment: pypi
+    permissions:
+      # PyPI trusted publishing exchanges this OIDC token for a short-lived key.
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: wheel-*
+          path: dist
+          merge-multiple: true
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: sdist
+          path: dist
+      - name: Upload the wheels and sdist to PyPI
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: upload
+          # Re-runs after a partial upload keep the files PyPI already has.
+          args: --skip-existing --non-interactive dist/*

matplotvite-0.6.0/.gitignore

@@ -0,0 +1,21 @@
+# Rust
+target/
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+*.pyd
+*.dylib
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+dist/
+wheels/
+*.egg-info/
+.venv/
+env/
+
+# Output
+visual/

matplotvite-0.6.0/.jules/bolt.md

@@ -0,0 +1,5 @@
+# Bolt's Journal - Critical Performance Learnings
+
+## 2026-03-30 - Python-side Data Extent Calculation Bottleneck on Dense Data
+**Learning:** Even though rendering itself is written in compiled Rust, Python-side figure preparation can become the dominant bottleneck when plotting dense datasets (e.g. 50k–100k points). Specifically, `Axes._extent_x` and `_extent_y` previously flattened all coordinate arrays into a giant Python list using `list.extend(np.asarray(arr).ravel())` before feeding it to `_span(xs)`, which converted the list back into a NumPy array. For 100k points, constructing and boxing 100,000 Python float objects twice (for X and Y limits) took ~24 ms, whereas the entire Rust rendering pass took ~12 ms.
+**Action:** When computing extents across heterogeneous graphical primitives in Python, accumulate running `(min, max)` tuples directly using vectorized `fin = arr[np.isfinite(arr)]; (min(ext[0], fin.min()), max(ext[1], fin.max()))` per array rather than concatenating arrays into a Python list. This cut 100k line plot time by more than half (speedup vs matplotlib jumped from 5.0× to 10.2× on PNG and 5.0× to 27.9× on SVG).

matplotvite-0.6.0/.jules/sentinel.md

@@ -0,0 +1,6 @@
+# Sentinel's Journal - Critical Security Learnings
+
+## 2026-03-30 - Unbounded Canvas Dimensions Causing Out-Of-Memory / Integer Overflows
+**Vulnerability:** Figure size (`figsize`) and resolution (`dpi`) were accepted without positive-finite validation or maximum bounds checking in both Python and Rust layers. Unchecked parameters allowed non-positive or excessive numbers, leading to integer overflow conversions or multi-terabyte buffer allocations in Rust rendering engines that crashed or aborted the host process (Denial of Service).
+**Learning:** PyO3 bindings converting Python floats directly into integer pixel counts (`(round(w * dpi), round(h * dpi))`) without range validation can cause `OverflowError` on negative/infinite inputs and immediate OOM aborts on huge values in native rasterizers (`tiny-skia` / `resvg`).
+**Prevention:** Validate dimension inputs at the Python API boundary (`_validate_dimension`) ensuring positive, finite numbers and reasonable upper bounds on pixel dimensions (32,768px) and total pixel count (2^28 px), and mirror the bounds checking defensively in Rust before memory allocations.