A few things I noticed:

1. luautf8 bump 0.1.6-1 → 0.2.1-1 — We've had issues in the past with newer luautf8 having stricter UTF-8 validation that broke edge case tests. Is this bump required for 5.5 compat, or incidental?

2. Other removed math functions — math.cosh, math.sinh, math.tanh, and math.log10 were removed in Lua 5.3 but the extern in lua/Math.hx still exposes them unconditionally. Pre-existing issue, but since this PR is tackling version compat it might be worth adding #if !(lua_ver >= 5.3) guards on those too.

3. atan signature change is unconditional — The extern changes to atan(y:Float, ?x:Float) for all Lua versions, but on 5.1/5.2 math.atan only takes one arg — the ?x would be silently ignored. The docstring mentions this, which is good, but it could be a subtle footgun for anyone calling lua.Math.atan(y, x) on older versions and getting wrong results without error.

Also — what's the plan for the hx-lua-simdjson dependency? Is that close to being merged, or does this PR need to wait on it?

1. This is explained in the commit message:

Lua 5.5 requires 0.1.7+, but 0.1.7 to 0.2.0 have a bug with invalid
arguments to utf8.char. 0.2.1 gives 5.5 support and fixes the argument
issue.

This is what gives 5.5 compat but causes a crash in edge cases: starwing/luautf8@38b1541, and this is the bug fix that fixes the crash: starwing/luautf8#60

2. These are actually in the same situation as atan2: they were deprecated in lua 5.3 but it looks like they still exist in 5.3 and 5.4, and are removed properly in 5.5. So I guess that makes sense to handle here

3. Currently we need atan and atan2 to have compatible signatures for version agnostic builds:
   https://github.com/tobil4sk/haxec/blob/e13af455497518c8afe5f818d01c09a1c83059b2/std/lua/_std/Math.hx#L101
   I'll try to see if we can change the definition for lua_ver<=5.2. If no lua_ver is set we probably should still show both arguments? Not sure what the best solution is there.

The hx-lua-simdjson PR should be ready to merge

Tested luautf8 0.2.1 locally — you're right, the bump is safe. Confirmed that 0.1.7 crashes on utf8.char(-1) (C assertion failure) and 0.2.1 fixes it cleanly. The 0.2.0 width() API break doesn't affect us since Haxe never calls those functions. Edge case validation (surrogates, overlong sequences, beyond-max codepoints) all behaves identically to 0.1.5.

Good to know about the cosh/sinh/tanh/log10 situation — makes sense to handle them here since they follow the same deprecation→removal pattern as atan2.

I handled the other deprecations as suggested. I also hid the 2nd atan argument when explicitly targeting 5.1/5.2 and luajit, though it is still exposed for untargeted builds.

Is this safe to merge?

I think it should be, if the version handling looks good to you now?

@Simn do you want to give this one final sniff and do the honors? I believe it's an improvement for handling runtime variants across the Lua target versions.