Skip to content

fix(deps): update module github.com/pdfcpu/pdfcpu to v0.15.0 - #11

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-pdfcpu-pdfcpu-0.x
Open

fix(deps): update module github.com/pdfcpu/pdfcpu to v0.15.0#11
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-pdfcpu-pdfcpu-0.x

Conversation

@renovate

@renovate renovate Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/pdfcpu/pdfcpu v0.13.0 → v0.15.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

pdfcpu/pdfcpu (github.com/pdfcpu/pdfcpu)

v0.15.0

Compare Source

pdfcpu v0.15.0

This release is a focused follow-up to v0.14.0 improving diagnostics and observability for validating large PDF corpora.
It also includes PDF processing hardening, CJK text wrapping for watermarks, and clearer signature-validation
behavior.

v0.15.0 follows v0.14.0 by only one week because post-release corpus testing made an existing operational gap clear:
large wildcard-driven validation runs delayed failure diagnostics until the full input set completed and provided no
quiet-mode indication of the file currently being processed.

The changes are targeted and immediately useful to corpus testers, so holding them for a later feature release would unnecessarily delay feedback. The short interval is intentional and does not establish a weekly release routine.

Corpus validation diagnostics

Multi-file CLI validation now reports each failed input as soon as the failure is detected, continues with the remaining
inputs, and exits nonzero with a compact summary:

validation failed: 66 of 463 files invalid

The new --progress flag identifies the active input during quiet validation runs. This is useful when a long-running
corpus job stalls on a particular file:

pdfcpu validate -q --progress "**/*.pdf"

The quotes are intentional. They pass the recursive pattern to pdfcpu for internal expansion instead of asking the shell
to expand thousands of paths into one command line, which may exceed the operating system's argument-size limit.

With -q --progress, progress and validation failures are written to standard error while standard output remains
clean:

validating(mode=relaxed) path/to/input.pdf ...
validate path/to/input.pdf: validation error: ...

Corpus testing and issue reports

There is a new Corpus Validation guide documenting quick assessment,
progress monitoring, logging, validation modes, result interpretation, and focused issue reporting.

A failed corpus run is diagnostic input, not an issue backlog.
Public reports must isolate one manually verified and independently reproduced problem with the smallest shareable PDF.
Include the relevant error and final summary, and attach large logs as compressed files instead of pasting them into an issue.

AI-generated, bulk-generated, or mechanically reformatted corpus reports will be closed immediately without investigation.
Corpus-wide analysis, failure classification, confidential-file investigation, and scheduled remediation are separate engineering work and may require a paid engagement.

Limited corpus investigation and remediation work may be available by arrangement.

PDF validation and processing hardening

Malformed and inconsistent PDF structures now produce more contextual errors across reading, dereferencing, validation,
optimization, fonts, forms, and XObjects. Integer conversion and encryption handling have been tightened, and additional
guards reduce the risk of panics while processing damaged input.

This work is backed by expanded malformed-input, error-path, and optimization regression coverage.

CJK watermark text wrapping

Text watermarks now support automatic wrapping for CJK text, including long runs without spaces. Oversized text is
wrapped to the configured width instead of forcing unintended font-size reduction. This resolves issue #​1427 and
includes expanded CJK wrapping and layout coverage.

Digital signatures

Signature validation output is clearer for legacy and unsupported cases. Evidence handling, PKCS#1 and PKCS#7
processing, and related error classification have also been tightened.

Compatibility notes

The pkg/api multi-file validation contract is unchanged: API callers continue to receive joined errors after
processing. The CLI now streams individual multi-file validation failures and returns a final summary, so scripts that
compare complete stderr strings should be updated to rely on exit status and stable error classification instead.

Existing non-quiet validation already reports the active input.
--progress extends that visibility to quiet corpus runs without duplicating normal progress output.

Changelog

v0.14.0

Compare Source

Safer Processing, Clearer Errors

Changes since v0.14.0-rc.1

Shared custom font directories (#​1454)

Installed font metrics are now world-readable (0644).
Calling api.InstallFonts(nil) reloads existing fonts without modifying the font directory,
allowing fonts installed by one user to be shared safely with other users that have read-only access.

Error handling

The github.com/pkg/errors dependency is gone.
Error handling has been migrated throughout the codebase to standard Go patterns.

Errors now retain useful operation and input context, and exported sentinel errors make failures easier to classify with errors.Is and errors.As.

Public API boundaries now validate nil and invalid arguments instead of risking panics. Multi-input operations return joined
errors where appropriate, while the CLI presents concise errors without exposing stack traces by default.

File operations are safer as well: output is staged before replacement, existing files and permissions are preserved on
failure, filesystem aliases and output collisions are detected, and temporary-file cleanup has been hardened across
platforms.

CLI

CLI users should see clearer and more complete diagnostics, particularly for batch validation, merging, attachments,
encryption, certificates, fonts, and page operations.

Other notable changes include:

  • JSON output for certificate listing.
  • Support for the OneColumn page layout.
  • Optional installed-font selection for fonts cheatsheet.
  • Improved attachment glob handling.
  • Stricter validation of ordered, unique page split points.
  • Clearer certificate-import and replacement behavior.
  • Improved reporting when one or more inputs in a batch fail.

API

The public API now offers more consistent reader/writer and file-based entry points, along with exported errors that callers
can inspect without parsing error strings.

New and expanded API support includes:

  • Grid operations.
  • Raw signature validation.
  • Machine-readable certificate listing.
  • List-oriented bookmark, box, form-field, image, property, permission, and viewer-preference operations.
  • Explicit handling policies for unsupported resources during extraction.
  • Transactional certificate and TrueType collection installation.

Callers that compare complete error strings should migrate to errors.Is or errors.As, as many errors now include
additional operation and source context.

Security, signatures, and dependencies

Signature, timestamp, PKCS#7, certificate-chain, and revocation processing received substantial hardening. This area remains
under active development, and further work on signature creation, validation, revocation, and interoperability is ongoing.

Remote image fetching for create and form inputs now rejects private and local destinations, including redirects and DNS
results. Access to private revocation endpoints must be explicitly allowed through allowedRevocationHosts.

The external github.com/hhrutter/lzw and github.com/hhrutter/pkcs7 dependencies have been replaced by internal
implementations. Remaining dependencies have been updated.

Windows 7

The experimental Windows 7 build is being discontinued because the request for community testing received no response.
It relied on an unofficial patched Go toolchain and could not be tested on Windows 7 in CI.
Official Go releases require Windows 10 or Windows Server 2016 or later.

Additional fixes

This release also includes numerous fixes across parsing, validation, forms, fonts, attachments, merging, page trees,
annotations, images, encryption, and digital signatures, backed by substantially expanded regression and error-path
coverage.

Thanks

Many of the fixes in this release began with reports from you - the pdfcpu users.
Thanks everyone who opened issues, provided reproducible examples, tested fixes, and helped identify difficult PDF edge cases. Your feedback directly improves pdfcpu's reliability.

Changelog

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: github.com/iodesystems/gwag@v0.0.0-00010101000000-000000000000 (replaced by ../gwag): reading ../gwag/go.mod: open /tmp/renovate/repos/github/IodeSystems/gwag/go.mod: no such file or directory

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants