[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/pdfcpu/pdfcpu	v0.15.0 → v0.16.4

---

Release Notes

pdfcpu/pdfcpu (github.com/pdfcpu/pdfcpu)

v0.16.4

Compare Source

pdfcpu v0.16.4

This is a security update for crafted PDFs and form or create data that could cause excessive CPU or memory use or terminate a
process.

Additive Go API Changes: types.DecodeStreamFunc and types.NewLazyObjectStreamObjectWithDecoder.
Existing constructors and signatures remain unchanged.
Requires Go 1.26 or later.

Release binaries were built with Go 1.27.3, which includes security fixes for crypto/x509.

1) Unbounded object traversal — GHSA-2623-w998-vcr4:

Long chains of PDF objects could exhaust the Go stack and terminate the process during optimization while reading,
annotation removal, or page migration. These paths now use iterative traversal. The fix preserves long valid chains,
handles objects whose value is another reference, and bounds error-path output.

Fix: 0bb00190.

2) Repeated stream data — GHSA-pr6x-vqwr-4hj2:

Shared or nested stream aliases and oversized declared lengths could make a small PDF retain unbounded encoded or
decoded data. Encoded streams now count toward the existing per-read budget, lengths past the end of the input no
longer size buffers, and compressed xref entries that share one current object-stream index are rejected.

Filtered decodes through XRefTable.DecodeStream and lazy object streams each receive a separate cumulative allowance
A = max(1 GiB, 2 × MaxDecodeBytes); both default to 1 GiB. The allowances count cumulative decoding, not live memory.
Object streams remain lazy, image extraction remains subject to its per-stream and image limits, and a negative
MaxDecodeBytes disables these limits.

Fix: 82c88cec.

3) Poster tile grids — GHSA-g5q6-53hx-f68j:

A crafted page size could make poster create an unbounded number of tile definitions and output pages, consuming
excessive CPU and memory. Poster output is now limited to 1,000 tiles per source page, and oversized grids are rejected
before page content is transformed or tile objects are allocated. Zero, negative and non-finite page or tile dimensions
are rejected.

Tiles produced by poster, cut and ndown now share one resource dictionary per source page instead of carrying a
copy each. With a margin, each tile references the shared page content through a content array instead of embedding a
copy of it. Rendered output is unchanged.

Fix: a9725db6.

4) Create table dimensions — GHSA-cphg-88q6-whwh:

Table rows and cols in a create template were unbounded, so a few hundred bytes of JSON could make create
allocate and render without limit. All tables of a template now share a limit of 100,000 rows plus columns. A table
whose anchor is invalid, or given together with pos, is now rejected; previously its remaining validation was
skipped.

Fix: 5367e878.

5) Unbounded page numbers — GHSA-gx4m-7r76-vpww:

A large page number in a create template or form-fill data could make pdfcpu allocate excessive memory or stall.
create now limits additions to 1,000 pages beyond the existing document; form fill and form multifill accept image
page numbers only within the document. Both paths reject page numbers below 1.

Fix: ebac361a.

6) Bookmark split page numbers — GHSA-p2r6-9jcq-fp7v:

An outline destination with a very large page number could make split -m bookmark allocate memory proportional to
that number, or panic for library callers. Bookmark page spans are now checked against the page count before their
pages are listed; such files fail with the same "invalid page number" error as before.

Fix: 70f1a860.

7) Shared resource graphs — GHSA-vwmc-mhq7-fqhc:

Validation could repeatedly process the same shared object through different paths in resource, pattern, property-list
and visibility-expression graphs. A small PDF could therefore keep validation busy for an extended time. The fix
reuses successful validation results while preserving checks on deeper paths and existing cycle handling. Commands
that validate PDFs during reading benefit from the fix.

Fix: 7653f158.

8) Shared object comparison graphs — GHSA-8pv5-h3hv-xhc9:

Object comparison could repeatedly process the same pair of indirect objects when font, image, form XObject or
content-stream dictionaries contained shared reference graphs. The comparison is used by default for font, image and
form XObject deduplication, validation's info-dictionary reconciliation and image reuse during create; content-stream
deduplication is optional. A small PDF could therefore cause exponential comparison work. Object comparison now memoizes
indirect-reference pairs for the duration of each comparison, limits distinct pairs to the document's object table size
and enforces the existing recursion-depth limit. Reaching either limit conservatively treats the objects as different,
so callers keep both objects instead of failing the command; the optimize log reports the cutoff.

Fix: d6abb27e.

Thanks

Special thanks to Black Water (@​Manyo9) for reporting these vulnerabilities.

Changelog

• 0f5ac76 bump version
• a9725db fix GHSA-g5q6-53hx-f68j: bound poster tile grids
• d6abb27 fix GHSA-8pv5-h3hv-xhc9: memoize indirect-reference pairs in object comparison
• 5367e87 fix GHSA-cphg-88q6-whwh: bound create table rows and columns
• 70f1a86 fix GHSA-p2r6-9jcq-fp7v: check bookmark page spans before splitting
• 82c88ce fix GHSA-pr6x-vqwr-4hj2: bound repeated stream data while reading
• ebac361 fix GHSA-gx4m-7r76-vpww: bound page numbers in create and form fill
• 0bb0019 fix GHSA-2623-w998-vcr4: walk object graphs without recursion
• 7653f15 fix GHSA-vwmc-mhq7-fqhc: validate shared resource graphs once per depth
• 358a9a9 add GHSA regression tests and use ghsa_ test naming

v0.16.3

Compare Source

pdfcpu v0.16.3

This is a security update fixing configured decoded-byte limit bypasses and restricting local image access in create and form input.

Applications handling untrusted PDFs or create/form input should upgrade.

Decoded-byte limits — GHSA-jp42-qm45-2x6g:

Honor Limits.MaxDecodeBytes across stream decoding and combined page content, and stop cross-reference repair after
limit failures. Strengthen Flate predictor, DCT and cached-content checks, with regression coverage for strict/relaxed
validation and eager/deferred decoding.

The limit bounds individual decoded streams and combined page content, not total process memory.

Additive Go API change: Add StreamDict.DecodeWithLimit and StreamDict.DecodeLengthWithLimit to supply the
configured decode limit explicitly.

Local image access — GHSA-44h9-p34h-2w4p:

Confine local images referenced by create, form fill, and JSON/CSV form multifill input to an allowed directory.
Reject absolute paths, parent-directory components, symlink escapes and non-regular files, and report access denials
as errors.

Compatibility change:
API callers must set conf.LocalImageRoot to enable local images; an empty value disables
them. The CLI defaults to its working directory; set localImageRoot in config.yml to select another root.
Update image paths to be relative to that root. Confined local images are unavailable on js/wasm.
See local image access for migration guidance and limitations.

Documentation:
Updated security policy clarifies vulnerability scope, supported releases and guidance for AI-assisted reports and multiple findings.
Updated pull request template clarifies contribution requirements.
Added local image configuration and migration guidance to README and website.

Requires Go 1.26 or later, unchanged from v0.16.2.

Thanks

Special thanks to Ondrej Bilek (@​bilcus) for reporting GHSA-jp42-qm45-2x6g

Changelog

• 35ea259 bump version
• 8befe54 confine local images in create and form input
• c1db2d5 honor configured decode limits across stream consumers

v0.16.2

Compare Source

pdfcpu v0.16.2

Hello!

This release makes PDF workflows more reliable:

• preserving document content during processing
• improving forms and encrypted PDFs
• handling malformed files more safely.

Upgrading is highly recommended. Existing Go API signatures remain unchanged.

Release binaries were built with Go 1.27.2, which includes important security fixes.
Building requires Go 1.26 or later.

Highlights

• Preserve more of your documents. Fixes retain inherited page boundaries and resources, shared stamp resources,
  catalog data, and named destinations during affected page, merge, stamp, and bookmark operations.

• Work more reliably with forms. Improvements cover inherited fields, checkboxes and radio buttons, export ordering,
  JSON field matching, empty list boxes, and Unicode text limits.

• Improve text and image fidelity. Fixes address text decoding, font mappings and widths, CMYK image extraction,
  RGBA image import, and compressed image data.

• Improve encrypted PDF handling. Corrections cover AES-256 passwords, crypt-filter selection, extraction permissions,
  and encryption of strings rewritten from object streams.

For Existing Users

• Validation is more precise. Strict mode rejects additional malformed inputs. Relaxed mode retains applicable
  compatibility cases and reports notices; it does not bypass every validation or writing requirement.

• PDF 2.0 output has additional checks. Writing fails when required annotation appearances are missing. Automatic
  appearance generation remains incomplete. Standard-font metric completion can also report errors for partial metrics
  or unsupported encodings it cannot reconstruct.

• Extraction permissions are enforced correctly. Accessibility permission alone no longer authorizes general extraction.

• AES-256 password preparation is corrected. Unicode normalization and password-length handling now apply consistently
  when creating and opening encrypted files. Encryption defaults are unchanged.

• Corrected decoding may change results. Applications comparing extracted text or image data should review their
  expected output.

For API Users

• Existing exported function and method signatures, including pkg/api, remain unchanged.

• Supporting packages receive additive exports for catalog entries, standard-font metric completion, and annotation
  appearance checks.

• Integrations should account for the behavior changes above, particularly stricter validation, corrected extraction
  permissions, and PDF 2.0 write errors.

Fixed Security Advisories

• GHSA-ppm7-rg95-2c2p — Plaintext strings in encrypted PDFs
  When encrypting PDFs containing object streams, some strings could remain readable without a password despite the
  operation completing successfully. Affects versions v0.8.0 through v0.16.1.

• GHSA-gj7c-wpph-xx35 — Process termination from recursive stream references
  Malformed PDFs with circular /Filter or /DecodeParms references could cause a fatal stack overflow. v0.16.2 detects
  these references and returns an error. Affects Go module versions v0.2.3 through v0.16.1; older repository releases
  are also affected.

If an affected version was used to encrypt PDFs containing object streams, review the
output for exposed sensitive material and regenerate it from a trusted source.
Upgrading does not repair files already produced.

Reliability and Security

• Bound excessive parsing work, reject circular stream-filter references, and enforce resource limits during decoding
  and cross-reference repair.

• Prevent malformed-input panics involving object streams, cross-reference data, colour spaces, and annotations.

• Correct PDF whitespace handling, inline-image parsing, effective-version detection, and damaged-file recovery.

• Strengthen validation across images, graphics, destinations, page labels, and PDF 2.0 entries while restoring targeted
  multimedia compatibility.

• Expand regression coverage for encryption, document preservation, forms, parsing, images, fonts, and validation.

Internals and Performance

• Reuse validation results for shared JavaScript, Web Capture, 3D, RichMedia, and Rendition objects, reducing repeated
  work while retaining cancellation and cycle checks.

• Reduce allocation overhead when parsing large certificate revocation lists. Regression tests check preservation of
  revocation entries and signatures and bound allocation counts.

Thanks

Thanks to everyone who reported issues and helped improve pdfcpu.

Special thanks to @​qoke and the IQ Hive team for contributing the substantial set of fixes behind this release.

v0.16.1

Compare Source

v0.16.1

Security and stability update with no public API changes.
Requires Go 1.26 or later.

This release fixes a denial-of-service vulnerability in grayscale and Indexed image rendering, including CalRGB palette
handling. Processing a crafted PDF could cause an index-out-of-range panic and terminate the calling process if the
panic was not recovered.

Versions v0.16.0 and earlier are affected.
Applications extracting or rendering images from untrusted PDFs should upgrade to v0.16.1.
See GHSA-6524-w46v-6399.

Improvements:

• Harden PDF parsing, image processing, JSON input handling, and signature-data parsing.
• Prevent panics when rendering grayscale and Indexed images, including palette bounds and Decode mapping checks.
• Strengthen external-link checks and reporting of problematic links; redact URL passwords in reports and CLI output.
• Improve structural validation of embedded files, 3D annotations, and multimedia dictionaries.
• Report JavaScript and supported media presence during validation without executing content or displaying script code.
• Report invalid zero-offset xref entries as skipped in relaxed validation and reject them in strict mode (#​612).
• Fix strict validation of PDF dates ending in Z (#​1493).
• Update the TIFF dependency to v1.0.7.

Thanks

Special thanks to @​xaferima) for reporting GHSA-6524-w46v-6399

v0.16.0

Compare Source

v0.16.0

This release updates the Go API and configuration model, improves automation and PDF validation, and includes processing fixes and security hardening.

Changes since v0.16.0-rc.1

• Protect image buffer allocations against integer overflow and enforce resource limits before decoding each TIFF page.
• Fix default-configuration handling (#​1492): synchronize access to the cached default configuration and return independent clones to callers.

Security advisories

This release includes fixes covered by six security advisories.

• Integer overflow in image buffer allocation
• Traditional cross-reference tables bypass configured XRef limits
• Packed RGB image samples can cause an index-out-of-range panic during image extraction
• Missing BitsPerComponent can cause a nil-pointer panic during image extraction
• Integer overflow in XRef stream /W array can cause denial of service
• Off-by-one revision mapping weakens PDF signature modification reporting

Highlights

• Updated Go API — Explicit contexts for long-running operations, optional progress reporting, and reusable caller-owned configuration.
• Configuration redesign — Schema-aware loading, explicit initialization and reset, plus read-only and stateless operation.
• Automation and container preparation — Signal cancellation, safer output replacement, password-file inputs, and verified execution under arbitrary user IDs.
• Stronger PDF validation — Improved malformed-input handling, graph-traversal safeguards, and compatibility warnings for selected relaxed-validation decisions.
• Clearer signature validation — Separate reporting of document integrity, certificate trust, revocation, and timestamp evidence.
• PDF processing fixes — Improved resize orientation, rotated watermarks, form appearances, image handling, and LZW decoding.
• Smaller Go module — Approximately 94% smaller in the original packaging comparison. Samples and test fixtures remain in Git but are excluded from module downloads.

Requirements and installation

Go applications require Go 1.26 or later and updates to affected API calls. Existing file-backed configurations from v0.15 or earlier require an explicit configuration reset.

go get github.com/pdfcpu/pdfcpu@v0.16.0

Before upgrading

Reset legacy file-backed configuration

Existing v0.15 and older config.yml files do not contain the new configuration schema identifier. pdfcpu preserves the
file and reports that a reset is required instead of rewriting it automatically.

If the configuration is not customized, run:

pdfcpu config reset
pdfcpu config validate

For an explicit configuration root, use the same root for every command:

pdfcpu --conf /srv/pdfcpu config reset
pdfcpu --conf /srv/pdfcpu config validate
pdfcpu --conf /srv/pdfcpu config inspect

Before resetting, back up any customized config.yml. After resetting, reapply your settings.
Installed user fonts and trusted certificates are preserved.

New installations and stateless operation with --conf disable need no migration.

See the v0.16 configuration upgrade guide.

Update Go API callers

Change	Required action
Long-running operations require a context.Context	Pass the request or job context, or context.Background() when cancellation is not needed. Nil contexts are rejected.
Validation and optimization operations take a final *api.ProgressOptions	Pass nil when progress events are not needed.
LoadConfiguration() now takes options and returns an error	Call api.LoadConfiguration(api.ConfigurationOptions{}) and handle the error.
Context-free and interim WithContext/WithOptions variants were consolidated	Use the canonical operation name.

Configurations supplied by an application remain caller-owned and can be reused after an operation. Clone a configuration
before applying different settings for another job; do not mutate it concurrently while operations use it.
Passing nil loads the default configuration and may initialize files on disk. For stateless
applications, explicitly load api.ConfigurationModeStateless and pass the returned configuration.

See API installation and usage and the
v0.16 migration guide for before/after examples.

Configuration and runtime

Explicit configuration modes

• Automatic discovers or initializes file-backed configuration for normal CLI and API use.
• Read-only loads a prepared configuration tree without modifying it.
• Stateless uses built-in settings and the 14 core PDF fonts without accessing configuration files, user fonts or the
  local certificate store.

The CLI selects stateless mode with --conf disable.

Applications select a mode through api.ConfigurationOptions.

Configuration root precedence is the explicit flag, PDFCPU_CONFIG_ROOT, then the operating-system default.
Normal CLI PDF
commands have no read-only-mode flag: prepare the complete tree first and mount it read-only.
Go applications can select api.ConfigurationModeReadOnly to load existing configuration without modifying files.

The new commands are:

pdfcpu config init
pdfcpu config list
pdfcpu config inspect [--json]
pdfcpu config validate
pdfcpu config reset

Use
pdfcpu config inspect for configuration paths and effective policy.

Cancellation and transactional output

The CLI responds to Ctrl+C, SIGINT and SIGTERM. The first signal requests a clean stop; a second signal terminates
immediately. Go callers control cancellation through the context passed to the operation.

Cancellation is cooperative, so a large operation may take a moment to reach a safe stopping point. File-producing
operations stage output before publication. When cancellation or an ordinary write failure occurs before publication,
an existing destination is preserved and unfinished temporary output is removed.

Stdin PDF input and merged form multi-fill output to stdout use the operating-system temporary directory. Replacement
files are staged beside their destination. On supported Unix systems, replacement preserves the destination group or
fails before publication.

Password files

Use --upw-file or --opw-file wherever the corresponding literal password flag is accepted. Supply a password either
directly or through a file, not both. Password files cannot use stdin.

One trailing LF or CRLF is ignored. Other spaces and line endings remain part of the password. An empty file supplies an
empty password, except where a non-empty owner password is required.

Password changes can replace their positional old/new password pair with:

Command	Old password	New password
changeupw	--upwold-file	--upwnew-file
changeopw	--opwold-file	--opwnew-file

Both file options for a password change must be supplied together.

Resource and network policy

• maxInputBytes optionally limits each PDF input, including stdin spooling. Zero remains unlimited.
• maxObjectBytes exposes the existing per-object reader buffer limit. Its default remains 64 MiB.
• Offline mode now consistently covers remote images, link validation and live CRL/OCSP requests.
• Outbound image and revocation requests reject loopback, private, link-local, multicast, unspecified and selected
  special-purpose destinations by default. Trusted private revocation hosts can be configured explicitly.

These settings limit individual inputs or operations; they are not a total memory, disk or job-time budget.

Validation

Compatibility warnings

Compatibility-warning coverage has substantially expanded. Relaxed validation reports selected conditions that strict validation would reject, indicating whether content was accepted, skipped or repaired in memory. These warnings are available through the CLI and structured API reports; --quiet suppresses CLI warnings.

Go callers can obtain the same ordered report through ValidateWithReport, ValidateFileWithReport and
ValidateContextWithReport. Existing error-only validation APIs remain available.

Warning coverage is partial and will expand over time. Some relaxed-validation fallbacks produce no notice, so silence
does not imply strict validation.

Strict validation describes the checks pdfcpu currently implements; it does not certify complete ISO 32000 compliance
or prove that no bounded low-level reader recovery occurred.

Expanded validation and malformed-input handling

Stronger validation and safer handling of malformed PDFs, including improved bounds checks, cycle detection and error reporting. Relaxed mode adds targeted compatibility exceptions while strict validation retains its requirements.

Signature-validation evidence

Signature validation now clearly separates integrity, certificate trust, revocation and timestamp evidence from the
overall local assessment. See the signature-validation guide for output examples,
supported checks and current limitations.

Distribution and constrained environments

The Go module now excludes samples and test fixtures while retaining all runtime resources (#​1449).

This release prepares pdfcpu for container deployment; an official image is planned for v0.17.

Compatibility summary

• Existing v0.15 and older file-backed configuration requires an explicit reset.
• Long-running Go APIs require a non-nil context under their canonical names.
• Validation and optimization APIs listed above require the final progress argument.
• Strict validation may reject malformed structures that earlier releases did not check.
• Relaxed compatibility warnings do not yet cover every pre-existing fallback.
• Cancellation takes effect at checkpoints, so some operations may not stop immediately.

Thanks

Special thanks to @​xaferima) and @​lmonstergg) for reporting vulnerabilities.

Fixed issues

#​1407,
#​1444,
#​1449,
#​1457,
#​1460,
#​1461,
#​1465,
#​1466,
#​1467,
#​1470,
#​1472,
#​1473,
#​1474,
#​1477,
#​1479,
#​1484,
#​1485,
#​1487,
#​1492.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
golang.org/x/image	v0.45.0 -> v0.47.0
github.com/hhrutter/tiff	v1.0.6 -> v1.0.7