From 89fad2f27c4f74f34e9d9dfc1d5e51c8ca6d22c6 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Thu, 27 Aug 2026 20:45:50 +0200 Subject: [PATCH] deps: catch up with the siblings, and set Renovate to watch them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two halves of the same problem: this module was behind its own siblings, and nothing was watching. WHAT IT WAS BEHIND ON reader v0.6.0 carries fixes this module was doing without, including two denial of service defects it was handing to its own callers: a 219-byte file with no trailer, whose last object is numbered 2 147 483 647, took 21.2 s to open and allocated not one byte — so no memory limit caught it; /Crypt, which 209 files (12.8% of the 1 633 real government forms) carry and which used to make every one of them decode to nothing readable; a second map-order non-determinism, in indexObjectStreams, giving five different answers in five runs of the same binary on the same file; a damaged stream's decoded prefix kept and labelled as salvage, rather than returned with a nil error as though it were the whole of it. WHY IT HAPPENED, AND WHAT STOPS IT HAPPENING AGAIN Nothing in this organisation was watching for a sibling's release. The org already has a Renovate preset at go-pdfkit/.github, with rules for Go modules and for actions — and not one of the ten Go modules extends it, so the preset has never been read. This adds the one-line renovate.json that does, matching what every go-ruby-* repository already has. That is the durable half. Renovate still has to be installed on the organisation for it to run, which this cannot do from here. Co-Authored-By: Claude Opus 5 --- go.mod | 2 +- go.sum | 4 ++-- renovate.json | 4 ++++ 3 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 renovate.json diff --git a/go.mod b/go.mod index d66dfb5..fe6a7e0 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.26.4 require ( github.com/go-gfx/gfx v0.10.0 - github.com/go-pdfkit/forms v0.2.1 + github.com/go-pdfkit/forms v0.2.2 github.com/go-pdfkit/ops v0.7.0 github.com/go-pdfkit/reader v0.6.0 github.com/go-pdfkit/render v0.11.0 diff --git a/go.sum b/go.sum index ec01068..e0afb4c 100644 --- a/go.sum +++ b/go.sum @@ -24,8 +24,8 @@ github.com/go-opentype/opentype v0.10.0 h1:cZVMZ3RVkcijXmxlmpqyVkjlNc33aSB2ugKVW github.com/go-opentype/opentype v0.10.0/go.mod h1:AOixevJf7XQaH7+WG+OMIOZEbYPXfMqklVk26Y6YTUU= github.com/go-opentype/shape v0.5.0 h1:jHNaOMHNBdDj5EixOevlrrsi92svMxvVMKN7GYaPfxo= github.com/go-opentype/shape v0.5.0/go.mod h1:3ImRYNIj6zpwWQ/DV3BWhgMFfmzDITH6XpZw2auQHTo= -github.com/go-pdfkit/forms v0.2.1 h1:INa2GwAadxEhcXvBe7zJYgapYwaGn9WIaLxUJU/lm6A= -github.com/go-pdfkit/forms v0.2.1/go.mod h1:LORxkdP4FVULFk0/PA0CdPZc1dZF9zTSaHrtfM7IYaw= +github.com/go-pdfkit/forms v0.2.2 h1:tGnENs09LBUBppSrH0dGenV8KCQcbngsi+OatWID90Y= +github.com/go-pdfkit/forms v0.2.2/go.mod h1:dQ4FzO6qF7RJh6oEa0dkgL0i8hKBmm/e7hj4XC56h5Q= github.com/go-pdfkit/ops v0.7.0 h1:W8sK//0nfs/OACvjzvw/GK5ywtd90eDoYcdv74GxW8M= github.com/go-pdfkit/ops v0.7.0/go.mod h1:Is3FBR2NcCUEzNt4eowdsVa+P0SBtGtcxK8lDlOeyrk= github.com/go-pdfkit/pdffont v0.3.0 h1:G5DKcAmsZJ0e17QhSrcUaL7PKEXKjUx4P/iGMl7bAbI= diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..fd6bb9b --- /dev/null +++ b/renovate.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["github>go-pdfkit/.github"] +}