From aff58db1ddfaf497759143a4e4bf57cddc6b161e Mon Sep 17 00:00:00 2001 From: tannevaled Date: Thu, 27 Aug 2026 20:45:46 +0200 Subject: [PATCH] deps: catch up with the siblings, and set Renovate to watch them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two halves of the same problem: this module was behind its own siblings, and nothing was watching. WHAT IT WAS BEHIND ON reader v0.6.0 carries fixes this module was doing without, including two denial of service defects it was handing to its own callers: a 219-byte file with no trailer, whose last object is numbered 2 147 483 647, took 21.2 s to open and allocated not one byte — so no memory limit caught it; /Crypt, which 209 files (12.8% of the 1 633 real government forms) carry and which used to make every one of them decode to nothing readable; a second map-order non-determinism, in indexObjectStreams, giving five different answers in five runs of the same binary on the same file; a damaged stream's decoded prefix kept and labelled as salvage, rather than returned with a nil error as though it were the whole of it. WHY IT HAPPENED, AND WHAT STOPS IT HAPPENING AGAIN Nothing in this organisation was watching for a sibling's release. The org already has a Renovate preset at go-pdfkit/.github, with rules for Go modules and for actions — and not one of the ten Go modules extends it, so the preset has never been read. This adds the one-line renovate.json that does, matching what every go-ruby-* repository already has. That is the durable half. Renovate still has to be installed on the organisation for it to run, which this cannot do from here. Co-Authored-By: Claude Opus 5 --- go.mod | 2 +- go.sum | 4 ++-- renovate.json | 4 ++++ 3 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 renovate.json diff --git a/go.mod b/go.mod index 90c9ba1..fbb8bed 100644 --- a/go.mod +++ b/go.mod @@ -12,6 +12,6 @@ require ( require ( github.com/go-opentype/fonts v0.9.0 // indirect github.com/go-opentype/opentype v0.9.0 // indirect - github.com/go-pdfkit/forms v0.2.1 // indirect + github.com/go-pdfkit/forms v0.2.2 // indirect github.com/go-pdfkit/pdffont v0.3.0 // indirect ) diff --git a/go.sum b/go.sum index 08b8282..ad9baea 100644 --- a/go.sum +++ b/go.sum @@ -6,8 +6,8 @@ github.com/go-opentype/fonts v0.9.0 h1:slB6OB3riLyUPrOxqXe0s6/AzdenF1TDvCN8N87hh github.com/go-opentype/fonts v0.9.0/go.mod h1:C6yQL2apHItfEZ5hztpsHF0S5mlX/hklLlq/Z5fRG/g= github.com/go-opentype/opentype v0.9.0 h1:GFgcJ3nwTDp4NJr5O+Paw7lhZx5Jv/R+noZwvhYDlkM= github.com/go-opentype/opentype v0.9.0/go.mod h1:AOixevJf7XQaH7+WG+OMIOZEbYPXfMqklVk26Y6YTUU= -github.com/go-pdfkit/forms v0.2.1 h1:INa2GwAadxEhcXvBe7zJYgapYwaGn9WIaLxUJU/lm6A= -github.com/go-pdfkit/forms v0.2.1/go.mod h1:LORxkdP4FVULFk0/PA0CdPZc1dZF9zTSaHrtfM7IYaw= +github.com/go-pdfkit/forms v0.2.2 h1:tGnENs09LBUBppSrH0dGenV8KCQcbngsi+OatWID90Y= +github.com/go-pdfkit/forms v0.2.2/go.mod h1:dQ4FzO6qF7RJh6oEa0dkgL0i8hKBmm/e7hj4XC56h5Q= github.com/go-pdfkit/ops v0.7.0 h1:W8sK//0nfs/OACvjzvw/GK5ywtd90eDoYcdv74GxW8M= github.com/go-pdfkit/ops v0.7.0/go.mod h1:Is3FBR2NcCUEzNt4eowdsVa+P0SBtGtcxK8lDlOeyrk= github.com/go-pdfkit/pdffont v0.3.0 h1:G5DKcAmsZJ0e17QhSrcUaL7PKEXKjUx4P/iGMl7bAbI= diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..fd6bb9b --- /dev/null +++ b/renovate.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["github>go-pdfkit/.github"] +}