From ed1c4dc9d7c56b0325af12a2c609be306e24e5a3 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Thu, 27 Aug 2026 20:45:37 +0200 Subject: [PATCH] deps: catch up with the siblings, and set Renovate to watch them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two halves of the same problem: this module was behind its own siblings, and nothing was watching. WHAT IT WAS BEHIND ON reader v0.6.0 carries fixes this module was doing without, including two denial of service defects it was handing to its own callers: a 219-byte file with no trailer, whose last object is numbered 2 147 483 647, took 21.2 s to open and allocated not one byte — so no memory limit caught it; /Crypt, which 209 files (12.8% of the 1 633 real government forms) carry and which used to make every one of them decode to nothing readable; a second map-order non-determinism, in indexObjectStreams, giving five different answers in five runs of the same binary on the same file; a damaged stream's decoded prefix kept and labelled as salvage, rather than returned with a nil error as though it were the whole of it. WHY IT HAPPENED, AND WHAT STOPS IT HAPPENING AGAIN Nothing in this organisation was watching for a sibling's release. The org already has a Renovate preset at go-pdfkit/.github, with rules for Go modules and for actions — and not one of the ten Go modules extends it, so the preset has never been read. This adds the one-line renovate.json that does, matching what every go-ruby-* repository already has. That is the durable half. Renovate still has to be installed on the organisation for it to run, which this cannot do from here. Co-Authored-By: Claude Opus 5 --- go.mod | 8 ++++---- go.sum | 24 ++++++++---------------- renovate.json | 4 ++++ 3 files changed, 16 insertions(+), 20 deletions(-) create mode 100644 renovate.json diff --git a/go.mod b/go.mod index 23a4e51..8dc9220 100644 --- a/go.mod +++ b/go.mod @@ -3,13 +3,13 @@ module github.com/go-pdfkit/ops go 1.26.4 require ( - github.com/go-pdfkit/extract v0.1.0 - github.com/go-pdfkit/reader v0.4.1 + github.com/go-pdfkit/extract v0.2.0 + github.com/go-pdfkit/forms v0.2.2 + github.com/go-pdfkit/reader v0.6.0 ) require ( github.com/go-opentype/fonts v0.9.0 // indirect github.com/go-opentype/opentype v0.9.0 // indirect - github.com/go-pdfkit/forms v0.2.1 // indirect - github.com/go-pdfkit/pdffont v0.2.0 // indirect + github.com/go-pdfkit/pdffont v0.3.0 // indirect ) diff --git a/go.sum b/go.sum index 544b44a..d3a169a 100644 --- a/go.sum +++ b/go.sum @@ -1,20 +1,12 @@ -github.com/go-opentype/fonts v0.8.0 h1:77i3VPIH90GbstzNb21mk+an4WvEOe2idC6W+J0n0fw= -github.com/go-opentype/fonts v0.8.0/go.mod h1:C6yQL2apHItfEZ5hztpsHF0S5mlX/hklLlq/Z5fRG/g= github.com/go-opentype/fonts v0.9.0 h1:slB6OB3riLyUPrOxqXe0s6/AzdenF1TDvCN8N87hhQk= github.com/go-opentype/fonts v0.9.0/go.mod h1:C6yQL2apHItfEZ5hztpsHF0S5mlX/hklLlq/Z5fRG/g= github.com/go-opentype/opentype v0.9.0 h1:GFgcJ3nwTDp4NJr5O+Paw7lhZx5Jv/R+noZwvhYDlkM= github.com/go-opentype/opentype v0.9.0/go.mod h1:AOixevJf7XQaH7+WG+OMIOZEbYPXfMqklVk26Y6YTUU= -github.com/go-pdfkit/extract v0.1.0 h1:7IJDJMH43l2wJZD+DkW5StmeAS1NDt2FnT2LBceXTog= -github.com/go-pdfkit/extract v0.1.0/go.mod h1:3ejdi87IrdR60wmjzLswdqzBzHCgFlrLtxkMxRN1KSU= -github.com/go-pdfkit/forms v0.2.0 h1:qcphzViGdL3vDb66rnyQkwzPw+una5rsF4H84KB2XMI= -github.com/go-pdfkit/forms v0.2.0/go.mod h1:LORxkdP4FVULFk0/PA0CdPZc1dZF9zTSaHrtfM7IYaw= -github.com/go-pdfkit/forms v0.2.1 h1:INa2GwAadxEhcXvBe7zJYgapYwaGn9WIaLxUJU/lm6A= -github.com/go-pdfkit/forms v0.2.1/go.mod h1:LORxkdP4FVULFk0/PA0CdPZc1dZF9zTSaHrtfM7IYaw= -github.com/go-pdfkit/pdffont v0.1.0 h1:mThWvPn3LLETup2adm9xMcNZWECP2Wq3eTSyTW4O3I0= -github.com/go-pdfkit/pdffont v0.1.0/go.mod h1:y4vo5DgT95e57C3XxIWfA/xss+x6RwZwyj6KWdJc86s= -github.com/go-pdfkit/pdffont v0.2.0 h1:yAp/oR5Z2kkqs4r0GWMalZMC7rc7XSCZXgwIypbpMWM= -github.com/go-pdfkit/pdffont v0.2.0/go.mod h1:y4vo5DgT95e57C3XxIWfA/xss+x6RwZwyj6KWdJc86s= -github.com/go-pdfkit/reader v0.4.0 h1:qPbNZSO+Xl+4NBvQoV1PYt7HlqHaEAQ1tUc6/IL8JAU= -github.com/go-pdfkit/reader v0.4.0/go.mod h1:fQFOVfCMUui1AdvD4qhimdyvvNr9KvvJ1S7IuKZjyV8= -github.com/go-pdfkit/reader v0.4.1 h1:pRxFqRjsn7H/VsGfWb9nYWyFuDgTU2Pjmoq/f5mgVq4= -github.com/go-pdfkit/reader v0.4.1/go.mod h1:fQFOVfCMUui1AdvD4qhimdyvvNr9KvvJ1S7IuKZjyV8= +github.com/go-pdfkit/extract v0.2.0 h1:ibx2C2mJTJjGzP9bRnrRnmvdeZjv9aTas6tSkeEiTeM= +github.com/go-pdfkit/extract v0.2.0/go.mod h1:7KJGmgvxjk9qqbDdjpaAcEzd4G3vq3ciHuuufVdLiu4= +github.com/go-pdfkit/forms v0.2.2 h1:tGnENs09LBUBppSrH0dGenV8KCQcbngsi+OatWID90Y= +github.com/go-pdfkit/forms v0.2.2/go.mod h1:dQ4FzO6qF7RJh6oEa0dkgL0i8hKBmm/e7hj4XC56h5Q= +github.com/go-pdfkit/pdffont v0.3.0 h1:G5DKcAmsZJ0e17QhSrcUaL7PKEXKjUx4P/iGMl7bAbI= +github.com/go-pdfkit/pdffont v0.3.0/go.mod h1:bfmNLna1l1CljNX/Utg55YzFylovfmI7sJnvgA3bzKI= +github.com/go-pdfkit/reader v0.6.0 h1:KAabNOYUcTlZlNBTbG9bEhWP1NiZhjuhzUdavdTdfes= +github.com/go-pdfkit/reader v0.6.0/go.mod h1:fQFOVfCMUui1AdvD4qhimdyvvNr9KvvJ1S7IuKZjyV8= diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..fd6bb9b --- /dev/null +++ b/renovate.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["github>go-pdfkit/.github"] +}