From 2bec655f4ab108caa7f55a0a59f7c7ad5fe32cdb Mon Sep 17 00:00:00 2001 From: tannevaled Date: Thu, 27 Aug 2026 20:45:19 +0200 Subject: [PATCH] deps: catch up with the siblings, and set Renovate to watch them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two halves of the same problem: this module was behind its own siblings, and nothing was watching. WHAT IT WAS BEHIND ON reader v0.6.0 carries fixes this module was doing without, including two denial of service defects it was handing to its own callers: a 219-byte file with no trailer, whose last object is numbered 2 147 483 647, took 21.2 s to open and allocated not one byte — so no memory limit caught it; /Crypt, which 209 files (12.8% of the 1 633 real government forms) carry and which used to make every one of them decode to nothing readable; a second map-order non-determinism, in indexObjectStreams, giving five different answers in five runs of the same binary on the same file; a damaged stream's decoded prefix kept and labelled as salvage, rather than returned with a nil error as though it were the whole of it. WHY IT HAPPENED, AND WHAT STOPS IT HAPPENING AGAIN Nothing in this organisation was watching for a sibling's release. The org already has a Renovate preset at go-pdfkit/.github, with rules for Go modules and for actions — and not one of the ten Go modules extends it, so the preset has never been read. This adds the one-line renovate.json that does, matching what every go-ruby-* repository already has. That is the durable half. Renovate still has to be installed on the organisation for it to run, which this cannot do from here. Co-Authored-By: Claude Opus 5 --- go.mod | 2 +- go.sum | 4 ++-- renovate.json | 4 ++++ 3 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 renovate.json diff --git a/go.mod b/go.mod index acb012d..5d16f26 100644 --- a/go.mod +++ b/go.mod @@ -2,4 +2,4 @@ module github.com/go-pdfkit/pdffont go 1.26.4 -require github.com/go-pdfkit/reader v0.4.1 +require github.com/go-pdfkit/reader v0.6.0 diff --git a/go.sum b/go.sum index e65851b..1b4ef55 100644 --- a/go.sum +++ b/go.sum @@ -1,2 +1,2 @@ -github.com/go-pdfkit/reader v0.4.1 h1:pRxFqRjsn7H/VsGfWb9nYWyFuDgTU2Pjmoq/f5mgVq4= -github.com/go-pdfkit/reader v0.4.1/go.mod h1:fQFOVfCMUui1AdvD4qhimdyvvNr9KvvJ1S7IuKZjyV8= +github.com/go-pdfkit/reader v0.6.0 h1:KAabNOYUcTlZlNBTbG9bEhWP1NiZhjuhzUdavdTdfes= +github.com/go-pdfkit/reader v0.6.0/go.mod h1:fQFOVfCMUui1AdvD4qhimdyvvNr9KvvJ1S7IuKZjyV8= diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..fd6bb9b --- /dev/null +++ b/renovate.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["github>go-pdfkit/.github"] +}