Skip to content

chore(deps): update module github.com/pdfcpu/pdfcpu to v0.13.0#317

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-pdfcpu-pdfcpu-0.x
Open

chore(deps): update module github.com/pdfcpu/pdfcpu to v0.13.0#317
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-pdfcpu-pdfcpu-0.x

Conversation

@renovate

@renovate renovate Bot commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/pdfcpu/pdfcpu v0.11.1 → v0.13.0 age confidence

Release Notes

pdfcpu/pdfcpu (github.com/pdfcpu/pdfcpu)

v0.13.0

Compare Source

A Release Featuring CLI Pipelines and Safer Defaults

Starting with this release, pdfcpu improves CLI usability with broader stdin/stdout pipeline support and stricter overwrite handling.

Check out the refreshed documentation at https://pdfcpu.io

Many commands now support - for stdin/stdout, making pdfcpu easier to use in shell pipelines. Explicit output files and non-empty output directories are no longer overwritten implicitly. Use the new global --force flag when overwriting is intentional.

Example:

pdfcpu optimize - out.pdf < in.pdf

or:

cat in.pdf | pdfcpu optimize - - > out.pdf

or a pipeline:

aws s3 cp s3://acme-contracts/master.pdf - \
      | pdfcpu optimize - - \
      | aws s3 cp - s3://acme-contracts/optimized/master.pdf

CLI Improvements

This release adds and refines several user-facing CLI features:

  • Broader stdin/stdout support using -
  • Global --force flag for explicit overwrite handling
  • annotations list --json
  • form list --json
  • certificates list --json
  • merge --bookmark-mode wrap|preserve
  • Improved version command behavior
  • Clarified help text around signature validation scope and trust boundaries

The new overwrite behavior is intentionally stricter. Existing scripts that relied on implicit overwrites may need to add --force.

Merge Bookmarks

The merge command now supports bookmark handling modes:

pdfcpu merge --bookmark-mode wrap out.pdf in1.pdf in2.pdf

Supported modes:

  • wrap
  • preserve

The default is wrap.

This release also improves bookmark tree preservation and handling of bookmark destination collisions.

JSON Output

JSON output is now available for selected listing commands:

pdfcpu annotations list --json in.pdf
pdfcpu form list --json in.pdf
pdfcpu certificates list --json

form list --json also supports multi-file form export JSON.

Certificate Trust Store Packaging

Standard builds now start with an empty trusted certificate directory.

Embedded EUTL certificate bundles are only included when building with:

-tags pdfcpu_eutl

certificates reset now resets the certificate directory to the build defaults.

This keeps standard builds smaller and avoids implying a bundled trust store unless it was explicitly selected at build time.

Experimental Windows 7 Build

An experimental Windows 7 x64 build is available in the release assets:

pdfcpu_0.13.0_Windows_x86_64_win7_experimental.zip

This build uses a patched Go toolchain and is not part of the regular supported release matrix. Feedback from Windows 7 SP1 x64 users is welcome (at #​870), especially the output of:

cmd
ver
pdfcpu.exe version
pdfcpu.exe validate test.pdf

Robustness & Safer Processing

This release adds configurable parser and resource limits for:

  • stream bytes
  • decoded bytes
  • image pixels and bytes
  • object counts
  • xref entries
  • recursion depth

The corresponding limits are also part of the configuration. Users of older version will be prompted by the CLI to reset their configuration.

Additional cycle and depth checks were added for page trees, form fields, name trees, and object graph traversal.

Stream parsing and filter decoding have also been hardened against oversized, malformed, and overflowing inputs.

Very large or malformed PDFs that were previously attempted may now be rejected earlier.

Fixes and Improvements

This release includes targeted fixes and compatibility improvements for:

  • annotation geometry during resize, including Rect and QuadPoints
  • merge bookmark handling
  • form filling with user fonts
  • removing document properties and associated catalog XMP metadata
  • relaxed validation for selected malformed JavaScript action and structure-tree object-reference cases
  • booklet page count and content-buffer handling
  • FlateDecode predictor and EOF handling
  • output path handling in extraction, fonts, forms, split/cut, and attachment-related workflows
  • watermarks, stamps, validation, fonts, properties, and related command behavior

Dependencies were updated, including go-runewidth, x/crypto, x/image, and x/text.

Signature Validation Notes

Now usage, help text and docs describe the current signature validation scope and trust boundaries more clearly.

This release does not claim complete legal, eIDAS, LTV, or long-term trust validation.

Development

Behind the scenes, this release includes command plumbing refactoring in pkg/cli, updated tests around command dispatch, and an experimental Windows 7 build workflow.

Thanks

Everybody for testing, reporting issues, and feeding back real-world PDFs.
Your bug reports and edge cases continue to make pdfcpu more robust and useful.
Shoutouts to @​harish for spending time on submitting a PR.

Changelog

v0.12.1

Compare Source

Bugfix Release

This is a fix for what was a miss on the decrypt command during the CLI Cobra migration.

🙏🏻 Thanks 🙏🏻

everybody for the bug reports.
Shoutouts 👏🏻 go to @​znbang for spending time on submitting a PR.

Changelog

v0.12.0

Compare Source

A Release Featuring Command Completion

Starting with this release, pdfcpu now offers shell command completion for CLI users.

Supported shells:

  • bash
  • zsh
  • fish
  • PowerShell

Big thanks to @​doronbehar for providing the Cobra integration 🙌

CLI Improvements

This release also refines how command flags work:

  • Clear distinction between short and long flags

    • Example: -f vs --full

  • Short flags can now be chained:

    pdfcpu signatures validate signed.pdf -af

    is equivalent to:

    pdfcpu signatures validate signed.pdf --all --full
Tradeoff

As a result of this cleanup:

  • Arbitrary abbreviation of commands and flags is no longer supported

However, the CLI is now more predictable and easier to use overall.

👉 Learn more:

pdfcpu completion --help

👉 For command help going forward:

pdfcpu <command> --help

🛠️ Stability & Ongoing Work

This release also represents a significant amount of work behind the scenes focused on overall stability and parser robustness. Many edge cases have been addressed to make pdfcpu more reliable when dealing with real-world PDF files.

Work on digital signature creation and validation is actively ongoing. These features will be released once the maintainers are confident they meet the expected standards for quality, correctness, and practical usefulness.

✂️ Removing Signatures (--rmsig)

This flag removes all signatures as part of processing.

Supported commands:

  • merge
  • optimize

There is also a dedicated command:

pdfcpu signatures remove inFile [outFile]

Flags:

  • --rmenc → also remove encryption
  • -h, --help → show help

🔓 Removing Encryption (--rmenc)

The --rmenc flag removes any existing encryption when writing a file.

Supported commands:

  • optimize
  • signatures remove

🔐 Encryption

pdfcpu now supports AES-256 GCM encryption (ISO/TS 32003).

  • The encrypt command defaults to AES-256 GCM
  • Supported consistently across relevant operations

🙏🏻 Thanks 🙏🏻

everybody for testing and feeding back your real world PDFs and bug reports.
Shoutouts 👏🏻 go to @​mdmcconnell, @​13rac1, @​doronbehar and @​joeyave for spending their time on submitting PR's.

Changelog

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 02:00 AM and 02:59 AM, between day 1 and 3 of the month, Monday through Friday (* 2 1-3 * 1-5)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 11 additional dependencies were updated

Details:

Package Change
golang.org/x/crypto v0.48.0 -> v0.52.0
golang.org/x/term v0.40.0 -> v0.43.0
golang.org/x/text v0.34.0 -> v0.37.0
github.com/clipperhouse/uax29/v2 v2.2.0 -> v2.7.0
github.com/hhrutter/pkcs7 v0.2.0 -> v0.2.2
github.com/hhrutter/tiff v1.0.2 -> v1.0.3
github.com/mattn/go-runewidth v0.0.19 -> v0.0.24
golang.org/x/image v0.32.0 -> v0.41.0
golang.org/x/net v0.51.0 -> v0.54.0
golang.org/x/sync v0.19.0 -> v0.20.0
golang.org/x/sys v0.41.0 -> v0.45.0

@renovate renovate Bot force-pushed the renovate/github.com-pdfcpu-pdfcpu-0.x branch from dfd4714 to 30354a4 Compare June 9, 2026 16:57
@renovate renovate Bot changed the title chore(deps): update module github.com/pdfcpu/pdfcpu to v0.12.1 chore(deps): update module github.com/pdfcpu/pdfcpu to v0.13.0 Jun 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies go minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants