pdfcpu 0.16.3

What's new in 0.16.3

pdfcpu v0.16.3

This is a security update fixing configured decoded-byte limit bypasses and restricting local image access in create and form input.

Applications handling untrusted PDFs or create/form input should upgrade.

Decoded-byte limits — GHSA-jp42-qm45-2x6g:

Honor Limits.MaxDecodeBytes across stream decoding and combined page content, and stop cross-reference repair after
limit failures. Strengthen Flate predictor, DCT and cached-content checks, with regression coverage for strict/relaxed
validation and eager/deferred decoding.

The limit bounds individual decoded streams and combined page content, not total process memory.

Additive Go API change: Add StreamDict.DecodeWithLimit and StreamDict.DecodeLengthWithLimit to supply the
configured decode limit explicitly.

Local image access — GHSA-44h9-p34h-2w4p:

Confine local images referenced by create, form fill, and JSON/CSV form multifill input to an allowed directory.
Reject absolute paths, parent-directory components, symlink escapes and non-regular files, and report access denials
as errors.

Compatibility change:
API callers must set conf.LocalImageRoot to enable local images; an empty value disables
them. The CLI defaults to its working directory; set localImageRoot in config.yml to select another root.
Update image paths to be relative to that root. Confined local images are unavailable on js/wasm.
See local image access for migration guidance and limitations.

Documentation:
Updated security policy clarifies vulnerability scope, supported releases and guidance for AI-assisted reports and multiple findings.
Updated pull request template clarifies contribution requirements.
Added local image configuration and migration guidance to README and website.

Requires Go 1.26 or later, unchanged from v0.16.2.

Changelog

• * 35ea259eb27d5a607f797edd41fd8a9e50a1f818 bump version
• * 8befe54db401e8ed0ecb9d52aec700fa67b2972f confine local images in create and form input
• * c1db2d55c0826689a129012fbac5a25d5fd3a39f honor configured decode limits across stream consumers

Full release notes »