pdfcpu: semua versi dan versi lama

# pdfcpu v0.16.4

This is a security update for crafted PDFs and form or create data that could cause excessive CPU or memory use or terminate a
process.

Additive Go API Changes：`types.DecodeStreamFunc` and `types.NewLazyObjectStreamObjectWithDecoder`.
Existing constructors and signatures remain unchanged.
Requires Go 1.26 or later.

**Release binaries were built with [Go 1.27.3](https://go.dev/doc/devel/release#go1.27.3), which includes security fixes for `crypto/x509`.**

**1) Unbounded object traversal — [GHSA-2623-w998-vcr4](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-2623-w998-vcr4):**

Long chains of PDF objects could exhaust the Go stack and terminate the process during optimization while reading,
annotation removal, or page migration. These paths now use iterative traversal. The fix preserves long valid chains,
handles objects whose value is another reference, and bounds error-path output.

Fix：[0bb00190](https://github.com/pdfcpu/pdfcpu/commit/0bb001901ef160aa75e882d839ee2997d56fdcb2).

**2) Repeated stream data — [GHSA-pr6x-vqwr-4hj2](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-pr6x-vqwr-4hj2):**

Shared or nested stream aliases and oversized declared lengths could make a small PDF retain unbounded encoded or
decoded data. Encoded streams now count toward the existing per-read budget, lengths past the end of the input no
longer size buffers, and compressed xref entries that share one current object-stream index are rejected.

Filtered decodes through `XRefTable.DecodeStream` and lazy object streams each receive a separate cumulative allowance
`A = max(1 GiB, 2 × MaxDecodeBytes)`; both default to 1 GiB. The allowances count cumulative decoding, not live memory.
Object streams remain lazy, image extraction remains subject to its per-stream and image limits, and a negative
`MaxDecodeBytes` disables these limits.

Fix：[82c88cec](https://github.com/pdfcpu/pdfcpu/commit/82c88cecdee7dac398bebf06d0bdd28728235a57).

**3) Poster tile grids — [GHSA-g5q6-53hx-f68j](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-g5q6-53hx-f68j):**

A crafted page size could make `poster` create an unbounded number of tile definitions and output pages, consuming
excessive CPU and memory. Poster output is now limited to 1,000 tiles per source page, and oversized grids are rejected
before page content is transformed or tile objects are allocated. Zero, negative and non-finite page or tile dimensions
are rejected.

Tiles produced by `poster`, `cut` and `ndown` now share one resource dictionary per source page instead of carrying a
copy each. With a margin, each tile references the shared page content through a content array instead of embedding a
copy of it. Rendered output is unchanged.

Fix：[a9725db6](https://github.com/pdfcpu/pdfcpu/commit/a9725db622f32c519fee90c1733b779ccd5dd598).

**4) Create table dimensions — [GHSA-cphg-88q6-whwh](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-cphg-88q6-whwh):**

Table `rows` and `cols` in a `create` template were unbounded, so a few hundred bytes of JSON could make create
allocate and render without limit. All tables of a template now share a limit of 100,000 rows plus columns. A table
whose `anchor` is invalid, or given together with `pos`, is now rejected; previously its remaining validation was
skipped.

Fix：[5367e878](https://github.com/pdfcpu/pdfcpu/commit/5367e878f7766b94dd5f7e9e3128e1ab5f9b30b6).

**5) Unbounded page numbers — [GHSA-gx4m-7r76-vpww](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-gx4m-7r76-vpww):**

A large page number in a `create` template or form-fill data could make pdfcpu allocate excessive memory or stall.
`create` now limits additions to 1,000 pages beyond the existing document; `form fill` and `form multifill` accept image
page numbers only within the document. Both paths reject page numbers below 1.

Fix：[ebac361a](https://github.com/pdfcpu/pdfcpu/commit/ebac361ac40798d81a97299c8231e7248e0094ab).

**6) Bookmark split 

# pdfcpu v0.16.3

This is a security update fixing configured decoded-byte limit bypasses and restricting local image access in create and form input.

**Applications handling untrusted PDFs or create/form input should upgrade.**

**Decoded-byte limits — [GHSA-jp42-qm45-2x6g](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-jp42-qm45-2x6g):**

Honor `Limits.MaxDecodeBytes` across stream decoding and combined page content, and stop cross-reference repair after
limit failures. Strengthen Flate predictor, DCT and cached-content checks, with regression coverage for strict/relaxed
validation and eager/deferred decoding.

The limit bounds individual decoded streams and combined page content, not total process memory.

**Additive Go API change:** Add `StreamDict.DecodeWithLimit` and `StreamDict.DecodeLengthWithLimit` to supply the
configured decode limit explicitly.

**Local image access — [GHSA-44h9-p34h-2w4p](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-44h9-p34h-2w4p):**

Confine local images referenced by `create`, `form fill`, and JSON/CSV `form multifill` input to an allowed directory.
Reject absolute paths, parent-directory components, symlink escapes and non-regular files, and report access denials
as errors.

**Compatibility change:**
API callers must set `conf.LocalImageRoot` to enable local images; an empty value disables
them. The CLI defaults to its working directory; set `localImageRoot` in `config.yml` to select another root.
Update image paths to be relative to that root. Confined local images are unavailable on `js/wasm`.
See [local image access](https://pdfcpu.io/create/create/#local-image-access) for migration guidance and limitations.

**Documentation:**
Updated [security policy](https://github.com/pdfcpu/pdfcpu/blob/v0.16.3/SECURITY.md) clarifies vulnerability scope, supported releases and guidance for AI-assisted reports and multiple findings.
Updated [pull request template](https://github.com/pdfcpu/pdfcpu/blob/v0.16.3/.github/pull_request_template.md) clarifies contribution requirements.
Added local image configuration and migration guidance to README and website.

Requires Go 1.26 or later, unchanged from v0.16.2.

## Changelog
• * 35ea259eb27d5a607f797edd41fd8a9e50a1f818 bump version
• * 8befe54db401e8ed0ecb9d52aec700fa67b2972f confine local images in create and form input
• * c1db2d55c0826689a129012fbac5a25d5fd3a39f honor configured decode limits across stream consumers

# pdfcpu v0.16.2

Hello!

We ship important security, stability, and PDF compatibility fixes with **no breaking Go API changes**.

Binaries were built with Go 1.27.2, which includes security fixes.
The minimum Go version required to build remains 1.26.
Upgrading is highly recommended!

## Security

• Harden parsing and decoding against excessive work, circular references, malformed fonts, and invalid image parameters.
Enforce resource limits and prevent several malformed-input panics.
• Reduce repeated validation of shared objects and memory allocations when parsing large certificate revocation lists.
• Correct AES-256 password preparation and owner authentication, encryption revision checks, and extraction permissions.
• Fix named and Identity crypt-filter handling, crypt-filter length units and validation, and encryption of strings
rewritten from object streams.

## Fixes and improvements

• Preserve catalog data, inherited page boxes and resources, shared stamp resources, name-tree values, and named
destinations during processing. Correct compressed-object reference renumbering during merging.
• Fix PDF whitespace, text and hexadecimal-string decoding, inline-image parsing, cross-reference handling, and
effective PDF version detection.
• Improve form field inheritance, checkbox/radio handling, export ordering, JSON matching, list-box clearing, and
Unicode text-length checks.
• Correct CMYK rendering, RGBA image import, Flate/TIFF predictor handling, and Crypt filter pipelines.
• Fix ToUnicode mappings, TrueType widths and style detection, and XMP date parsing.
• Complete required standard-font metrics for PDF 2.0 output and enforce required annotation appearances.
• Strengthen validation of images, graphics values, colour spaces, functions, destinations, PageLabels, and PDF 2.0
entries. Restore targeted multimedia compatibility and improve action reporting.

## Compatibility

Existing Go API signatures remain unchanged; supporting packages receive additive exports. Strict validation now
rejects additional malformed inputs, while applicable relaxed compatibility is retained with notices. PDF 2.0 writes
report an error when required annotation appearances are missing; automatic appearance generation remains incomplete.
Encryption defaults are unchanged.

## Thanks

Thanks everyone who opened issues.
Shoutout to @qoke and the IQ Hive team for providing a heavy load of critical fixes for this release.

## v0.16.1

Security and stability update with no public API changes.
Requires Go 1.26 or later.

This release fixes a denial-of-service vulnerability in grayscale and Indexed image rendering, including CalRGB palette
handling. Processing a crafted PDF could cause an index-out-of-range panic and terminate the calling process if the
panic was not recovered.

Versions v0.16.0 and earlier are affected.
Applications extracting or rendering images from untrusted PDFs should upgrade to v0.16.1.
See [GHSA-6524-w46v-6399](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-6524-w46v-6399).

Improvements:
• Harden PDF parsing, image processing, JSON input handling, and signature-data parsing.
• Prevent panics when rendering grayscale and Indexed images, including palette bounds and Decode mapping checks.
• Strengthen external-link checks and reporting of problematic links; redact URL passwords in reports and CLI output.
• Improve structural validation of embedded files, 3D annotations, and multimedia dictionaries.
• Report JavaScript and supported media presence during validation without executing content or displaying script code.
• Report invalid zero-offset xref entries as skipped in relaxed validation and reject them in strict mode (#612).
• Fix strict validation of PDF dates ending in `Z` (#1493).
• Update the TIFF dependency to v1.0.7.

## v0.16.0

This release updates the Go API and configuration model, improves automation and PDF validation, and includes processing fixes and security hardening.

## Changes since v0.16.0-rc.1

• Protect image buffer allocations against integer overflow and enforce resource limits before decoding each TIFF page.
• Fix default-configuration handling (#1492)：synchronize access to the cached default configuration and return independent clones to callers.

## Security advisories

This release includes fixes covered by six security advisories.

• [Integer overflow in image buffer allocation](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-g766-88fx-58h8)
• [Traditional cross-reference tables bypass configured XRef limits](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-fjh6-rrhv-4g63)
• [Packed RGB image samples can cause an index-out-of-range panic during image extraction](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-9mmx-88p2-c8c6)
• [Missing BitsPerComponent can cause a nil-pointer panic during image extraction](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-prvw-v9vv-6966)
• [Integer overflow in XRef stream /W array can cause denial of service](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-w2hj-54mc-76r4)
• [Off-by-one revision mapping weakens PDF signature modification reporting](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-7v74-phpq-xq6g)

## Highlights

• **Updated Go API** — Explicit contexts for long-running operations, optional progress reporting, and reusable caller-owned configuration.
• **Configuration redesign** — Schema-aware loading, explicit initialization and reset, plus read-only and stateless operation.
• **Automation and container preparation** — Signal cancellation, safer output replacement, password-file inputs, and verified execution under arbitrary user IDs.
• **Stronger PDF validation** — Improved malformed-input handling, graph-traversal safeguards, and compatibility warnings for selected relaxed-validation decisions.
• **Clearer signature validation** — Separate reporting of document integrity, certificate trust, revocation, and timestamp evidence.
• **PDF processing fixes** — Improved resize orientation, rotated watermarks, form appearances, image handling, and LZW decoding.
• **Smaller Go module** — Approximately 94% smaller in the original packaging comparison. Samples and test fixtures remain in Git but are excluded from module downloads.

## Requirements and installation

Go applications require **Go 1.26 or later** and updates to affected API calls. Existing file-backed configurations from **v0.15 or earlier** require an explicit configuration reset.

```sh
go get github.com/pdfcpu/pdfcpu@v0.16.0
```

## Before upgrading

### Reset legacy file-backed configuration

Existing v0.15 and older `config.yml` files do not contain the new configuration schema identifier. pdfcpu preserves the
file and reports that a reset is required instead of rewriting it automatically.

If the configuration is not customized, run:

```sh
pdfcpu config reset
pdfcpu config validate
```

For an explicit configuration root, use the same root for every command:

```sh
pdfcpu --conf /srv/pdfcpu config reset
pdfcpu --conf /srv/pdfcpu config validate
pdfcpu --conf /srv/pdfcpu config inspect
```

Before resetting, back up any customized `config.yml`. After resetting, reapply your settings.
Installed user fonts and trusted certificates are preserved.<br>
New installations and stateless operation with `--conf disable` need no migration.

See the [v0.16 configuration upgrade guide](https://pdfcpu.io/getting_started/configuration_v016/).

### Update Go API callers

| Change | Required action |
|:--|:--|
| Long-running operations require a `context.Context` | Pass the request or job context, or `context.Background()` when cancellation is not needed. Nil contexts are rejected. |
| Validation and optimization operations take a final `*api.ProgressOptions` | Pass `nil`

# pdfcpu v0.15.0

This release is a focused follow-up to v0.14.0 improving diagnostics and observability for validating large PDF corpora.
It also includes PDF processing hardening, CJK text wrapping for watermarks, and clearer signature-validation
behavior.

v0.15.0 follows v0.14.0 by only one week because post-release corpus testing made an existing operational gap clear:
large wildcard-driven validation runs delayed failure diagnostics until the full input set completed and provided no
quiet-mode indication of the file currently being processed.

The changes are targeted and immediately useful to corpus testers, so holding them for a later feature release would unnecessarily delay feedback. The short interval is intentional and does not establish a weekly release routine.

## Corpus validation diagnostics

Multi-file CLI validation now reports each failed input as soon as the failure is detected, continues with the remaining
inputs, and exits nonzero with a compact summary:

```text
validation failed: 66 of 463 files invalid
```

The new `--progress` flag identifies the active input during quiet validation runs. This is useful when a long-running
corpus job stalls on a particular file:

```sh
pdfcpu validate -q --progress "**/*.pdf"
```

The quotes are intentional. They pass the recursive pattern to pdfcpu for internal expansion instead of asking the shell
to expand thousands of paths into one command line, which may exceed the operating system's argument-size limit.

With `-q --progress`, progress and validation failures are written to standard error while standard output remains
clean:

```text
validating(mode=relaxed) path/to/input.pdf ...
validate path/to/input.pdf: validation error: ...
```

## Corpus testing and issue reports

There is a new [Corpus Validation guide](https://pdfcpu.io/getting_started/corpus_validation/) documenting quick assessment,
progress monitoring, logging, validation modes, result interpretation, and focused issue reporting.

A failed corpus run is diagnostic input, not an issue backlog.
Public reports must isolate one manually verified and independently reproduced problem with the smallest shareable PDF.
Include the relevant error and final summary, and attach large logs as compressed files instead of pasting them into an issue.

AI-generated, bulk-generated, or mechanically reformatted corpus reports will be closed immediately without investigation.
Corpus-wide analysis, failure classification, confidential-file investigation, and scheduled remediation are separate engineering work and may require a paid engagement.

Limited corpus investigation and remediation work may be available by arrangement.

## PDF validation and processing hardening

Malformed and inconsistent PDF structures now produce more contextual errors across reading, dereferencing, validation,
optimization, fonts, forms, and XObjects. Integer conversion and encryption handling have been tightened, and additional
guards reduce the risk of panics while processing damaged input.

This work is backed by expanded malformed-input, error-path, and optimization regression coverage.

## CJK watermark text wrapping

Text watermarks now support automatic wrapping for CJK text, including long runs without spaces. Oversized text is
wrapped to the configured width instead of forcing unintended font-size reduction. This resolves issue #1427 and
includes expanded CJK wrapping and layout coverage.

## Digital signatures

Signature validation output is clearer for legacy and unsupported cases. Evidence handling, PKCS#1 and PKCS#7
processing, and related error classification have also been tightened.

## Compatibility notes

The `pkg/api` multi-file validation contract is unchanged: API callers continue to receive joined errors after
processing. The CLI now streams individual multi-file validation failures and returns a final summary, so scripts that
compare complete stderr strings should be updated to rely on exit status and stable error classi