[dependabot]

Bumps smalot/pdfparser from 2.12.5 to 2.13.1.

Release notes

Sourced from smalot/pdfparser's releases.

Security hardening and refinements

Mitigation of Denial-of-Service vulnerabilities

This release introduces safeguards against potential denial-of-service attacks caused by specially crafted PDF files.

• Uncontrolled recursion: Added a configurable nesting depth limit to prevent excessive recursion when parsing deeply nested PDF objects.
• Unbounded decompression: Extended the existing decompression memory limit to additional filters (LZWDecode and RunLengthDecode).
• Additional improvements: Added cycle detection for PDF page trees, regression tests, and updated configuration documentation.

Limitations and backward compatibility

To preserve backward compatibility, the default decompression limit remains 0 (unlimited). Applications processing untrusted PDFs should explicitly configure Config::setDecodeMemoryLimit().

The nesting depth limit defaults to 5,000 levels but does not currently cover recursion caused by consecutive PDF comments. These safeguards therefore mitigate, but do not completely eliminate, the reported risks.

Acknowledgments

Special thanks to Eduardo Santos de Abreu (@​blackrose-0xday) for responsibly reporting both vulnerabilities and providing detailed proof-of-concept examples.

CVE identifiers will be added once available.

See #843 for further details.

Bugfixes and performance gains

Summary

@​kernie, @​bernemann, @​splitbrain and @​NiekNijland contributed bug fixes and performance optimizations for this release. Thank you. 🚀

What's Changed

• Fix Font::getDetails() TypeError when Encoding is indirect reference to PDFObject by @​kernie in smalot/pdfparser#823
• Replaces #828: Chunked getSectionsText() to lower peak memory by @​splitbrain in smalot/pdfparser#840
• Replaces #825 - Fix float-to-int cast warning in Font::uchr on PHP 8.1+ fix by @​splitbrain in smalot/pdfparser#841
• Replaces #827 - Build PDF objects incrementally to lower peak memory by @​splitbrain in smalot/pdfparser#842
• Avoid quadratic placeholder replacement in PDFObject::formatContent() by @​bernemann in smalot/pdfparser#831
• Avoid recursive matching for object stream indexes by @​NiekNijland in smalot/pdfparser#836
• Revise maintenance status and contribution guidelines by @​k00ni in smalot/pdfparser#821

New Contributors

• @​kernie made their first contribution in smalot/pdfparser#823
• @​bernemann made their first contribution in smalot/pdfparser#831
• @​NiekNijland made their first contribution in smalot/pdfparser#836

Full Changelog: smalot/pdfparser@v2.12.5...v2.13.0

Call for testers! - Bugfixes and performance gains (Beta 1)

Summary

@​kernie, @​bernemann, @​splitbrain and @​NiekNijland contributed bug fixes and performance optimizations for this release. Thank you. 🚀

... (truncated)

Commits

• a71c6dd Bound object nesting depth and stream decoding; detect page-tree cycles (#843)
• 4e964c7 Avoid recursive matching for object stream indexes (#836)
• 577c3da Avoid quadratic placeholder replacement in PDFObject::formatContent() (#831)
• 7b4ec8c Replaces #827 - Build PDF objects incrementally to lower peak memory (#842)
• b570944 Replaces #825 - Fix float-to-int cast warning in Font::uchr on PHP 8.1+ fix (...
• e992ac7 Replaces #828: Chunked getSectionsText() to lower peak memory (#840)
• 5211c9e Fix Font::getDetails() TypeError when Encoding is indirect reference to PDFOb...
• c6288bc Revise maintenance status and contribution guidelines (#821)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)