[dependabot]

Bumps lopdf from 0.44.0 to 0.46.0.

Release notes

Sourced from lopdf's releases.

v0.46.0

What's Changed

• fix: derive the file encryption key from the recovered user password, not the literal owner password by @​chintans in J-F-Liu/lopdf#573
• perf: build the missing-key error of Dictionary::get lazily by @​melnik0v in J-F-Liu/lopdf#577
• fix: detect reference cycles through object stream containers by @​melnik0v in J-F-Liu/lopdf#576
• feat: add Document::get_page_annotations_mut by @​ChrisJr404 in J-F-Liu/lopdf#571
• perf: decode each object stream once per load by @​melnik0v in J-F-Liu/lopdf#578
• fix: export DateTime from crate root by @​isaim0011 in J-F-Liu/lopdf#579
• fix: preserve text after unmapped tounicode codes by @​szdytom in J-F-Liu/lopdf#580
• fix: keep an unloadable page-tree kid as a blank page slot by @​abimaelmartell in J-F-Liu/lopdf#583
• fix: read one white-space character after ID in inline images by @​ghempton in J-F-Liu/lopdf#582
• fix: derive the file key from the sanitized password on load by @​LuisFigueroaG in J-F-Liu/lopdf#586
• fix: tolerate padding after %%EOF when locating startxref by @​LuisFigueroaG in J-F-Liu/lopdf#587
• fix: don't panic on huge predictor DecodeParms by @​LuisFigueroaG in J-F-Liu/lopdf#589
• fix: handle missing and indirect /Annots in remove_annot by @​LuisFigueroaG in J-F-Liu/lopdf#590
• fix: treat /Type and /Differences as optional in encoding dictionaries by @​LuisFigueroaG in J-F-Liu/lopdf#591
• fix: parse UTC and shortened dates with the time backend by @​LuisFigueroaG in J-F-Liu/lopdf#592
• feat: decode content operations one at a time with Content::decode_iter by @​josh-prefix in J-F-Liu/lopdf#588
• fix: don't overflow when incrementing a multi-unit bfrange target by @​LuisFigueroaG in J-F-Liu/lopdf#593
• fix: don't overflow computing inline image data length by @​LuisFigueroaG in J-F-Liu/lopdf#594
• fix: apply array DecodeParms per filter by @​sean0407 in J-F-Liu/lopdf#596
• fix: read /XRefStm in every section of hybrid-reference files by @​LuisFigueroaG in J-F-Liu/lopdf#598
• fix: accept the /G abbreviation and Indexed colour spaces in inline images by @​LuisFigueroaG in J-F-Liu/lopdf#597
• fix: treat NUL and form feed as white-space in content streams by @​jaenam615 in J-F-Liu/lopdf#599
• fix: allow delimiters without white-space in ToUnicode CMaps by @​jaenam615 in J-F-Liu/lopdf#600
• fix: parse the Type 3 glyph operators d0 and d1 in content streams by @​LuisFigueroaG in J-F-Liu/lopdf#601
• fix: bound cross-reference stream object numbers to u32 by @​LuisFigueroaG in J-F-Liu/lopdf#602
• fix: consume the fields of unknown cross-reference stream entry types by @​LuisFigueroaG in J-F-Liu/lopdf#604
• fix: read unescaped end-of-line markers in literal strings as a line feed by @​LuisFigueroaG in J-F-Liu/lopdf#605
• fix: ignore a minus sign inside the fraction of a real number by @​LuisFigueroaG in J-F-Liu/lopdf#606
• fix: write decoded inline images back as BI/ID/EI when encoding content by @​LuisFigueroaG in J-F-Liu/lopdf#607
• fix: drop /Prev and /XRefStm from a reconstructed trailer by @​yhay81 in J-F-Liu/lopdf#609
• perf: keep the reconstruction scan linear when streams lack endstream by @​yhay81 in J-F-Liu/lopdf#610
• fix: correct an xref offset only when the section found locates its objects by @​yhay81 in J-F-Liu/lopdf#611
• feat: report cross-reference recovery in Document and PdfMetadata by @​yhay81 in J-F-Liu/lopdf#612
• fix: stop new object IDs from wrapping past u32::MAX by @​yhay81 in J-F-Liu/lopdf#614
• perf: speed up the object parser by @​yhay81 in J-F-Liu/lopdf#616
• fix: keep tabs and line breaks when decoding PDFDocEncoding text strings by @​LuisFigueroaG in J-F-Liu/lopdf#617
• feat: reconstruct files that only have cross-reference streams by @​yhay81 in J-F-Liu/lopdf#613
• perf: parse small documents on the calling thread instead of rayon's pool by @​yhay81 in J-F-Liu/lopdf#618
• fix: strip the UTF-8 byte order mark when decoding text strings by @​LuisFigueroaG in J-F-Liu/lopdf#619
• fix: decode outline titles as text strings in get_toc by @​LuisFigueroaG in J-F-Liu/lopdf#620
• fix: ignore an odd trailing byte in UTF-16BE text strings by @​LuisFigueroaG in J-F-Liu/lopdf#621
• fix: use inherited /Resources in get_page_images by @​LuisFigueroaG in J-F-Liu/lopdf#622

New Contributors

• @​chintans made their first contribution in J-F-Liu/lopdf#573
• @​melnik0v made their first contribution in J-F-Liu/lopdf#577
• @​ChrisJr404 made their first contribution in J-F-Liu/lopdf#571
• @​isaim0011 made their first contribution in J-F-Liu/lopdf#579

... (truncated)

Changelog

Sourced from lopdf's changelog.

v0.45.0 (2026-09-08)

• Accept 19-byte cross-reference entries when parsing leniently (#564)
• Accept an integral real /Length when resolving deferred streams (#560)
• Add option to set FirstChar, LastChar and the Widths array of a custom font (#557)
• Bound cross-reference subsection object numbers to u32
• Bound xref-stream entry count against the decoded stream length
• Bound object-graph recursion depth (fix #530)
• Decode sub-byte-depth PNG and TIFF predictors
• Decode ASCIIHexDecode and RunLengthDecode streams
• Default the file encryption key length from V when Length is absent
• Fix ASCII85 group-value overflow and decode TIFF Predictor 2
• Fix four crash bugs from crafted PDFs (fix #532)
• Recover from slightly miswritten startxref / Prev offsets
• Silence lints introduced by Rust 1.98
• Use skrifa instead of unmaintained ttf-parser
• Write a cross-reference stream when object streams are disabled

Commits

• bbc5e4b Release 0.46
• 846e2e9 fix: use inherited /Resources in get_page_images (#622)
• 2f497f8 fix: encrypt and decrypt strings in stream dictionaries, and leave signature ...
• abd061c fix: ignore an odd trailing byte in UTF-16BE text strings (#621)
• 8ccd5af fix: decode outline titles as text strings in get_toc (#620)
• a259349 fix: strip the UTF-8 byte order mark when decoding text strings (#619)
• 8d16cd1 perf: parse small documents on the calling thread instead of rayon's pool (#618)
• 7679383 feat: reconstruct files that only have cross-reference streams (#613)
• c608838 fix: keep tabs and line breaks when decoding PDFDocEncoding text strings (#617)
• 6d1a503 perf: speed up the object parser (#616)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 2 packages with OpenSSF Scorecard issues.

See the Details below.

License Issues

Cargo.lock

Package	Version	License	Issue Type
brotli-decompressor	5.0.3	LicenseRef-bad-bsd-3-clausemit	Incompatible License

Allowed Licenses:

MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, BlueOak-1.0.0, Unlicense, CC0-1.0, CC-BY-4.0, CDLA-Permissive-2.0, MIT-0, MPL-2.0, Python-2.0, Zlib, Unicode-3.0

Excluded from license check:

pkg:cargo/stella-aho-corasick-core, pkg:cargo/stella-fuzzy-search-core, pkg:cargo/stella-regex-set-core, pkg:cargo/libfuzzer-sys, pkg:cargo/matrixmultiply, pkg:cargo/rangemap, pkg:cargo/unicode-properties

OpenSSF Scorecard

Package	Version	Score	Details
cargo/alloc-no-stdlib	2.0.4	⚠️ 2.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 1 Found 3/28 approved changesets -- score normalized to 1 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ -1 No tokens found Dangerous-Workflow ⚠️ -1 no workflows found Pinned-Dependencies ⚠️ -1 no dependencies found Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/alloc-stdlib	0.2.4	⚠️ 2.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 1 Found 3/28 approved changesets -- score normalized to 1 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ -1 No tokens found Dangerous-Workflow ⚠️ -1 no workflows found Pinned-Dependencies ⚠️ -1 no dependencies found Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/brotli-decompressor	5.0.3	🟢 5.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow ⚠️ -1 no workflows found Token-Permissions ⚠️ -1 No tokens found Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 4 Found 13/30 approved changesets -- score normalized to 4 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ -1 no dependencies found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/lopdf	0.46.0	🟢 4.7	Details Check Score Reason Code-Review 🟢 9 Found 28/30 approved changesets -- score normalized to 9 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/lopdf	>= 0.46.0, < 0.47.0	Unknown	Unknown

Scanned Files

• Cargo.lock
• crates/anonymize-pdf-core/Cargo.toml

[dependabot]

Superseded by #633.