chore: bump lopdf from 0.44.0 to 0.46.0 by dependabot[bot] · Pull Request #633 · stella/anonymize

dependabot · 2026-10-31T06:06:21Z

Bumps lopdf from 0.44.0 to 0.46.0.

Release notes

v0.46.0

What's Changed

fix: derive the file encryption key from the recovered user password, not the literal owner password by @chintans in J-F-Liu/lopdf#573

perf: build the missing-key error of Dictionary::get lazily by @melnik0v in J-F-Liu/lopdf#577

fix: detect reference cycles through object stream containers by @melnik0v in J-F-Liu/lopdf#576

feat: add Document::get_page_annotations_mut by @ChrisJr404 in J-F-Liu/lopdf#571

perf: decode each object stream once per load by @melnik0v in J-F-Liu/lopdf#578

fix: export DateTime from crate root by @isaim0011 in J-F-Liu/lopdf#579

fix: preserve text after unmapped tounicode codes by @szdytom in J-F-Liu/lopdf#580

fix: keep an unloadable page-tree kid as a blank page slot by @abimaelmartell in J-F-Liu/lopdf#583

fix: read one white-space character after ID in inline images by @ghempton in J-F-Liu/lopdf#582

fix: derive the file key from the sanitized password on load by @LuisFigueroaG in J-F-Liu/lopdf#586

fix: tolerate padding after %%EOF when locating startxref by @LuisFigueroaG in J-F-Liu/lopdf#587

fix: don't panic on huge predictor DecodeParms by @LuisFigueroaG in J-F-Liu/lopdf#589

fix: handle missing and indirect /Annots in remove_annot by @LuisFigueroaG in J-F-Liu/lopdf#590

fix: treat /Type and /Differences as optional in encoding dictionaries by @LuisFigueroaG in J-F-Liu/lopdf#591

fix: parse UTC and shortened dates with the time backend by @LuisFigueroaG in J-F-Liu/lopdf#592

feat: decode content operations one at a time with Content::decode_iter by @josh-prefix in J-F-Liu/lopdf#588

fix: don't overflow when incrementing a multi-unit bfrange target by @LuisFigueroaG in J-F-Liu/lopdf#593

fix: don't overflow computing inline image data length by @LuisFigueroaG in J-F-Liu/lopdf#594

fix: apply array DecodeParms per filter by @sean0407 in J-F-Liu/lopdf#596

fix: read /XRefStm in every section of hybrid-reference files by @LuisFigueroaG in J-F-Liu/lopdf#598

fix: accept the /G abbreviation and Indexed colour spaces in inline images by @LuisFigueroaG in J-F-Liu/lopdf#597

fix: treat NUL and form feed as white-space in content streams by @jaenam615 in J-F-Liu/lopdf#599

fix: allow delimiters without white-space in ToUnicode CMaps by @jaenam615 in J-F-Liu/lopdf#600

fix: parse the Type 3 glyph operators d0 and d1 in content streams by @LuisFigueroaG in J-F-Liu/lopdf#601

fix: bound cross-reference stream object numbers to u32 by @LuisFigueroaG in J-F-Liu/lopdf#602

fix: consume the fields of unknown cross-reference stream entry types by @LuisFigueroaG in J-F-Liu/lopdf#604

fix: read unescaped end-of-line markers in literal strings as a line feed by @LuisFigueroaG in J-F-Liu/lopdf#605

fix: ignore a minus sign inside the fraction of a real number by @LuisFigueroaG in J-F-Liu/lopdf#606

fix: write decoded inline images back as BI/ID/EI when encoding content by @LuisFigueroaG in J-F-Liu/lopdf#607

fix: drop /Prev and /XRefStm from a reconstructed trailer by @yhay81 in J-F-Liu/lopdf#609

perf: keep the reconstruction scan linear when streams lack endstream by @yhay81 in J-F-Liu/lopdf#610

fix: correct an xref offset only when the section found locates its objects by @yhay81 in J-F-Liu/lopdf#611

feat: report cross-reference recovery in Document and PdfMetadata by @yhay81 in J-F-Liu/lopdf#612

fix: stop new object IDs from wrapping past u32::MAX by @yhay81 in J-F-Liu/lopdf#614

perf: speed up the object parser by @yhay81 in J-F-Liu/lopdf#616

fix: keep tabs and line breaks when decoding PDFDocEncoding text strings by @LuisFigueroaG in J-F-Liu/lopdf#617

feat: reconstruct files that only have cross-reference streams by @yhay81 in J-F-Liu/lopdf#613

perf: parse small documents on the calling thread instead of rayon's pool by @yhay81 in J-F-Liu/lopdf#618

fix: strip the UTF-8 byte order mark when decoding text strings by @LuisFigueroaG in J-F-Liu/lopdf#619

fix: decode outline titles as text strings in get_toc by @LuisFigueroaG in J-F-Liu/lopdf#620

fix: ignore an odd trailing byte in UTF-16BE text strings by @LuisFigueroaG in J-F-Liu/lopdf#621

fix: use inherited /Resources in get_page_images by @LuisFigueroaG in J-F-Liu/lopdf#622

New Contributors

@chintans made their first contribution in J-F-Liu/lopdf#573

@melnik0v made their first contribution in J-F-Liu/lopdf#577

@ChrisJr404 made their first contribution in J-F-Liu/lopdf#571

@isaim0011 made their first contribution in J-F-Liu/lopdf#579

... (truncated)

Changelog

Sourced from lopdf's changelog.

v0.45.0 (2026-09-08)

Accept 19-byte cross-reference entries when parsing leniently (#564)

Accept an integral real /Length when resolving deferred streams (#560)

Add option to set FirstChar, LastChar and the Widths array of a custom font (#557)

Bound cross-reference subsection object numbers to u32

Bound xref-stream entry count against the decoded stream length

Bound object-graph recursion depth (fix #530)

Decode sub-byte-depth PNG and TIFF predictors

Decode ASCIIHexDecode and RunLengthDecode streams

Default the file encryption key length from V when Length is absent

Fix ASCII85 group-value overflow and decode TIFF Predictor 2

Fix four crash bugs from crafted PDFs (fix #532)

Recover from slightly miswritten startxref / Prev offsets

Silence lints introduced by Rust 1.98

Use skrifa instead of unmaintained ttf-parser

Write a cross-reference stream when object streams are disabled

Commits

bbc5e4b Release 0.46
846e2e9 fix: use inherited /Resources in get_page_images (#622)
2f497f8 fix: encrypt and decrypt strings in stream dictionaries, and leave signature ...
abd061c fix: ignore an odd trailing byte in UTF-16BE text strings (#621)
8ccd5af fix: decode outline titles as text strings in get_toc (#620)
a259349 fix: strip the UTF-8 byte order mark when decoding text strings (#619)
8d16cd1 perf: parse small documents on the calling thread instead of rayon's pool (#618)
7679383 feat: reconstruct files that only have cross-reference streams (#613)
c608838 fix: keep tabs and line breaks when decoding PDFDocEncoding text strings (#617)
6d1a503 perf: speed up the object parser (#616)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [lopdf](https://github.com/J-F-Liu/lopdf) from 0.44.0 to 0.46.0. - [Release notes](https://github.com/J-F-Liu/lopdf/releases) - [Changelog](https://github.com/J-F-Liu/lopdf/blob/main/CHANGELOG.md) - [Commits](J-F-Liu/lopdf@v0.44.0...v0.46.0) --- updated-dependencies: - dependency-name: lopdf dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-31T06:06:35Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
❌ 1 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.
⚠️ 2 packages with OpenSSF Scorecard issues.

See the Details below.

License Issues

Cargo.lock

Package	Version	License	Issue Type
brotli-decompressor	5.0.3	LicenseRef-bad-bsd-3-clausemit	Incompatible License

Allowed Licenses:
MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, BlueOak-1.0.0, Unlicense, CC0-1.0, CC-BY-4.0, CDLA-Permissive-2.0, MIT-0, MPL-2.0, Python-2.0, Zlib, Unicode-3.0

Excluded from license check:
pkg:cargo/stella-aho-corasick-core, pkg:cargo/stella-fuzzy-search-core, pkg:cargo/stella-regex-set-core, pkg:cargo/libfuzzer-sys, pkg:cargo/matrixmultiply, pkg:cargo/rangemap, pkg:cargo/unicode-properties

OpenSSF Scorecard

Package

Version

Score

Details

cargo/alloc-no-stdlib

2.0.4

⚠️ 2.1

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 3/28 approved changesets -- score normalized to 1
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Token-Permissions	⚠️ -1	No tokens found
Dangerous-Workflow	⚠️ -1	no workflows found
Pinned-Dependencies	⚠️ -1	no dependencies found
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/alloc-stdlib

0.2.4

⚠️ 2.1

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 3/28 approved changesets -- score normalized to 1
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Token-Permissions	⚠️ -1	No tokens found
Dangerous-Workflow	⚠️ -1	no workflows found
Pinned-Dependencies	⚠️ -1	no dependencies found
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/brotli-decompressor

5.0.3

🟢 5.1

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	⚠️ -1	no workflows found
Token-Permissions	⚠️ -1	No tokens found
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 4	Found 13/30 approved changesets -- score normalized to 4
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ -1	no dependencies found
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/lopdf

0.46.0

🟢 4.7

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/30 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/lopdf

>= 0.46.0, < 0.47.0

Unknown

Scanned Files

Cargo.lock
crates/anonymize-pdf-core/Cargo.toml

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 31, 2026

dependabot Bot mentioned this pull request Oct 31, 2026

chore: bump lopdf from 0.44.0 to 0.46.0 #606

Closed

Navigation Menu

Repository navigation

chore: bump lopdf from 0.44.0 to 0.46.0 - #633

chore: bump lopdf from 0.44.0 to 0.46.0#633
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/lopdf-0.46.0

dependabot Bot commented on behalf of github Oct 31, 2026

Uh oh!

github-actions Bot commented Oct 31, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 31, 2026

v0.46.0

What's Changed

New Contributors

v0.45.0 (2026-09-08)

Uh oh!

github-actions Bot commented Oct 31, 2026

Dependency Review

License Issues

Cargo.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants