* Fri Sep 25 2026 Markéta Machová <mmachova@suse.com>
- Update to 6.19.0
* SEC: Limit size of alphabetical page labels
* Replace PdfWriter method add_js
* Move static value out of loop body for appearance stream data
* Reduce number of full data lookups for attachment mapping API
6.18.1
* SEC: Further restrict FlateDecode recovery
* SEC: Limit entry count for TrueType and Type1 font /Widths
* SEC: Limit allowed length of tokens in parse_bfchar
* Fix compatibility with fonttools < 4.58.0
6.18.0
* SEC: Limit allowed length of indirect object tokens
* Rework configuration value handling
* Draw borders and backgrounds for appearance streams and annotations
6.17.0
* SEC: Limit value for Roman numerals
* _cmap.py: Also parse encoding for embedded CFF Type1 fonts
* Cache repeated text extraction character lookups
- Drop fonttools-slfo.patch, no longer needed (and skip the test)
- Skip some flaky tests
* Fri Sep 04 2026 Markéta Machová <mmachova@suse.com>
- Add fonttools-slfo.patch to restore compatibility with FontTools < 4.57
* Mon Aug 24 2026 Markéta Machová <mmachova@suse.com>
- Update to 6.16.2
* Make remove_from_tree() work on outline items
* Allow repeated page references
* Improve RC4 fallback when cryptography can't provide it
6.16.1
* Limit iterations for outline retrieval and XForm text extraction
6.16.0 (CVE-2026-84309, bsc#1278986)
* Detect cycles in TreeObject.insert_child
* Build /ToUnicode source-code bytes directly in parse_bfrange
* Reject typeless non-page /Kids entries in strict mode
6.15.0 (CVE-2026-71870, bsc#1274688, CVE-2026-71852, bsc#1275551, CVE-2026-82398, bsc#1278166)
* Improve performance of read_until_whitespace
* Limit CID width range and width count when loading fonts
* Limit token length for ToUnicode entries
* Deprecate previously missed inline_images setter as well
* Add ActualText tag when we produce RTL appearance stream
* Allow keeping original PDF header in non-incremental clone mode
* Thu Jul 09 2026 Markéta Machová <mmachova@suse.com>
- Update to 6.14.2 (CVE-2026-59935, bsc#1271145)
* Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline
images
6.14.1 (CVE-2026-59936, bsc#1271146)
* Detect end of stream during inline image end marker detection
* Tue Jun 23 2026 Markéta Machová <mmachova@suse.com>
- Update to 6.14.0 (CVE-2026-59937, bsc#1271147, CVE-2026-59938, bsc#1271148)
* Apply general limit for requested image size
* Speed up recovery when reading broken cross-reference table
6.13.3
* Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well
6.13.2
* Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV
6.13.1 (bsc#1268787, CVE-2026-54651)
* Prevent infinite loops when processing threads/articles
* Mon Jun 08 2026 Daniel Garcia <daniel.garcia@suse.com>
- Update to 6.13.0
(CVE-2026-48155, bsc#1266823, CVE-2026-48156, bsc#1266822,
CVE-2026-48735, bsc#1266821)
[#] Security (SEC)
- Avoid infinite loops for outlines and text extraction (#3830)
[#] New Features (ENH)
- Add Japanese predefined CMaps (#3800)
- Font: Collect all character widths, not only those that can be
unicode mapped (#3798)
[#] Robustness (ROB)
- Recover a corrupt trailing startxref pointer (closes #3238) (#3826)
- Handle /Pages node without /Kids during flattening (#3825)
- Accept inline image EI marker at the end of a content stream (#3827)
[#] Maintenance (MAINT)
- Type the always-raising deprecation helpers as `NoReturn` (#3819)
- 6.12.2:
[#] Security (SEC)
- Optimize _decode_png_prediction regarding memory and speed (#3806)
- Improve loop control in text extraction (#3805)
- 6.12.1:
[#] Security (SEC)
- Limit input size and element count for XMP metadata (#3796)
[#] Robustness (ROB)
- Prevent cyclic parent hierarchies for inherited dictionaries (#3795)
- Deal with invalid first code in LZW decoder (#3794)
- 6.12.0:
[#] Security (SEC)
- Disallow cross-reference streams with zero-only width values (#3791)
- Avoid excessive whitespace in layout mode text extraction (#3790)
[#] New Features (ENH)
- Implement SASLprep (RFC 4013) for AES-256 password normalization (#3780)
- CID font resource from font file to encode more characters (#3652)
[#] Performance Improvements (PI)
- Optimize retrieval of named destinatinos in reader (#3442)
[#] Bug Fixes (BUG)
- Fix TreeObject.insert_child KeyError on fresh children (#3786)
[#] Robustness (ROB)
- AppearanceStream: Also honor user-set font name when not
flattening annotations (#3781)
[#] Documentation (DOC)
- Block encrypting writer in incremental mode (#3789)
- 6.11.0:
[#] New Features (ENH)
- Initialise a Font from an embedded font file (#3704)
[#] Robustness (ROB)
- Allow to fix AES padding length in non-strict mode (#3742)
[#] Developer Experience (DEV)
- Enable PyPy testing again (#3752)
- Align mypy Makefile target with strict mode (#3690)
* Mon Apr 20 2026 Daniel Garcia <daniel.garcia@suse.com>
- Update to 6.10.2 (bsc#1262675, CVE-2026-41312, bsc#1262670, CVE-2026-41313, bsc#1262669, CVE-2026-41314)
* Do not rely on possibly invalid /Size for incremental cloning
* Introduce limits for FlateDecode parameters and image decoding
- 6.10.1 (bsc#1262676, CVE-2026-41168)
* Limit the allowed size of xref and object streams
* Consider strict mode setting for decryption errors
* Use new parameter names for compress_identical_objects
- 6.10.0 (bsc#1262284, CVE-2026-40260)
* Disallow custom XML entity declarations for XMP metadata
* Skip MD5 key derivation for AES-256 encrypted PDFs
* Use remove_orphans in compress_identical_objects
* Fix PdfReadError when xref table contains comments before trailer
* Correctly verify AES padding during decryption
* Fix stale object cache from non-authoritative object streams
* Fix extract_links pairing when annotations include non-links
* Add AI policy
* Mon Mar 30 2026 Steve Kowalik <steven.kowalik@suse.com>
- Update to 6.9.2 (bsc#1260882, CVE-2026-33699)
* Avoid infinite loop in read_from_stream for broken files
* Resolve UnboundLocalError for xobjs in _get_image
- Remove unneeded BuildRequires on setuptools/wheel.
- Run the testsuite.
* Fri Mar 20 2026 Markéta Machová <mmachova@suse.com>
- Update to 6.9.1 (bsc#1259992, CVE-2026-33123)
* Improve performance and limit length of array-based content streams
* Expose /Perms verification result on Encryption object
* Fix O(n²) performance in NameObject read/write
* Batch-parse all objects in ObjStm on first access
* Avoid sharing array-based content streams between pages
* Avoid accessing invalid page when inserting blank page under some conditions
* Wed Mar 11 2026 Nico Krapp <nico.krapp@suse.com>
- Update to 6.8.0 (CVE-2026-31826, bsc#1259508)
* Limit allowed /Length value of stream
* Add /IRT (in-reply-to) support for markup annotations
* Avoid using PageObject.replace_contents on PdfReader
* Document how to disable jbig2dec calls
Version: 1.13+20130112-bp150.2.4
* Sat Jan 12 2013 jw@suse.com
- bumping version number to 1.13+20130112 to allow Requires: > 1.13
- added pypdf_encryption_string_unicode_bug.patch
fixing https://bugs.launchpad.net/pypdf/+bug/242756
The codebase at http://pybrary.net/pyPdf/
has not accepted any of the 13 pull requests waiting at
https://github.com/mfenniak/pyPdf/pulls
The patch above is pull/29 of this set.
* Mon Feb 13 2012 coolo@suse.com
- patch license to follow spdx.org standard
* Tue Mar 29 2011 saschpe@suse.de
- Update to 1.13:
- Fixed a typo in code for reading a "\b" escape character in strings.
- Improved __repr__ in FloatObject.
- Fixed a bug in reading octal escape sequences in strings.
- Added getWidth and getHeight methods to the RectangleObject class.
- Fixed compatibility warnings with Python 2.4 and 2.5.
- Added addBlankPage and insertBlankPage methods on PdfFileWriter class.
- Fixed a bug with circular references in page's object trees (typically
annotations) that prevented correctly writing out a copy of those pages.
- New merge page functions allow application of a transformation matrix.
- To all patch contributors: I did a poor job of keeping this ChangeLog
up-to-date for this release, so I an missing attributions here for any
changes you submitted. Sorry! I'll do better in the future.
- Cleaned up spec file:
- Changed license to BSD2c
- Removed authors
- Fixed build for non-SUSE distros
- Added spec license header
- Use %%py_requires macro
* Sat Dec 12 2009 pascal.bleser@opensuse.org
- New package (1.12), based on home:babelworx:python/python-pypdf