v1.2.2

What's Changed

• [PDF-131] test: let the rasterize signal arms admit only the documented residue when the pool SIGKILL-escalated by @ArmandoHerra in #67
• [PDF-132] test: admit the idle worker's own SIGTERM-unwind exit (143) in the group-SIGINT oracle by @ArmandoHerra in #68
• [PDF-145] test: close the pipes and files the suite leaks so it passes its own -W error pre-land gate by @ArmandoHerra in #70
• chore(deps): Bump the python-minor-patch group with 5 updates by @dependabot[bot] in #69
• [PDF-135] fix: make permissions --dry-run predict the missing-password exit 6 by @ArmandoHerra in #71
• [PDF-136] fix: keep LibreOffice's temp dir inside the product's scratch namespace so a convert --timeout kill leaves nothing in $TMPDIR by @ArmandoHerra in #72
• [PDF-143] test: close the docs-gate parsing traps and bind the In-1.2 upgrading cells to the product by @ArmandoHerra in #73
• [PDF-134] fix(ci): re-derive the startup-cost ceiling under uv 0.13.5 and move the setup-uv pin to it by @ArmandoHerra in #75
• [PDF-137] fix: make a compress dry-run batch predict each row's own code by @ArmandoHerra in #74
• [PDF-139] fix: escape control characters in table cells so a hostile document name or field cannot drive the terminal by @ArmandoHerra in #76
• [PDF-138] fix: refuse an over-long -O component at exit 5 and predict it in --dry-run by @ArmandoHerra in #77
• chore(release): bump to 1.2.2 by @ArmandoHerra in #78

Full Changelog: v1.2.1...v1.2.2

v1.2.1

What's Changed

• docs: say the 1.2 changes shipped in 1.2.0 by @ArmandoHerra in #59
• fix: unblock main — pin uv below 0.13 and clear the advisories against the locked closure by @ArmandoHerra in #64
• chore(deps): Bump astro from 7.3.5 to 7.4.0 in /website in the npm-minor-patch group across 1 directory by @dependabot[bot] in #61
• fix(ci): move the uv pin into setup-uv so Dependabot can still update Python dependencies by @ArmandoHerra in #65
• chore(ci): Bump the actions-all group across 1 directory with 4 updates by @dependabot[bot] in #62
• chore(release): bump to 1.2.1 by @ArmandoHerra in #66

Full Changelog: v1.2.0...v1.2.1

v1.2.0

What's Changed

• [PDF-126] feat: report unreferenced metadata objects and prior revisions in meta get by @ArmandoHerra in #53
• [PDF-127] feat: refuse --clear-all --in-place unless the cleared metadata's .bak is named by @ArmandoHerra in #54
• [PDF-128] fix: make a batch with a password failure exit 1 and check a supplied password on owner-only inputs by @ArmandoHerra in #55
• [PDF-129] docs: document SIGKILL temp residue instead of reaping it (R-07) by @ArmandoHerra in #56
• [PDF-130] docs: lead the README with a try-it line, recipes and a demo, and stop pointing visitors at a private planning tree by @ArmandoHerra in #57
• chore(release): bump to 1.2.0 by @ArmandoHerra in #58

Full Changelog: v1.1.1...v1.2.0

v1.1.1

What's Changed

• [PDF-122] fix: audit the whole lock — every extra and group — in the required vulncheck, so an advisory in [html]/[all] can no longer hide behind an uninstalled extra by @ArmandoHerra in #48
• [PDF-121] fix: make meta set --clear-all drop the XMP packet from the file by @ArmandoHerra in #49
• [PDF-123] docs: give vulnerability reporters a private channel and keep users' documents out of bug reports by @ArmandoHerra in #50
• [PDF-124] docs: let PyPI searches for the jobs the CLI does find it, and link the site, docs and issue tracker by @ArmandoHerra in #51
• chore(release): bump to 1.1.1 by @ArmandoHerra in #52

Full Changelog: v1.1.0...v1.1.1

v1.1.0

What's Changed

• [PDF-109] fix: the macOS wheel floor moved under us (pikepdf 10.14+ ships macosx_15 only), so CI and the supported floor move to macos-15 and the pikepdf hold is lifted by @ArmandoHerra in #32
• [PDF-110] fix: clear the two high npm advisories (sharp, source-map-js) that red the website check by @ArmandoHerra in #35
• chore(deps-dev): Bump mypy from 2.3.1 to 2.4.0 in the python-minor-patch group across 1 directory by @dependabot[bot] in #33
• [PDF-112] fix: a page's bitmap was unbounded, so one hostile page box could demand gigabytes; bound the render with a per-page pixel budget and --dpi/--width ceilings by @ArmandoHerra in #38
• [PDF-120] fix: stop untrusted office documents fetching or embedding linked resources during convert by @ArmandoHerra in #41
• [PDF-114] test: pin PDF-82 AC13's one-second census cost and put PDF-86 AC2's halves on the -ra line by @ArmandoHerra in #40
• [PDF-115] feat: refuse a decrypted output from an encrypted input unless --allow-decrypted-output by @ArmandoHerra in #42
• [PDF-117] ci: gate --help wall-clock latency in one dedicated, advisory job by @ArmandoHerra in #43
• [PDF-116] fix: carry the input's /Info and XMP through the page-rebuild verbs instead of replacing them with the engine's producer entry by @ArmandoHerra in #44
• [PDF-115] fix: name the verbs that refuse an encrypted input, and warn W-ENC for an opt-in stamp --from source by @ArmandoHerra in #45
• [PDF-119] test: in-place raises of a landed ratchet record or ceiling now red, helper-attributed reads credit their caller, and the runner-image rationale is true by @ArmandoHerra in #46
• [PDF-111] fix: kill a render worker orphaned before it could arm PDEATHSIG by @ArmandoHerra in #39
• [PDF-113] fix: lift the weasyprint floor to 70.0 so the [html] extra cannot resolve CVE-2026-55073, and state the OR-33 platform by @ArmandoHerra in #36
• [PDF-118] fix: the DCO gate graded a PR with the PR's own checker, and Dependabot proposed same-day releases by @ArmandoHerra in #37
• chore(release): bump to 1.1.0 by @ArmandoHerra in #47

Full Changelog: v1.0.1...v1.1.0

v1.0.1

What's Changed

• docs: the branch-and-pull-request flow, now that main is protected by @ArmandoHerra in #8
• [PDF-91] ci: gate the website, and make the colour rules real by @ArmandoHerra in #9
• [PDF-92] fix: navigation that exists on a phone, and anchors that clear the header by @ArmandoHerra in #10
• [PDF-94] feat: move the evidence to its own route, and print it once by @ArmandoHerra in #11
• [PDF-93] feat: the two-plate visual system — the page is printed, not rendered by @ArmandoHerra in #12
• [PDF-95] feat: the fold, rebuilt around a real transcript by @ArmandoHerra in #13
• [PDF-96] fix: the section that states the architecture stated it wrongly by @ArmandoHerra in #14
• [PDF-97] feat: density — verbs as a board, features as a contract, and a posture section by @ArmandoHerra in #15
• feat(website): a Spanish locale, worked examples, and a plain-language pass by @ArmandoHerra in #16
• chore(ci): Bump the actions-all group across 1 directory with 2 updates by @dependabot[bot] in #6
• chore(deps): Bump astro from 7.3.1 to 7.3.5 in /website in the npm-minor-patch group across 1 directory by @dependabot[bot] in #5
• [PDF-98] fix: clear the 11 pip-audit advisories that red vulncheck by @ArmandoHerra in #17
• [PDF-99] fix: return the envelope, not a traceback, when meta set meets a PDF with no /Info by @ArmandoHerra in #18
• [PDF-100] fix: let the guards read a three-digit spec id and stop make ci reddening on a soffice-only host by @ArmandoHerra in #19
• [PDF-104] fix: clear four high npm advisories in the site build and make the website check fail on the next one by @ArmandoHerra in #20
• [PDF-103] test: close D7's file-descriptor blind spot — forbid the fd/link family by derivation, not by name by @ArmandoHerra in #21
• chore(deps): Bump the python-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #7
• [PDF-102] test: keep the docs gate deterministic for the verifier -- no shared-tree plant, no superlative pointer by @ArmandoHerra in #23
• [PDF-101] fix: unwind every render worker's open writer on a terminal Ctrl-C by @ArmandoHerra in #24
• [PDF-106] test: make verification mechanical — one spec's AC evidence on one command by @ArmandoHerra in #25
• [PDF-105] test: give the roster gates a third operand they do not write by @ArmandoHerra in #26
• [PDF-87] fix: make _terminate_pool report what it could not verify by @ArmandoHerra in #27
• [PDF-107] fix: stop meta set leaving an unparseable XMP packet behind a reported ok by @ArmandoHerra in #28
• [PDF-108] fix: say what a write drops — warn when an output loses the input's encryption or metadata by @ArmandoHerra in #29
• [PDF-107] fix: read the true XMP packet of an /EncryptMetadata false input before meta set decides anything by @ArmandoHerra in #30
• chore(release): bump to 1.0.1 by @ArmandoHerra in #31

New Contributors

• @ArmandoHerra made their first contribution in #8
• @dependabot[bot] made their first contribution in #6

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Full Changelog: v0.3.1...v1.0.0

v0.3.1

Full Changelog: v0.3.0...v0.3.1

v0.3.0

Full Changelog: v0.2.0...v0.3.0

v0.2.0

Full Changelog: v0.1.1...v0.2.0