PDFrig Windows alpha 0.1.0-alpha.20261024.2 — security update

PDFrig Windows alpha 0.1.0-alpha.20261024.2

Security dependency update

• Next.js 16.4.1 and Zod 4.6.6 replace the affected versions.
• Production dependency audit: no known vulnerabilities reported at build time.
• Both Windows downloads were rebuilt from source commit 27b4ed0. The desktop embeds Zod; Next.js powers the browser app and is not embedded in the desktop payload.
• Local format, lint, types, tests, license checks and production builds passed. All 153 browser tests passed. GitHub CI and the Windows build both passed:
  https://github.com/kevindemara/PDFrig/actions/runs/40148644677
  https://github.com/kevindemara/PDFrig/actions/runs/40148644767

Choose a download

• PDFrig-setup.exe: current-user Windows x64 installer. Close PDFrig before upgrading. Includes table extraction, its correction preview, XLSX/ODS output, local OCR and All tools navigation.
• PDFrig-portable-windows-x64.zip: extract ALL files to a new folder, keep the licenses folder alongside PDFrig.exe, then run it. Requires Microsoft Edge WebView2 Runtime, which is not bundled in the ZIP. No PDFrig installation or build toolchain is needed. It stores cache/settings in a separate Windows user-profile identity; it is not a trace-free USB profile.
• SHA256SUMS.txt: verify the downloaded EXE or ZIP using PowerShell Get-FileHash -Algorithm SHA256. Individual project and third-party notice files are also attached; the packages include them.

These are unsigned public alpha downloads. Checksums verify integrity, not publisher identity. Stop if Windows or device policy blocks installation or execution; do not disable security protections. No paid code-signing certificate or paid service was used. There is no automatic update channel.

Testing and limits

• Installer upgraded successfully; installed version, expected Tauri NSIS bundle marker, payload and all three license files were checked. Installed original-text preview/apply/export, Save As cancellation/retry, and scanned-table OCR XLSX/ODS saves passed. Independent PDF checks confirmed original font size and text position, replacement text, and unchanged second-page content. Independent spreadsheet checks verified cells, types and totals.
• Portable app passed OCR preview/apply/native PDF save; independent text extraction found the recognized text and independent scan rendering was byte-identical before/after OCR. Selectable-text table XLSX/ODS output passed independent checks. The extracted package passed checksums, moved-folder and relaunch tests.
• These checks used synthetic documents on this Windows PC. Prior-version user acceptance does not constitute new-version cross-machine testing. Clean-machine install, uninstall, missing-runtime behavior, disconnected-network OCR and broader platform testing remain open.
• Native OCR security review remains incomplete. Original-text editing supports bounded fonts/layouts; paragraph reflow does not move neighboring blocks or span pages. OCR can misread values. Tables support one page/region at a time, with correction/review required; mixed scan/text OCR, rotated tables, merged-cell reconstruction, original spreadsheet formulas and cross-page joins are unsupported. Scanned artwork stays unchanged.
• Production audit success is not security certification or full third-party license clearance. The Windows bundle graph excludes the optional native Canvas dependency; broader dependency review remains in progress. PDFrig code is MIT; third-party components retain their own terms.

Provenance

• Installer SHA-256: 4a5b18e14be2392e92fc455d9d58963fa9aad9a0ac7a7e7bf8756bb56def3d47
• Portable ZIP SHA-256: 29854dcdcb84fdca308aac2cf8709f27fa717cf353d796f3ef2d2c7f0f073e17
• Portable source snapshot SHA-256: 3c4a319398906c9f861e74a76ab2b4a0e9cb073b68ee33d1f11eb5e3af6cc6eb
• BUILD_INFO.json in the ZIP retains its pre-publication build state. These release notes record the later validation/publication; no security clearance is implied by build metadata.

This release supersedes the earlier 20261024.1 portable download and 20261020.2 installer. Use this version for both Windows options. Browser setup and the tool-neutral setup aid are in the README:
https://github.com/kevindemara/PDFrig#quick-start

PDFrig portable Windows alpha 0.1.0-alpha.20261024.1

Superseded by the dependency security update: https://github.com/kevindemara/PDFrig/releases/tag/v0.1.0-alpha.20261024.2 . Download the replacement EXE or portable ZIP from that release. The original notes below describe this older build.

Portable Windows app

Download PDFrig-portable-windows-x64.zip below, verify it against SHA256SUMS.txt, extract ALL files, then run PDFrig.exe inside the extracted folder. Keep the license files alongside it. No PDFrig installation, administrator access, Node.js or Rust is needed to run this download.

Microsoft Edge WebView2 Runtime is required and is not bundled. If it is missing, use Microsoft's official runtime setup only when permitted by your device policy: https://developer.microsoft.com/microsoft-edge/webview2/

This is an unsigned public alpha. Stop if Windows or your device policy blocks it; do not disable security protections to proceed. Checksums verify file integrity, not publisher identity. Native OCR security and broader dependency reviews remain in progress.

Included

• All tools > PDF tables to spreadsheet: select a table, correct the extracted cells and column types, review, then save XLSX or ODS.
• Local English/French OCR for tables on supported image-only, unrotated pages. Scanned artwork stays unchanged. Verify every recognized value.
• Literal text and leading-zero identifiers are preserved; PDF text does not become spreadsheet formulas, macros or external links.
• Compress is first in All tools; table extraction is ninth, below PDF to images.
• Existing PDF viewing, supported text editing, annotations and local export tools.

Table extraction handles one table/page at a time. Merged-cell reconstruction, original spreadsheet formulas, mixed scan/text OCR, rotated tables and cross-page joins are not supported. OCR mistakes and ambiguous layouts need correction.

This app runs without installation but stores settings/cache in a separate Windows user-profile identity. It is not a self-contained USB profile or a trace-free application. It creates no shortcuts, PDF file associations or uninstall entry. Close the app before moving, updating or removing its folder. There is no automatic update channel.

Local regression checks, native Save As exports, independent XLSX/ODS verification and maintainer manual browser/portable tests passed. Clean-machine, missing-runtime, broader spreadsheet GUI and other-platform testing remain open. No security certification is claimed.

Other options

The README includes browser setup and Mac browser instructions. There is no native Mac app/DMG release, and Mac compatibility still needs testing on Mac hardware. The older PDFrig-setup.exe installer remains available on its existing release; that installer does not contain the new table extraction feature.

README and setup guide: https://github.com/kevindemara/PDFrig#quick-start

Provenance and checksum

This ZIP is the exact archive manually tested before publication. Its executable was built from the recorded source snapshot; subsequent source changes are documentation and test cleanup. BUILD_INFO.json and READ_FIRST.txt inside the ZIP retain their pre-publication build state. Manual acceptance and publication occurred afterward; those historical fields are not a complete security or license clearance.

• Version: 0.1.0-alpha.20261024.1, Windows x64
• ZIP SHA-256: 406322453c403e62e999559de2842260091e66a9ae9fecd3ecf3980498db78fe
• Executable SHA-256: e450eea3b18bddec7e1c3a8e386aa6577ff4622bc3bbf9da049d44b2a012e643
• Build source snapshot SHA-256: aca652143ee62290d8494e94f28941d6ea3bc6e7cccbef24f5599bc75ab6fbec

PDFrig's own code is MIT-licensed. Third-party components keep their respective terms; full notices are inside the ZIP.

PDFrig Windows alpha 0.1.0-alpha.20261020.2

Superseded by the dependency security update: https://github.com/kevindemara/PDFrig/releases/tag/v0.1.0-alpha.20261024.2 . Download the replacement EXE or portable ZIP from that release. The original notes below describe this older build.

PDFrig Windows private alpha 0.1.0-alpha.20261020.2

Download PDFrig-setup.exe and verify SHA256SUMS.txt. This replaces the .1
installer and fixes a rare native Save As competing-writer overwrite race.
Export first and close PDFrig before installing. Native save requires a new
filename. Do not bypass Windows security if installation or execution is blocked.

Tested on the authorized Windows developer host: same-user upgrade, installed
version/shortcuts, English OCR preview/review/apply, Save As cancellation and new
Unicode filename, script signature preview/move/resize/export, All tools warning
and Cancel, navigation after export. Independent qpdf/pypdf/Poppler checks passed;
OCR scan appearance is byte-identical at 144 DPI and signature font is unchanged.
20 native tests, 3 updater verifier tests, local full checks and 29 additional
browser checks passed. Exact payload/notices are hash-bound in attached evidence.

Unsigned private prerelease, not public-distribution or Windows compliance
certification. The updater test signature is not Authenticode publisher identity.
The shipped OCR core is unchanged; research OCR ownership/API reductions are NOT
adopted. Native OCR review, clean-machine/WebView2 bootstrap, disconnected-network,
uninstall and broader platform checks remain open. CI is not claimed passed:
the previously observed account payment/spending block is unchanged. No billing,
repository visibility or Windows security settings were changed.

Executable source: 0f49fc6
Earlier .1 release is retained for history, not recommended for installation.