v0.9.4

• Security hardening of the untrusted-PDF parsing paths:
  • The XMP /Metadata stream is now read through the bounded reader and capped at
    HybridLimits.getMaxPdfBytes(), closing a decompression-bomb vector that previously bypassed
    the PDF-size limit.
  • The embedded-files name tree is traversed with a maximum recursion depth, so a cyclic or
    deeply nested tree raises a clean IOException instead of a StackOverflowError.
  • Behaviour change: when veraPDF throws while validating an untrusted PDF, the PDF/A-3 layer
    now emits an ERROR (fail-closed) instead of a WARNING, so such a document is reported as
    invalid rather than valid; the finding no longer echoes the raw exception message.
  • HybridAttachment now defensively copies the payload in its constructor, matching the
    @Immutable contract already honoured by getBytes().
  • Attacker-controlled strings (embedded-file names, XMP values) are stripped of control
    characters before being written to logs and to the CLI console, preventing log / terminal
    escape-sequence injection.
  • The CLI extract subcommand writes the output XML with NOFOLLOW_LINKS, refusing to write
    through a pre-planted symlink in the output directory.
  • Clarified the HybridSource.fromUrl Javadoc: the scheme check does not prevent host-level
    SSRF or re-validate HTTP redirects — host / IP allow-listing remains the caller's
    responsibility.

Full Changelog: kaltblut-parent-pom-0.9.3...kaltblut-parent-pom-0.9.4

v0.9.3

• Added distributed-tracing instrumentation via the vendor-neutral
  ph-telemetry facade. kaltblut-core and
  kaltblut-verapdf emit spans around the usual hotspots (source read, PDFBox parse, XMP parse,
  attachment extraction, BR-HYBRID + PDF/A-3 validation) and degrade to no-ops when no tracer is
  registered — no OpenTelemetry dependency is added to the library. The kaltblut-cli module ships
  an opt-in OpenTelemetry binding (-Dotel.enabled=true / OTEL_ENABLED=true). See
  Telemetry.

Full Changelog: kaltblut-parent-pom-0.9.2...kaltblut-parent-pom-0.9.3

v0.9.2

• Added support for ZUGFeRD v2.5

Full Changelog: kaltblut-parent-pom-0.9.1...kaltblut-parent-pom-0.9.2

v0.9.1

• Validation: the result of HybridValidator.validate is now structured as a list of
  HybridValidationLayers (BR_HYBRID + optional PDF_A3, identified by
  EHybridValidationLayerKind) instead of a flat finding list. Each layer carries its own findings
  and wall-clock Duration. Aggregate predicates on HybridValidationResult continue to work
  across all layers.
• Breaking: ValidationResult renamed to HybridValidationResult, and the new
  per-layer container is HybridValidationLayer.
• Breaking: EHybridSeverity.FATAL renamed to ERROR. Predicate methods follow:
  isFatal() → isError(), hasFatal() → hasError(), hasFatalRule() → hasErrorRule().
• EHybridSeverity entries now carry the equivalent ph-commons EErrorLevel via
  getErrorLevel(), so consumers mapping findings into ph-commons error infrastructure no
  longer need a translation table.
• EZugferdCountry now implements IHasID<String> with getID() and the static
  getFromIDOrNull(String) factory, matching the style of the other ph-commons-based enums.
• CLI validate subcommand prints one line per layer with its kind, finding count, and
  duration, then the layer's findings indented underneath.

Full Changelog: kaltblut-parent-pom-0.9.0...kaltblut-parent-pom-0.9.1

v0.9.0

• Detection: recognises all five XMP extension-schema namespaces seen across ZUGFeRD 1.0, 2.0.1, 2.1, 2.2, 2.3, 2.3.2, 2.3.3 and 2.4.
• Extraction: invoice XML, named attachments, full attachment list including Modification Date and MIME type.
• Validation: BR-HYBRID-01 through BR-HYBRID-15 (and the BR-HYBRID-DE-/-FR- country
  variants) plus PDF/A-3 conformance via the IPdfA3ValidatorSPI SPI implemented by
  kaltblut-verapdf using veraPDF (-jakarta artifact line, JAXB 4.x only).
• Command-line client with subcommands inspect, extract, attachments, validate.

Full Changelog: https://github.com/phax/kaltblut/commits/kaltblut-parent-pom-0.9.0