v0.3.63 | Engine bump to `pdf_oxide` 0.3.63 (version-mirroring release). The API release version, the pinned engine, the OpenAPI contract, `llms.txt`, and this changelog are now verified in lock-step by a CI version-sync gate so a bump can never again ship with a half-updated set of files.

Changed

• Bumped the embedded pdf_oxide engine to 0.3.63; the mirrored API
  release version moves 0.3.61 → 0.3.63 in step.

Added

• CI version-sync gate (.github/scripts/check-version-sync.sh, run as the
  version-sync job in ci.yml): asserts that Cargo.toml (package version +
  pdf_oxide dependency), Cargo.lock, openapi.yaml, openapi.json,
  llms.txt, and the top CHANGELOG.md entry all carry the same version
  string. Catches the drift class from the 0.3.61 bump, where the manifest was
  updated but openapi.* and llms.txt were left behind (fixed in #6).

---

Run it

docker run --rm -p 8080:8080 ghcr.io/yfedoseev/pdf_oxide:latest
curl -s -F file=@doc.pdf http://localhost:8080/v1/extract/text

Pin a digest for reproducibility:

docker pull ghcr.io/yfedoseev/pdf_oxide@sha256:<digest-from-assets>

The image is multi-arch (linux/amd64 + linux/arm64), cosign-signed
(keyless), and ships an attached CycloneDX SBOM + SLSA build provenance.

Verify the image

cosign verify ghcr.io/yfedoseev/pdf_oxide:VERSION_TAG \
  --certificate-identity-regexp 'https://github.com/yfedoseev/pdf_oxide_api/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

API contract

• OpenAPI 3.1: GET /openapi.json · interactive docs: GET /docs
• Versions: GET /version (reports the embedded pdf_oxide engine version)

Changelog

See CHANGELOG.md for full history.