A Release Featuring CLI Pipelines and Safer Defaults

Starting with this release, pdfcpu improves CLI usability with broader stdin/stdout pipeline support and stricter overwrite handling.

Check out the refreshed documentation at https://pdfcpu.io

Many commands now support - for stdin/stdout, making pdfcpu easier to use in shell pipelines. Explicit output files and non-empty output directories are no longer overwritten implicitly. Use the new global --force flag when overwriting is intentional.

Example:

:::sh
pdfcpu optimize - out.pdf < in.pdf

or:

:::sh
cat in.pdf | pdfcpu optimize - - > out.pdf

or a pipeline:

:::sh
aws s3 cp s3://acme-contracts/master.pdf - \
      | pdfcpu optimize - - \
      | aws s3 cp - s3://acme-contracts/optimized/master.pdf

---

CLI Improvements

This release adds and refines several user-facing CLI features:

• Broader stdin/stdout support using -
• Global --force flag for explicit overwrite handling
• annotations list --json
• form list --json
• certificates list --json
• merge --bookmark-mode wrap|preserve
• Improved version command behavior
• Clarified help text around signature validation scope and trust boundaries

The new overwrite behavior is intentionally stricter. Existing scripts that relied on implicit overwrites may need to add --force.

---

Merge Bookmarks

The merge command now supports bookmark handling modes:

:::sh
pdfcpu merge --bookmark-mode wrap out.pdf in1.pdf in2.pdf

Supported modes:

• wrap
• preserve

The default is wrap.

This release also improves bookmark tree preservation and handling of bookmark destination collisions.

---

JSON Output

JSON output is now available for selected listing commands:

:::sh
pdfcpu annotations list --json in.pdf
pdfcpu form list --json in.pdf
pdfcpu certificates list --json

form list --json also supports multi-file form export JSON.

---

Certificate Trust Store Packaging

Standard builds now start with an empty trusted certificate directory.

Embedded EUTL certificate bundles are only included when building with:

:::sh
-tags pdfcpu_eutl

certificates reset now resets the certificate directory to the build defaults.

This keeps standard builds smaller and avoids implying a bundled trust store unless it was explicitly selected at build time.

---

Experimental Windows 7 Build

An experimental Windows 7 x64 build is available in the release assets:

pdfcpu_0.13.0_Windows_x86_64_win7_experimental.zip

This build uses a patched Go toolchain and is not part of the regular supported release matrix. Feedback from Windows 7 SP1 x64 users is welcome (at [#870]), especially the output of:

cmd
ver
pdfcpu.exe version
pdfcpu.exe validate test.pdf

---

Robustness & Safer Processing

This release adds configurable parser and resource limits for:

• stream bytes
• decoded bytes
• image pixels and bytes
• object counts
• xref entries
• recursion depth

The corresponding limits are also part of the configuration. Users of older version will be prompted by the CLI to reset their configuration.

Additional cycle and depth checks were added for page trees, form fields, name trees, and object graph traversal.

Stream parsing and filter decoding have also been hardened against oversized, malformed, and overflowing inputs.

Very large or malformed PDFs that were previously attempted may now be rejected earlier.

---

Fixes and Improvements

This release includes targeted fixes and compatibility improvements for:

• annotation geometry during resize, including Rect and QuadPoints
• merge bookmark handling
• form filling with user fonts
• removing document properties and associated catalog XMP metadata
• relaxed validation for selected malformed JavaScript action and structure-tree object-reference cases
• booklet page count and content-buffer handling
• FlateDecode predictor and EOF handling
• output path handling in extraction, fonts, forms, split/cut, and attachment-related workflows
• watermarks, stamps, validation, fonts, properties, and related command behavior

Dependencies were updated, including go-runewidth, x/crypto, x/image, and x/text.

---

Signature Validation Notes

Now usage, help text and docs describe the current signature validation scope and trust boundaries more clearly.

This release does not claim complete legal, eIDAS, LTV, or long-term trust validation.

---

Development

Behind the scenes, this release includes command plumbing refactoring in pkg/cli, updated tests around command dispatch, and an experimental Windows 7 build workflow.

---

Thanks

Everybody for testing, reporting issues, and feeding back real-world PDFs. Your bug reports and edge cases continue to make pdfcpu more robust and useful. Shoutouts to @harish for spending time on submitting a PR.

---

Changelog

• 2226694 bump version, fix [#1410], [#1411]
• a212fad refactor cli cmd plumbing
• 982b418 clarify signature trust boundaries
• d27afe2 fix version cmd
• 80b99fe add certificate JSON listing and reset defaults
• a3225ab refactor parameter handling
• 4f4129e add experimental Win7 build
• 84a68af decrease binary size via default build w/o bundled certificates, provide build tag pdfcpu_eutl for bundling EUTL trust-list certs
• ecb6888 fix [#1291]
• 3491406 fix identify version
• e102024 fix [#1316]
• d886d17 fix [#1375]
• d27963b fix [#1317]
• 174230a fix [#1359]
• 8719193 fix merge bookmark destination collisions
• 991e0ec fix: [#1364]
• b11ad47 fix: [#1394]
• 3a73dfa refactor: cli command plumbing
• 6ac18f9 fix arg validation
• 895371a fix [#1396]
• 59ca0db fix [#1402]
• 14e191d fix handling of os.Exit
• cbbb3b5 add missing GoDoc comments
• 8983029 add cycle-detection
• b4c1f98 add recursion-depth checking
• 54d7f0a add limits to configuration
• 21f8b3b sanitize file paths
• e8abb82 harden filter decoders and stream parsing against overflow
• 0ea56f8 update scripts
• 05e8897 add stdin/stdout support, add --force