Safer Processing, Clearer Errors

Changes since v0.14.0-rc.1

Shared custom font directories (#1454)

Installed font metrics are now world-readable (0644). Calling api.InstallFonts(nil) reloads existing fonts without modifying the font directory, allowing fonts installed by one user to be shared safely with other users that have read-only access.

Error handling

The github.com/pkg/errors dependency is gone. Error handling has been migrated throughout the codebase to standard Go patterns.

Errors now retain useful operation and input context, and exported sentinel errors make failures easier to classify with errors.Is and errors.As.

Public API boundaries now validate nil and invalid arguments instead of risking panics. Multi-input operations return joined errors where appropriate, while the CLI presents concise errors without exposing stack traces by default.

File operations are safer as well: output is staged before replacement, existing files and permissions are preserved on failure, filesystem aliases and output collisions are detected, and temporary-file cleanup has been hardened across platforms.

CLI

CLI users should see clearer and more complete diagnostics, particularly for batch validation, merging, attachments, encryption, certificates, fonts, and page operations.

Other notable changes include:

• JSON output for certificate listing.
• Support for the OneColumn page layout.
• Optional installed-font selection for fonts cheatsheet.
• Improved attachment glob handling.
• Stricter validation of ordered, unique page split points.
• Clearer certificate-import and replacement behavior.
• Improved reporting when one or more inputs in a batch fail.

API

The public API now offers more consistent reader/writer and file-based entry points, along with exported errors that callers can inspect without parsing error strings.

New and expanded API support includes:

• Grid operations.
• Raw signature validation.
• Machine-readable certificate listing.
• List-oriented bookmark, box, form-field, image, property, permission, and viewer-preference operations.
• Explicit handling policies for unsupported resources during extraction.
• Transactional certificate and TrueType collection installation.

Callers that compare complete error strings should migrate to errors.Is or errors.As, as many errors now include additional operation and source context.

Security, signatures, and dependencies

Signature, timestamp, PKCS#7, certificate-chain, and revocation processing received substantial hardening. This area remains under active development, and further work on signature creation, validation, revocation, and interoperability is ongoing.

Remote image fetching for create and form inputs now rejects private and local destinations, including redirects and DNS results. Access to private revocation endpoints must be explicitly allowed through allowedRevocationHosts.

The external github.com/hhrutter/lzw and github.com/hhrutter/pkcs7 dependencies have been replaced by internal implementations. Remaining dependencies have been updated.

Windows 7

The experimental Windows 7 build is being discontinued because the request for community testing received no response. It relied on an unofficial patched Go toolchain and could not be tested on Windows 7 in CI. Official Go releases require Windows 10 or Windows Server 2016 or later.

Additional fixes

This release also includes numerous fixes across parsing, validation, forms, fonts, attachments, merging, page trees, annotations, images, encryption, and digital signatures, backed by substantially expanded regression and error-path coverage.

Thanks

Many of the fixes in this release began with reports from you - the pdfcpu users. Thanks everyone who opened issues, provided reproducible examples, tested fixes, and helped identify difficult PDF edge cases. Your feedback directly improves pdfcpu's reliability.

Changelog

• [ef9dda] bump version
• [8c3a1f] fix(font): reload existing fonts for empty API input
• [384def] update gh templates
• [b3ddbc] fix: make installed fonts shared-readable
• [1e88df] Update Readme
• [2f43fd] fix Windows test portability
• [5f7bf4] bump version
• [029fa5] harden recursive action and bead validation
• [5538e8] fix [#1383]
• [4b6b06] fix [#1448]
• [f3c9ed] cleanup error handling
• [e7973f] harden integer validation and CI permissions
• [4dc0e6] fix [#1440]
• [1fa266] fix [#1439]
• [0f5d51] fix [#1438]
• [e413ba] fix [#1437]
• [d2488f] fix [#1431]
• [5a2455] cleanup error handling
• [997afd] hide stack traces from default API and CLI errors
• [29f40f] clarify encryption error classification
• [63bf1f] fix(cli): surface multi-input command errors
• [553aa8] fix(cli): return batch validation and merge source errors
• [73c7c2] api: add source context to merge errors
• [cd741d] api: harden error and nil argument handling
• [ae3023] fix [#1051]
• [fd3c42] add regression test for [#1059]
• [db8977] fix [#1088]
• [6d12b9] fix [#1091]
• [04d6bb] fix [#866]
• [75ded4] fix [#1101]
• [85bb38] fix [#1123]
• [823117] fix [#1127]
• [b897b5] fix [#1161]
• [c5124d] upgrade dependencies
• [6e318a] fix [#415]
• [7623a9] fix [#1265]
• [a35e55] add regression test for [#1271]
• [63ad8b] fix [#1279]
• [34a477] Harden remote image fetching for create/form inputs
• [ee1911] fix [#1282]
• [5868dc] fix [#1311]
• [ca9e9a] fix [#1325]
• [85f5d1] fix [#1326]
• [dfb3b4] internalize PDF LZW filter implementation
• [6c60ed] fix [#1302]
• [def15d] fix [#1340]
• [66f98f] fix [#1387]
• [a49681] fix [#1419]
• [30b7bc] fix [#1417]
• [e71119] fix [#1403]
• [dbf990] fix [#1274]
• [d79565] add regression test for invalid destination stream [#933]
• [887462] fix [#1289]
• [d5ec9d] Add xref stream regression tests for [#399] and [#401]
• [89d4bc] fix [#990]
• [d01e39] fix [#1385]
• [b45031] Fix tmp file handling & permissions
• [b17661] Add missing guards
• [7bde99] Fix [#1404]