pdfcpu v0.15.0

This release is a focused follow-up to v0.14.0 improving diagnostics and observability for validating large PDF corpora. It also includes PDF processing hardening, CJK text wrapping for watermarks, and clearer signature-validation behavior.

v0.15.0 follows v0.14.0 by only one week because post-release corpus testing made an existing operational gap clear: large wildcard-driven validation runs delayed failure diagnostics until the full input set completed and provided no quiet-mode indication of the file currently being processed.

The changes are targeted and immediately useful to corpus testers, so holding them for a later feature release would unnecessarily delay feedback. The short interval is intentional and does not establish a weekly release routine.

Corpus validation diagnostics

Multi-file CLI validation now reports each failed input as soon as the failure is detected, continues with the remaining inputs, and exits nonzero with a compact summary:

:::text
validation failed: 66 of 463 files invalid

The new --progress flag identifies the active input during quiet validation runs. This is useful when a long-running corpus job stalls on a particular file:

:::sh
pdfcpu validate -q --progress "**/*.pdf"

The quotes are intentional. They pass the recursive pattern to pdfcpu for internal expansion instead of asking the shell to expand thousands of paths into one command line, which may exceed the operating system's argument-size limit.

With -q --progress, progress and validation failures are written to standard error while standard output remains clean:

:::text
validating(mode=relaxed) path/to/input.pdf ...
validate path/to/input.pdf: validation error: ...

Corpus testing and issue reports

There is a new Corpus Validation guide documenting quick assessment, progress monitoring, logging, validation modes, result interpretation, and focused issue reporting.

A failed corpus run is diagnostic input, not an issue backlog. Public reports must isolate one manually verified and independently reproduced problem with the smallest shareable PDF. Include the relevant error and final summary, and attach large logs as compressed files instead of pasting them into an issue.

AI-generated, bulk-generated, or mechanically reformatted corpus reports will be closed immediately without investigation. Corpus-wide analysis, failure classification, confidential-file investigation, and scheduled remediation are separate engineering work and may require a paid engagement.

Limited corpus investigation and remediation work may be available by arrangement.

PDF validation and processing hardening

Malformed and inconsistent PDF structures now produce more contextual errors across reading, dereferencing, validation, optimization, fonts, forms, and XObjects. Integer conversion and encryption handling have been tightened, and additional guards reduce the risk of panics while processing damaged input.

This work is backed by expanded malformed-input, error-path, and optimization regression coverage.

CJK watermark text wrapping

Text watermarks now support automatic wrapping for CJK text, including long runs without spaces. Oversized text is wrapped to the configured width instead of forcing unintended font-size reduction. This resolves issue [#1427] and includes expanded CJK wrapping and layout coverage.

Digital signatures

Signature validation output is clearer for legacy and unsupported cases. Evidence handling, PKCS#1 and PKCS#7 processing, and related error classification have also been tightened.

Compatibility notes

The pkg/api multi-file validation contract is unchanged: API callers continue to receive joined errors after processing. The CLI now streams individual multi-file validation failures and returns a final summary, so scripts that compare complete stderr strings should be updated to rely on exit status and stable error classification instead.

Existing non-quiet validation already reports the active input. --progress extends that visibility to quiet corpus runs without duplicating normal progress output.

Changelog

• [f26865] bump version
• [dcc168] update issue reporting guidelines
• [f5f3ed] harden PDF validation and add progress reporting
• [afc357] clarify signature validation output and legacy handling
• [c9c07d] harden crypto integer conversions
• [198382] upgrade gh workflows
• [4e5f3a] harden crypto integer conversions
• [b57300] clean up for [#1427]
• [a2c337] add CJK auto-wrap support for text watermarks (#1427)