lazarh.work

storytold/pdfcraft

PdfCraft Updates: Enhanced Security and Usability in Versions 0.12.0 to 0.14.0

pdfcraft

PdfCraft, an open-source PDF reader and editor built in Rust, has released versions 0.12.0 through 0.14.0. These updates focus on improving decoding limits, form handling, interface layout, and platform support, while addressing security and performance issues. Notably, FreeBSD aarch64 support was temporarily dropped due to CI constraints.

About PdfCraft

PdfCraft is an open-source PDF workbench designed for reading, organizing, combining, splitting, and securing PDF documents. Written in Rust, it aims to provide a fast, native application alternative to commercial PDF editors like Adobe Acrobat. Despite being in alpha, PdfCraft already handles many everyday PDF tasks effectively and attracts developers and tech-curious users seeking a free and extensible PDF solution.

Key Changes in Recent Releases

Version 0.14.0

The most recent release, version 0.14.0, includes a broad range of fixes and improvements across decoding, form handling, rendering, UI, and security:

  • Decoding and Performance: The update introduces strict bounds on decoding budgets per page walk to prevent repeated stream references from multiplying decoding work. This change mitigates potential performance issues and resource exhaustion when processing complex or hostile PDF files.
  • Form and Script Handling: Enhancements limit the workload caused by repeated keys and streams in forms, including XFA data and scripts. FormCalc improvements fix issues with printing small negative numbers and accepting long unit names.
  • Editing and Organizing: The update bounds the work hostile files can cause during editing, page organization, and image import, improving stability and responsiveness.
  • Security and Auditing: Several fixes close high-severity scan findings related to redaction, signing, and encryption. The update also improves compliance with PDF/A standards by requiring owner permission on encrypted documents.
  • User Interface and Accessibility: UI improvements prevent clipping under panel headers, keep color popups open during custom color selection, and set accessibility attributes for tables and headers.
  • New Features: Added context menu options like "Split document..." and enhancements to sticky notes and stamps ensure compliance with PDF standards.
  • Platform and Packaging: FreeBSD aarch64 cross builds are packaged, and dependencies are updated to address security advisories.

The release also welcomed numerous new contributors, reflecting a growing community involvement.

Version 0.13.0

This release was primarily focused on maintenance and platform support:

  • FreeBSD aarch64 Support Dropped Temporarily: Due to continuous integration (CI) time constraints (a 5-hour limit), the team had to drop FreeBSD aarch64 builds temporarily. This is a known issue flagged for future resolution.
  • macOS PDF Association Recovery: The release includes a fix to recover existing macOS PDF associations after opening and saving documents, improving user experience on that platform.

Version 0.12.0

Version 0.12.0 brought several interface and performance enhancements:

  • Interface Layout: The Edit panel and Format text panel were updated to match Adobe Acrobat's layout more closely, aiding user familiarity.
  • Rendering and Export: PNG export was optimized to write opaque pages as RGB with faster compression, improving speed without increasing file size.
  • Organizing and Tools: The Organize pages panel remembers page sizes, and the Tools panel behavior was refined when docked alone.
  • Form Handling: Improvements include renaming fields propagating to calculations, enforcing HTTPS on downloads, and enhancements to calculation order and form field tables.
  • Internationalization: New interface languages, including Norwegian Bokmål, Finnish, Indonesian, Vietnamese, Hindi, Korean, Lao, Central Kurdish, Albanian, and Thai, were added or completed.
  • Security and Stability: Numerous fixes addressed issues in rendering, signing, printing, and redaction, enhancing the overall robustness.
  • FreeBSD aarch64 Support Dropped: Similar to v0.13.0, this release also dropped FreeBSD aarch64 due to CI limits.

Community and Development

PdfCraft's development is active and community-driven, with many contributors making first-time contributions in these releases. The project emphasizes compliance with PDF standards (ISO 32000-2), accessibility, and security.

Conclusion

These releases of PdfCraft demonstrate ongoing efforts to enhance the application's reliability, performance, and user experience while navigating platform-specific challenges. The temporary removal of FreeBSD aarch64 support highlights the practical constraints of continuous integration environments but is planned for future fixes. PdfCraft continues to evolve as a viable open-source alternative for PDF manipulation, appealing to users seeking a free and extensible tool.

For detailed changes, users can consult the full changelogs linked in the sources below.

Sources