chore(deps): update dependency smalot/pdfparser to v2.13.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
smalot/pdfparser (source)	2.12.5 → 2.13.1

---

Release Notes

smalot/pdfparser

v2.13.1: Security hardening and refinements

Compare Source

Mitigation of Denial-of-Service vulnerabilities

This release introduces safeguards against potential denial-of-service attacks caused by specially crafted PDF files.

• Uncontrolled recursion: Added a configurable nesting depth limit to prevent excessive recursion when parsing deeply nested PDF objects.
• Unbounded decompression: Extended the existing decompression memory limit to additional filters (LZWDecode and RunLengthDecode).
• Additional improvements: Added cycle detection for PDF page trees, regression tests, and updated configuration documentation.

Limitations and backward compatibility

To preserve backward compatibility, the default decompression limit remains 0 (unlimited). Applications processing untrusted PDFs should explicitly configure Config::setDecodeMemoryLimit().

The nesting depth limit defaults to 5,000 levels but does not currently cover recursion caused by consecutive PDF comments. These safeguards therefore mitigate, but do not completely eliminate, the reported risks.

Acknowledgments

Special thanks to Eduardo Santos de Abreu (@​blackrose-0xday) for responsibly reporting both vulnerabilities and providing detailed proof-of-concept examples.

CVE identifiers will be added once available.

See #​843 for further details.

v2.13.0: Bugfixes and performance gains

Compare Source

Summary

@​kernie, @​bernemann, @​splitbrain and @​NiekNijland contributed bug fixes and performance optimizations for this release. Thank you. 🚀

What's Changed

• Fix Font::getDetails() TypeError when Encoding is indirect reference to PDFObject by @​kernie in #​823
• Replaces #​828: Chunked getSectionsText() to lower peak memory by @​splitbrain in #​840
• Replaces #​825 - Fix float-to-int cast warning in Font::uchr on PHP 8.1+ fix by @​splitbrain in #​841
• Replaces #​827 - Build PDF objects incrementally to lower peak memory by @​splitbrain in #​842
• Avoid quadratic placeholder replacement in PDFObject::formatContent() by @​bernemann in #​831
• Avoid recursive matching for object stream indexes by @​NiekNijland in #​836
• Revise maintenance status and contribution guidelines by @​k00ni in #​821

New Contributors

• @​kernie made their first contribution in #​823
• @​bernemann made their first contribution in #​831
• @​NiekNijland made their first contribution in #​836

Full Changelog: smalot/pdfparser@v2.12.5...v2.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.