chore(deps): update dependency pikepdf to v10 by renovate[bot] · Pull Request #969 · DiveWithDamian/pikepdf-annots

renovate · 2025-11-16T19:58:17Z

This PR contains the following updates:

Package	Change	Age	Confidence
pikepdf (changelog)	`==6.2.9` → `==10.11.0`

Release Notes

pikepdf/pikepdf (pikepdf)

`v10.11.0`

Compare Source

`v10.10.0`

Compare Source

Behavior change

{meth}pikepdf.PdfImage.as_pil_image and {meth}pikepdf.PdfImage.extract_to
now apply an image's soft mask (/SMask) or explicit/colour-key mask
(/Mask) by default, returning an image with an alpha channel (LA or
RGBA) and writing a transparency-capable format (.png). Previously
the mask was silently ignored and the opaque base image was returned. Images
without a mask are unaffected. Pass apply_mask=False to recover the old
behavior and obtain only the opaque base image.

New features

Image masking is now honored when extracting images. /SMask soft masks,
/Mask stencil (explicit) masks, and /Mask colour-key masks are
composited into an alpha channel. Soft-mask images whose resolution differs
from the base image are resampled to match (ISO 32000-2 §8.9.6).
Added support for /CalRGB, /CalGray and /CalCMYK images, which
previously raised NotImplementedError. The samples are decoded as their
device equivalents, and for CalRGB/CalGray an ICC profile synthesized from
the colour space's WhitePoint/Gamma/Matrix is attached to the
extracted image so the calibration is preserved for colour-managed consumers.
Added support for the /Lab colour space, extracted as a Pillow LAB
image (saved as TIFF) with the PDF L*/a*/b* ranges remapped to
Pillow's conventions.
Added support for 16-bit-per-component images. 16-bit grayscale is extracted
losslessly as Pillow I;16; 16-bit RGB and CMYK are reduced to 8-bit (with
a warning) because Pillow has no higher-bit-depth raw mode for them.
Extended colour-space handling to several cases that previously raised
NotImplementedError: ICCBased CMYK images and indexed images now produce
the correct default /Decode array, and inline images that name their
colour space now resolve it from the in-scope /Resources when obtained via
{func}pikepdf.parse_content_stream.
JPEG (/DCTDecode) images with a non-default /ColorTransform -- a YCCK
CMYK or a non-YCbCr RGB JPEG -- are now decoded via Pillow (which honours the
JPEG's own markers) and transcoded, instead of failing to extract.
Filter chains that wrap a single terminal image codec (/DCTDecode,
/CCITTFaxDecode, /JPXDecode, /JBIG2Decode) in any number of
generalized/specialized filters (Flate, LZW, ASCII85/Hex, RunLength) are now
peeled and extracted seamlessly.
Added {attr}pikepdf.PdfImage.MAX_IMAGE_PIXELS, a settable class-level limit
on the number of pixels pikepdf will decode from a single image. Until set,
it defaults to max(500_000_000, PIL.Image.MAX_IMAGE_PIXELS) -- a floor
suited to high-DPI scanned PDFs -- and tracks Pillow's setting; once assigned
it becomes independent of Pillow. Set it to None to disable the check.
{class}pikepdf.Array now implements the standard Python list interface:
slicing (including del on slices and slice assignment), and the
clear(), count(), index(), insert(), pop(), remove(),
and reverse() methods.

Limitations

/SMaskInData (alpha encoded inside a JPEG 2000 stream) is applied only
when Pillow's JPEG 2000 decoder surfaces the alpha channel itself; a
pre-multiplied (SMaskInData 2) result is not un-premultiplied. A
/Matte entry on a soft mask is not undone (a warning is emitted). When an
image has both an /SMask and a /Mask, the soft mask takes precedence.
Colour-key masking is applied only to 8-bit L/RGB/CMYK images.
A filter chain containing two or more terminal image codecs (for example
[/DCTDecode /CCITTFaxDecode]) cannot be decoded by any reader and now
raises {class}~pikepdf.exceptions.UnsupportedImageTypeError rather than
NotImplementedError.

Security

Hardened image extraction against decompression-bomb (memory exhaustion)
attacks. A malicious PDF could declare an image with enormous /Width and
/Height so that {meth}pikepdf.PdfImage.as_pil_image attempted to
allocate many gigabytes before reading the (tiny) image stream. pikepdf now
enforces a configurable pixel limit, {attr}pikepdf.PdfImage.MAX_IMAGE_PIXELS
(analogous to PIL.Image.MAX_IMAGE_PIXELS), across every image-decode
path -- including the 2/4-bit transcoding path, 1-bit and 8-bit images, and
the Pillow-decoded JPEG/JPEG2000/CCITT path. Oversized images raise
{exc}pikepdf.DecompressionBombError and borderline images emit
{exc}pikepdf.DecompressionBombWarning (both subclass Pillow's equivalents).
(#733)

Fixed

A CCITT fax image preceded by a stripped simple filter (e.g.
[/FlateDecode /CCITTFaxDecode]) now builds its TIFF header from the
/CCITTFaxDecode filter's own /DecodeParms rather than the leading filter's,
which previously produced a corrupt extraction.
Corrected the documentation of {class}pikepdf.StreamDecodeLevel: the
specialized and all levels were each described with the other's behavior.
Fixed a crash (SIGABRT via std::terminate) that could occur when a
file-backed {class}pikepdf.Pdf was deallocated while a Python exception was
already propagating -- for example when pikepdf.open(filename) appears as a
transient element of a list/tuple literal whose later element raises. Opening
from a filename closes the file in the input source destructor, which calls
back into Python; with an exception already in flight that call raised an error
that escaped the destructor. The in-flight exception is now preserved and
propagates normally. (#732) Added a guard for a likely non-reproducible related
case with DecimalPrecision.

`v10.9.1`

Compare Source

`v10.9.0`

Compare Source

New features

Added {class}pikepdf.JobBuilder, a fluent, Pythonic builder for qpdf jobs.
It assembles a job specification with chained, snake_case methods (input,
output, encrypt, add_pages, split_pages, linearize,
compress, add_attachment, add_overlay, limits, ...) and runs it
via the existing {class}pikepdf.Job, without hand-writing qpdf's camelCase
job JSON. Encryption permissions are expressed with the familiar
{class}pikepdf.Permissions/{class}pikepdf.Encryption models, and a
.set(**kwargs) escape hatch reaches any other job option. Additional
methods cover image optimization (optimize_images,
externalize_inline_images), page/content transforms
(flatten_annotations, flatten_rotation, generate_appearances,
coalesce_contents, normalize_content), content removal
(remove_metadata, remove_info, remove_acroform,
remove_structure, remove_page_labels), page labels
(set_page_labels), version control (min_version, force_version),
and reproducible/inspection helpers (deterministic_id, static_id,
check).
Exposed several pieces of qpdf functionality that pikepdf had not previously
bound:
- Whole-document qpdf JSON: {meth}pikepdf.Pdf.write_qpdf_json,
  {meth}pikepdf.Pdf.from_qpdf_json and {meth}pikepdf.Pdf.update_from_qpdf_json
  serialize and reconstruct an entire PDF as qpdf JSON (the
  qpdf --json-output/--json-input format, version 2). This complements the
  existing object-level {meth}pikepdf.Object.to_json. Added
  {class}pikepdf.JSONStreamData to control how stream data is represented.
- {meth}pikepdf.Pdf.get_xref_table returns the cross-reference table as
  structured data ({class}pikepdf.XrefEntry), complementing the print-only
  {meth}pikepdf.Pdf.show_xref_table.
- {meth}pikepdf.Pdf.fix_dangling_references repairs references to objects
  that are not present in the file.
- {meth}pikepdf.Page.flatten_rotation bakes a page's /Rotate value into its
  content stream.
- {meth}pikepdf.Page.copy_annotations copies annotations (and associated form
  fields) from another page, applying a transformation matrix.
- {meth}pikepdf.Page.get_matrix_for_transformations and
  {meth}pikepdf.Page.get_matrix_for_form_xobject_placement expose qpdf's
  page/form-XObject placement matrices.
- {meth}pikepdf.AcroForm.validate,
  {meth}pikepdf.AcroForm.invalidate_cache and
  {meth}pikepdf.AcroForm.transform_annotations for working with interactive
  forms after manual structural edits.
Added {meth}pikepdf.Page.get_images, which by default recurses into nested
form XObjects to find images. The {attr}pikepdf.Page.images property is now
deprecated: it only reports images referenced directly by the page and
silently omits images drawn through form XObjects, which made it appear as if a
page "has no images" when it clearly did. Use get_images() instead, or
get_images(recursive=False) for the old behavior.
Added {attr}pikepdf.Page.rotation, a property that reports a page's effective
clockwise rotation normalized to [0, 360). Unlike the raw page.Rotate
attribute, it resolves a /Rotate value inherited from the page tree and
reports 0 when no rotation is set, instead of raising. Assigning to it sets
the absolute rotation. This addresses the long-standing confusion between the
page.Rotate attribute and the page.rotate() method (#467).
{meth}pikepdf.Page.rotate now defaults relative to False, so
page.rotate(90) sets an absolute rotation. Passing relative as a
positional argument is deprecated and emits a DeprecationWarning; pass it
as a keyword argument instead, e.g. page.rotate(90, relative=True).
Positional support will be removed in pikepdf 11.
Added {meth}pikepdf.Pdf.add_pages_from to copy pages between documents while
preserving interactive AcroForm form fields, returning a
{class}pikepdf.PageCopyResult. Naive pages.extend() across documents and
save() of documents with orphaned form widgets now emit
{class}pikepdf.PageCopyWarning. (#670, #207)

When copying pages, named destinations referenced by the copied pages'
annotations (e.g. table-of-contents links) are now carried into the
destination document — both the PDF 1.2 Names.Dests name tree and the
legacy PDF 1.1 Root.Dests dictionary — so internal links keep working
regardless of merge order. Name collisions are renamed and reported via
{class}pikepdf.PageCopyResult (named_dests_added, renamed_dests,
dropped_dests). Naive pages.extend() now also warns when copied pages
reference named destinations. (#148)

Fixes

Fixed image extraction ignoring the /Decode array, which caused colors to
be inverted (or otherwise mismapped) when a PDF specified a non-default
/Decode such as [1, 0]. {meth}pikepdf.PdfImage.as_pil_image and
{meth}pikepdf.PdfImage.extract_to now apply /Decode as a linear
per-channel mapping for grayscale, RGB and CMYK raster images, matching how a
PDF viewer renders the image. Previously /Decode was honored only for
CCITTFax-encoded images. Thanks to Mark-Joy for the report. {issue}650
Both methods gained an apply_decode_array parameter (default True).
Pass apply_decode_array=False to retrieve the raw stored sample values
with the least processing -- useful for forensic inspection of the underlying
image data.
Some image types are intentionally not affected: Indexed-colorspace images
(where /Decode remaps palette indices rather than colors -- a non-identity
/Decode there now emits a warning), and DCT (JPEG) / JPX (JPEG 2000)
images, whose codecs carry their own color semantics (such as the Adobe APP14
marker for inverted CMYK) that Pillow already honors; re-applying /Decode
would double-invert them.
Fixed {meth}pikepdf.Pdf.save decompressing streams when called with
compress_streams=False and no explicit stream_decode_level. qpdf 11.10
changed its default stream decode level to generalized, which caused such
saves to decompress (without recompressing) streams and balloon the output
file. pikepdf now pins the decode level to none in this case, restoring the
documented behavior that compress_streams=False alone does not trigger
decompression. Fixes {issue}676.
The minimum required qpdf version is now 12.3.2. The new
{meth}pikepdf.AcroForm.validate binding calls qpdf's
QPDFAcroFormDocumentHelper::validate, which was added in qpdf 12.3.0, so
pikepdf no longer builds against older qpdf releases.

Documentation

Documented a long-standing page-deletion pitfall: deleting a page unlinks it
from the page tree, but a page that is still referenced by an outline
(bookmark), link annotation, or named destination remains in the saved file.
The {ref}Deleting pages <deleting_pages> topic now explains the behavior and
gives workarounds. Thanks to m-holger. Closes {issue}196.
Documented how to copy metadata between documents, in a new
{ref}Copying metadata between documents <copymetadata> topic, including why
blindly copying all fields (or the raw XMP stream) can import false conformance
claims and identifiers. Closes {issue}188.

Fixed build to continue generating Python version specific wheels for
3.12 and 3.13 due to open issue in nanobind. Fixes :issue:723. Thanks
@mgorny for reporting.
Improved CI build to perform more detailed tests using python3-dbg (debug
build) which has more assertions and would have uncovered this issue.

`v10.7.0`

Compare Source

`v10.6.0`

Compare Source

Released v10.6.0 with version bump only.

`v10.5.1`

Compare Source

`v10.5.0`

Compare Source

Fixed logger in ctm module using __file__ instead of __name__,
which produced unhelpful log names. :issue:712
Modernized README.
Test all README code blocks instead of just one.