From 2e3ee24318eb0bb4977addeed337f0bd31ac4e57 Mon Sep 17 00:00:00 2001
From: hisayya <128133846+hisayya@users.noreply.github.com>
Date: Sat, 15 Aug 2026 16:39:18 +0000
Subject: [PATCH] fix: pin lopdf to 0.42.0 to close RUSTSEC-2026-0187

pdf-inspector transitively depends on lopdf. Versions <0.42.0 are
vulnerable to RUSTSEC-2026-0187: a crafted PDF with a deeply nested
catalog array (~21KB) causes a stack overflow and aborts the process
with an uncatchable SIGABRT (CVSS 3.1 7.5, remote DoS on untrusted
PDF input).

pdf-inspector 1.14.2 already resolves lopdf 0.42.0, but pinning the
transitive dependency explicitly guards against resolution
regressions and makes the patched version constraint visible to
auditors (osv-scanner, cargo-audit).

Refs: https://rustsec.org/advisories/RUSTSEC-2026-0187.html
---
 Cargo.lock | 1 +
 Cargo.toml | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index a01c9140..3dbdac97 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -98,6 +98,7 @@ dependencies = [
  "flate2",
  "insta",
  "log",
+ "lopdf",
  "pdf-inspector",
  "quick-xml",
  "sha2 0.11.0",
diff --git a/Cargo.toml b/Cargo.toml
index 04ed82f8..a213ef07 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,6 +29,10 @@ flate2 = "1"
 encoding_rs = "0.8.35"
 log = "0.4"
 pdf-inspector = "1.14.2"
+# RUSTSEC-2026-0187: pdf-inspector -> lopdf <0.42.0 is vulnerable to a stack
+# overflow DoS via deeply nested PDF objects (SIGABRT, not catchable). Pin the
+# transitive dependency to the patched version to prevent resolution regressions.
+lopdf = "0.42.0"
 quick-xml = "0.41.0"
 zip = { version = "8.6.0", default-features = false, features = ["deflate"] }