Unpin pdf-extract once the typst text-extraction regression is fixed

[padamson]

Background

pdf-extract is held at 0.10 as a dev-dependency (the PDF-verification
test harness, tests/pdf_callouts.rs). The bump to 0.12 — which pulls
the patched lopdf >=0.42 and so clears advisory RUSTSEC-2026-0187 —
regresses text extraction on typst-generated PDFs: glyphs come back
under a substitution cipher (e.g. the → TSk), because 0.12 mishandles
the ToUnicode CMap of typst's subsetted fonts. That breaks the test's
content assertions.

Verified on the byte-identical book PDF: 0.10 extracts clean and passes;
0.12 garbles and fails.

Since lopdf is reachable only through this dev-dependency and only ever
parses our own trusted typst PDF (never untrusted input), the advisory has
no real exposure, so we suppressed it rather than take the breaking bump.
See 1bfd577.

Current holds (all need removing once upstream is fixed)

• deny.toml — [advisories] ignore = ["RUSTSEC-2026-0187"]
• .cargo/audit.toml — same advisory ignore (for bare cargo audit)
• .github/dependabot.yml — ignore: pdf-extract under the cargo ecosystem
• Cargo.toml — pdf-extract = "0.10" pin

Done-when

pdf-extract ships a release that pulls lopdf >=0.42 and extracts
typst PDF text correctly (or we switch the test to a different extractor).
At that point: bump pdf-extract, drop all four holds above, and confirm
tests/pdf_callouts.rs -- --ignored passes.

Related

Supersedes dependabot PR #30 (the bump we declined).

[padamson]

Diagnosed and fixed upstream.

Root cause: not a lopdf bug. pdf-extract 0.12 moved its font_table cache from a per-page local to a Processor field that persists across the whole document. The cache is keyed by font-resource name (/F0, /F1, …), which is only unique within a page — typst reassigns those names per page — so a name resolved on one page gets reused on a later page that maps it to a different font, decoding that page's text through the wrong /ToUnicode CMap (the substitution-cipher output we saw).

• Minimal repro: https://github.com/padamson/pdf-extract-typst-repro
• Upstream issue: Text extraction regressed in 0.12: font cache persists across pages, reusing resource names jrmuizel/pdf-extract#151
• Upstream PR (one line, font_table.clear() per page): Reset font cache per page to fix cross-page resource-name reuse jrmuizel/pdf-extract#152

Unpin when PR #152 lands in a pdf-extract release above 0.12.0. To unblock before then, the dev-dep can point at the fork branch padamson/pdf-extract@fix/per-page-font-cache (a git dep pulls lopdf 0.42, so the RUSTSEC-2026-0187 suppressions can come out too).

Holds to remove on unpin: Cargo.toml:28, .cargo/audit.toml:12, deny.toml:21, .github/dependabot.yml (the pdf-extract ignore).