Update to BentoPDF v2.8.7 (security) + SDK 2.0.9 - #2
Merged
Conversation
Bump upstream bentopdf-simple v2.8.4 → v2.8.7, a security release fixing three GHSAs affecting all versions ≤ v2.8.6. The three bundled WASM libraries (PyMuPDF 0.11.16, Ghostscript 0.1.1, CoherentPDF 2.5.5) and their CDN URL shapes are unchanged at v2.8.7, so the rewrite-wasm-urls oneshot is unaffected — verified against the built image (no jsdelivr URLs survive the rewrite). Package version 2.8.4:1 → 2.8.7:0. Bump @start9labs/start-sdk 2.0.5 → 2.0.9 (no breaking changes affect this package). Refresh the local s9pk.mk from SDK 2.0.9, fixing the stale scaffold copy: 'make install' now uses 'start-cli s9pk select' instead of parsing a no-longer-present ~/.startos/config.yaml, 'make publish' is simplified likewise, check-deps gains git/jq, GIT_DEPS tolerates a missing git index, and the SDK lint gate now runs (clean on this package). Verified: tsc + SDK lint clean, both arches pack (sdkVersion 2.0.9, version 2.8.7:0), WASM rewrite oneshot verified against the built v2.8.7 image. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates BentoPDF to v2.8.7 (a security release), bumps the StartOS SDK to 2.0.9, and refreshes the stale build plumbing.
Upstream — BentoPDF v2.8.4 → v2.8.7
v2.8.7 fixes three security advisories (
GHSA-wh78-rcw2-hhg9,GHSA-5xjf-rr5x-pcfj,GHSA-cx8x-7rrr-r9x8) affecting all versions ≤ v2.8.6 — upgrading is strongly recommended. It also carries the v2.8.5/v2.8.6 improvements (custom rotate, alternate/mix pages, split-PDF refactor, multi-tool drag-and-drop, OCR/HEIC/email fixes).Only the Dockerfile
FROMtag changes: the three bundled WASM libraries (PyMuPDF 0.11.16, Ghostscript 0.1.1, CoherentPDF 2.5.5) and their CDN URL shapes are identical at v2.8.7, so therewrite-wasm-urlsoneshot is unaffected. Package version2.8.4:1→2.8.7:0.SDK 2.0.5 → 2.0.9
No breaking changes affect this package (the 2.0.6–2.0.9 entries are build fixes plus
getBridgeAddress/backup-hook helpers this package doesn't use).Build plumbing
Refreshes the local
s9pk.mkfrom SDK 2.0.9, fixing a stale scaffold copy:make installnow usesstart-cli s9pk select(the old copy parsed a~/.startos/config.yamlpath that no longer exists),make publishis simplified likewise,check-depsgains git/jq,GIT_DEPStolerates a missing git index, and the SDK lint gate now runs.Verification
tsc+ SDK lint clean under SDK 2.0.9 / TS 6.0.3sdkVersion 2.0.9,version 2.8.7:0sedrewrites all of them to local/wasm/...paths with none surviving🤖 Generated with Claude Code