3 Releases 3 Tags

• v0.1.1 ac6d57562b

  Compare

  bau-pm-pdf-tools v0.1.1 Pre-Release

  magdev released this 2026-10-24 08:28:24 +00:00 | 2 commits to main since this release

  The same BentoPDF on current packages. Nothing in this repository's own code changed; what changed is that a build no longer ships whatever base image the runner happened to have cached, so this image carries nginx 1.31.8 where v0.1.0 carried 1.31.6. Out of bau-pm's v0.22.3 security review.

  Security

  • The CI and release builds pull their base images fresh (docker build --pull). Both bases are floating tags, so what shipped was whatever the runner had cached: v0.1.0 went out with nginx 1.31.6 while the tag had already moved to 1.31.8, past five October CVEs. None of the five is reachable in a static file server configured like this one, which is why this is the fix rather than a pin. From bau-pm's v0.22.3 security review, finding 41 (bau-pm BAU-191). A release is what applies it - the running image does not change until one is cut.

  Changed

  • The image is built on the current node:20-alpine and nginx-unprivileged:alpine-slim, which is where the operating-system packages under BentoPDF come from. BentoPDF itself is unchanged: still v2.8.8 at the same pinned commit, the same vendored modules at the same integrity hashes, the same two tools disabled.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)