CI currently fails make vulncheck on reachable calls from internal/imageinput/pdf.go to github.com/ledongthuc/pdf (pdf.NewReader and Reader.GetPlainText). The Go vulnerability database reports no fixed version for this fork, so a dependency version bump cannot remediate it. Replace the PDF text-extraction implementation with a maintained non-affected alternative, preserve extraction/page-count behavior, add hostile-PDF resource-limit coverage, and verify make vulncheck is clean.
CI currently fails
make vulncheckon reachable calls frominternal/imageinput/pdf.gotogithub.com/ledongthuc/pdf(pdf.NewReaderandReader.GetPlainText). The Go vulnerability database reports no fixed version for this fork, so a dependency version bump cannot remediate it. Replace the PDF text-extraction implementation with a maintained non-affected alternative, preserve extraction/page-count behavior, add hostile-PDF resource-limit coverage, and verifymake vulncheckis clean.