What the developer wrote
Authored by Craig Raw
upgrade openpdf to v1.3.43
What changed, and why it matters
This commit simply bumps the version of a PDF library called OpenPDF from 1.3.30 to 1.3.43 in the project's build file. It is a routine dependency update. The commit itself does not say why the upgrade was made, and no security advisory or vulnerability details are provided. It may include bug or security fixes from the newer OpenPDF release, but that cannot be confirmed from this change alone.
Review the OpenPDF 1.3.31 through 1.3.43 release notes and changelog for any security fixes. If any CVEs affect versions before 1.3.43, assess whether Sparrow uses the vulnerable functionality (e.g., PDF parsing, font handling, image processing) and consider this commit a security fix. Otherwise, treat it as routine maintenance.
Security signals we found
Dependency version bump for a library commonly involved in PDF parsing/rendering vulnerabilities
No explicit security rationale in commit message or diff
No CVE, advisory, or changelog reference included in commit
Evidence from the diff
The commit changes a single line in build.gradle, updating the OpenPDF dependency from version 1.3.30 to 1.3.43. OpenPDF is a Java PDF library used for generating and manipulating PDF documents. The diff shows no code changes, no patch details, and no explanation of what issues the upgrade addresses. Without external references, we cannot determine whether this is a security-related fix, a compatibility update, or a general maintenance bump.
Changed components
build.gradle dependency declarationOpenPDF library (com.github.librepdf:openpdf)Inspect captured patch +1 / −1
diff --git a/build.gradle b/build.gradle
index 5b750a5..8ac2574 100644
--- a/build.gradle
+++ b/build.gradle
@@ -104,7 +104,7 @@ dependencies {
implementation('org.apache.commons:commons-lang3:3.19.0')
implementation('org.apache.commons:commons-compress:1.27.1')
implementation('net.sourceforge.streamsupport:streamsupport:1.7.0')
- implementation('com.github.librepdf:openpdf:1.3.30')
+ implementation('com.github.librepdf:openpdf:1.3.43')
implementation('com.googlecode.lanterna:lanterna:3.1.3')
implementation('net.coobird:thumbnailator:0.4.18')
implementation('com.github.hervegirod:fxsvgimage:1.1')
Why this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.