)

Closes #3667.

For V>=5 PDFs, the encryption key is used directly without
MD5. MD5 computation in _make_crypt_filter() only runs for V<=4,
allowing AES-256 encrypted PDFs to be read on FIPS-enabled systems where
hashlib.md5() is blocked.

RC4 and AES-128 encrypted PDFs will still correctly fail on FIPS
systems, as their key requires MD5.

)

The batch-parse optimization (added in #3677) caches every object
found when decompressing an object stream. The guard intended to
skip overridden objects checked `obj_num in self.xref_objStm`, but
this passes for any compressed object — not just ones that belong
to the current stream.

In incrementally-updated PDFs, the same object can appear in
multiple object streams across revisions (per the PDF 1.7 spec,
§7.5.6). The xref designates one stream as authoritative.
Decompressing a stale stream (e.g. to read a co-located AcroForm
dict) would cache the old version of the object, shadowing the
current one.

Fix: only cache when `xref_objStm` points the object at the stream
being decompressed.

Closes #3697.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Additionally removes the handling for incorrectly padded inputs - these
files are most likely not valid and it would be unexpected to let them
pass without further notice.

PdfWriter.compress_identical_objects ignored remove_orphans. Correct for this.

Also deprecate_with_replacement remove_orphans to remove_unreferenced and remove_identicals to remove_duplicates. This makes the naming more obvious.

Closes #3306.

---------

Co-authored-by: Stefan <96178532+stefan6419846@users.noreply.github.com>

See upstream issue pypy/pypy#5388

Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.5 to 46.0.6.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.5...46.0.6)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

)

Some PDF producers (e.g. Vectorizer.AI) insert legal PDF comments
(% to end of line) between the last xref table entry and the
`trailer` keyword.  The `_read_standard_xref_table` method did not
skip comments at this position, causing it to misparse the `%`
character and ultimately raise `PdfReadError: Could not read Boolean
object`.

The fix adds a loop after reading xref entries that calls
`skip_over_comment()` to consume any comment lines before checking
for the `trailer` tag.  This is consistent with PDF spec §7.2.3
which allows comments anywhere except inside strings or streams.

Some parts of this policy have been derived from https://github.com/astral-sh/.github/blob/main/AI_POLICY.md

#3660)

Relates to #3591.

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 6.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5...v6)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.6 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.6...46.0.7)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

While *libexpat* already handled the more severe cases, it has still
been possible to cause rather high memory usage. For this reason,
disallow entity declarations completely.

I decided against *defusedxml* for now, as I do not see the benefit of
including an untyped external package for something this small,
especially considering that the public maintenance status does not look
very promising.

## What's new

### Security (SEC)
- Disallow custom XML entity declarations for XMP metadata (#3724) by @stefan6419846

### New Features (ENH)
- Skip MD5 key derivation for AES-256 encrypted PDFs (#3694) by @Ygnas

### Bug Fixes (BUG)
- Use remove_orphans in compress_identical_objects (#3310) by @j-t-1
- Fix PdfReadError when xref table contains comments before trailer (#3710) by @rassie
- Correctly verify AES padding during decryption (#3699) by @stefan6419846
- Fix stale object cache from non-authoritative object streams (#3698) by @astahlman
- Fix extract_links pairing when annotations include non-links (#3687) by @ReinerBRO

### Documentation (DOC)
- Add AI policy (#3717) by @stefan6419846

[Full Changelog](6.9.2...6.10.0)