From 65e40daf9a73cdf268d3f0247ffc5814f97006d4 Mon Sep 17 00:00:00 2001
From: "riseproject-dev[bot]"
 <330740410+riseproject-dev[bot]@users.noreply.github.com>
Date: Sun, 27 Sep 2026 07:41:52 +0000
Subject: [PATCH 1/2] pikepdf: Add version 10.14.0

Signed-off-by: riseproject-dev[bot] <330740410+riseproject-dev[bot]@users.noreply.github.com>
---
 docs/packages/pikepdf.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/packages/pikepdf.yaml b/docs/packages/pikepdf.yaml
index ba487dcb9b5..9db82920bff 100644
--- a/docs/packages/pikepdf.yaml
+++ b/docs/packages/pikepdf.yaml
@@ -32,3 +32,4 @@ versions:
   - filename: pikepdf-10.13.0.post1-cp314-cp314t-manylinux_2_39_riscv64.whl
     sha256: 915d7e2af38b9b565419340912c41d84f5a2f084e9a731fddab9aa3e1bcd942d
     requires-python: '>=3.10'
+- version: 10.14.0

From fbfb969787c085c386889b5c74bb7d3ebdf7fe16 Mon Sep 17 00:00:00 2001
From: Ludovic Henry <git@ludovic.dev>
Date: Sun, 27 Sep 2026 09:10:22 +0000
Subject: [PATCH 2/2] pikepdf: Read the qpdf pin from upstream's pyproject.toml

pikepdf 10.14.0 raised QPDF_VERSION/QPDF_MIN_VERSION to 12.4.1 and binds
qpdf_param_e entries (tiff_max_memory, ...) that 12.3.2 lacks, so the
hardcoded 12.3.2 in CIBW_ENVIRONMENT broke every wheel. Take the values
from the checked-out pyproject.toml so each version builds against the
qpdf it pins.
---
 .github/workflows/build-pikepdf.yml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-pikepdf.yml b/.github/workflows/build-pikepdf.yml
index c2a851638f1..33530dd0b46 100644
--- a/.github/workflows/build-pikepdf.yml
+++ b/.github/workflows/build-pikepdf.yml
@@ -64,6 +64,16 @@ jobs:
           ref: v${{ env.PIKEPDF_VERSION }}
           persist-credentials: false
 
+      - name: Read upstream qpdf pin
+        run: |
+          python3 - >> "$GITHUB_ENV" <<'EOF'
+          import tomllib
+          with open("pyproject.toml", "rb") as f:
+              env = tomllib.load(f)["tool"]["cibuildwheel"]["environment"]
+          for key in ("QPDF_MIN_VERSION", "QPDF_VERSION", "QPDF_PATTERN"):
+              print(f"{key}={env[key]}")
+          EOF
+
       - name: Build wheels
         uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         with:
@@ -73,11 +83,12 @@ jobs:
           CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
           # CIBW_ENVIRONMENT replaces, not merges, upstream's [tool.cibuildwheel.environment]
           # table, so QPDF_* (consumed by before-all's build-scripts/*.bash) must be repeated
-          # alongside our registry (CLAUDE.md gotcha 107).
+          # alongside our registry (CLAUDE.md gotcha 107); they are read from the checked-out
+          # pyproject.toml so each pikepdf version builds against the qpdf it pins.
           CIBW_ENVIRONMENT: >-
-            QPDF_MIN_VERSION=12.3.2
-            QPDF_VERSION=12.3.2
-            QPDF_PATTERN=https://github.com/qpdf/qpdf/releases/download/vVERSION/qpdf-VERSION.tar.gz
+            QPDF_MIN_VERSION=${{ env.QPDF_MIN_VERSION }}
+            QPDF_VERSION=${{ env.QPDF_VERSION }}
+            QPDF_PATTERN=${{ env.QPDF_PATTERN }}
             PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
           # hypothesis switched its build backend to maturin; newer releases have no
           # riscv64 wheel anywhere, and maturin's rustup auto-install does not support