Repository navigation
Fullbleed 2.5.24: hidden HTML text stays hidden
Fullbleed 2.5.24 fixes hidden HTML text leaking into PDFs. Script and style elements are now hidden by default, and ordinary display:none descendants stay hidden in paragraphs, preformatted text, lists, captions, and table cells.
Previously, <p>Before</p><script>SOURCE_SENTINEL</script><p>After</p> printed the script source between the paragraphs. It now produces the same PDF as the visible-content control with that element removed.
| 2.5.23 | 2.5.24 |
|---|---|
 |
 |
Author CSS can still deliberately show source with display:inline, block, or contents. display:revert restores the default display value, including hidden script/style elements. Whitespace and plain-text table-cell layout are preserved around hidden children. Fullbleed does not execute scripts or apply embedded stylesheets. No runtime dependency is added.
The release passes 1,363 Rust library tests, 11 documentation tests, all 595 Python tests, and Windows/Linux CI. The new regression gate covers 94 HTML/CSS pairs in four rendering modes: 376 checks, 752 PDFs, and 1,128 pages. It checks exact visible-content controls, independent text extraction, native/PDFium pixels, and deterministic replay. The local candidate, both CI platforms, and a fresh public Python installation reproduce identical PDFs and Fullbleed native preview hashes. PDFium source/control pixels match within each platform; its separate cross-platform raster differences are retained. A fresh default-feature crates.io consumer reproduces all 376 direct/compiled PDFs.
Published 2.5.23 fails 77 of the 94 direct cases. All 94 control PDFs and the 17 previously correct source PDFs remain unchanged. An independent browser reference agrees with the visible text for all 94 controls; browser pixel parity is not asserted.
The unchanged 1,662-fixture source corpus reports 1,619 PASS, 25 FAIL, and 18 REFERENCE-DISPUTED. Every corpus PDF is byte-identical to the retained 2.5.23 run. Inputs, references, and comparator policy are fixed, and the existing failed gate is retained. These checks do not establish complete CSS parity or PDF standards conformance. The unavailable dedicated PDF/VT validator remains skipped. Node and .NET retain their separately verified engine pins.