Prerelease Considerations

Prerelease Considerations

⚠️ n8PDF is in alpha testing. Do not use it in production, and do not feed it user-supplied .docx files until more testing is complete.

What "alpha" means here

The library builds, the suite passes, and the fidelity numbers on Matching Word are real — but none of that adds up to production readiness yet:

• It has never shipped. There is no published NuGet package (#61), no released version, and therefore no version anybody has run in anger. The API surface (The API) is intended to be stable, but until a v1.0.0 tag is cut it promises nothing.
• Hardening against hostile input is in progress, not done. The project's own audits have filed roughly eighty still-open findings — unbounded allocations, integer overflows, unbounded recursion, hang loops — concentrated in the image decoders, the font parsers, and the document parsers. The register is public and honest: see Security.
• There is no fuzzing corpus yet (#71). The attacks that have been fixed were each built as a test, but nothing has systematically searched for the ones nobody thought of.
• The full Word comparison runs on one machine. Hosted CI covers 69 of the 143 comparison fixtures; the rest need faces only Word ships (Validation). A green CI is not the whole story.

Do not use with user-supplied documents

This is the sharp edge, stated as plainly as the Security page states it: a .docx is attacker-controlled input, and the open findings mean a crafted one can currently exhaust memory, hang a conversion, or kill the process outright (a stack overflow in .NET is not catchable). The failure modes are denial-of-service-shaped rather than code execution — the library is pure managed code with no unsafe — but a service that converts documents from the public is exactly the deployment those findings bite.

Until the hardening epics (#49–#56 and the parser/font findings) close and a fuzzing pass has run:

• Convert only documents you or your organisation authored — trusted input, produced by Word or by tooling you control.
• If you must experiment with third-party documents, do it the way the Security guidance describes anyway: a throwaway worker process, an OS-level memory cap, a timeout, and Limits set tight — and treat that as reducing the blast radius, not making it safe.

Acceptable uses today

• Evaluation, prototyping, and fidelity testing against your own document corpus
• Internal tooling over trusted, self-authored documents, with the caveats above understood
• Contributing — testing on real documents you own and filing what breaks is exactly the help the project needs (Developers)

When this page changes

This warning is expected to soften in stages, not vanish at once: a published package and a tagged release first, then the hostile-input epics closing, then a fuzzing corpus. Watch the issue tracker — the open security label and the release issue are the honest signal of where things stand, and this page will be updated as they close.