Version 6.18.1, 2026-09-11

What's new

Security (SEC)

• Further restrict FlateDecode recovery (#4073) by @stefan6419846
• Limit entry count for TrueType and Type1 font /Widths (#4072) by @stefan6419846
• Limit allowed length of tokens in parse_bfchar (#4071) by @stefan6419846

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062) by @r-kamei
• Repeat the letter for /S /A and /S /a page labels past Z (#4065) by @youdie006
• Use font color for FreeText default appearance (#4051) by @Yuki9814

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059) by @MeggyCal and @stefan6419846

Documentation (DOC)

• Use combined matrix in visitor examples (#4066) by @r-kamei

Full Changelog