Version 6.20.0, 2026-10-09

What's new

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173) by @stefan6419846

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168) by @stefan6419846

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164) by @marshalltech81
• Parse numbers, indirect references, names and nulls faster (#4148) by @MartinThoma
• Do not inherit PdfObject from a Protocol (#4149) by @MartinThoma
• Speed up cloning direct objects (#4152) by @MartinThoma

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154) by @pasmud
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151) by @metsw24-max

Robustness (ROB)

• Multiple changes by @RavSinghChandan
• Accept an %%EOF marker that is not at the start of a line (#4136) by @Dmao233
• Font / _cmapy.py: More robust guards around fontTools (#4157) by @PJBrs
• Flatten the page tree iteratively (#4107) by @MartinThoma
• Ignore invalid character codes for TrueType and Type1 font widths (#4117) by @stefan6419846
• Restrict values to allowed range in CCITTFaxDecode (#4115) by @stefan6419846
• Drop a /Kids entry resolving to null instead of raising a cycle error (#4108) by @MartinThoma

Developer Experience (DEV)

• Declare official support for Python 3.15 by @stefan6419846
• Declare protocol data members on PdfReader and PdfWriter (#4106) by @ihsandeniz

Full Changelog