Version 7.0.0, 2026-11-06

What's new

Security (SEC)

• Make file identifiers non-deterministic (#4366) by @stefan6419846
• Block not strictly increasing offsets in object streams (#4364) by @stefan6419846
• Limit XFA form decoding work (#4363) by @stefan6419846
• Apply image size limits more strictly (#4361) by @stefan6419846

Deprecations (DEP)

• Cleanup deprecations for the next major release (#4306) by @stefan6419846
• Remove support for cryptography<43 (#4304) by @stefan6419846
• Drop support for Python 3.9 (#4292) by @stefan6419846

New Features (ENH)

• Allow setting border color for rectangle annotations (#4297) by @Ak4shh

Performance Improvements (PI)

• Speed up LZW decoding for clear table markers (#4354) by @stefan6419846
• Build right-to-left text runs with a single join (#4344) by @kholdrex
• Read every page label number tree once for all pages (#4321) by @kholdrex
• Decode the PNG Up predictor a row at a time (#4312) by @MartinThoma

Bug Fixes (BUG)

• Fix cloning of objects that require constructor arguments (#4262) by @Ak4shh
• Serialize XMP packets without an XML declaration (#4296) by @Ak4shh

Maintenance (MAINT)

• Generate Symbol and ZapfDingbats encodings from Adobe sources (#4333) by @plenaerts

Full Changelog

Version 6.21.4, 2026-10-28

What's new

Security (SEC)

• Limit the number of copied page attributes during flattening (#4290) by @stefan6419846
• Detect EOF when reading standard xref table trailer (#4289) by @stefan6419846
• Fix loop detection when cloning DictionaryObject (#4288) by @stefan6419846

Documentation (DOC)

• Exclude performance issues from security reports (#4280) by @stefan6419846

Full Changelog

Version 6.21.3, 2026-10-27

What's new

Security (SEC)

• Use the validated page count after decrypting a document (#4270) by @stefan6419846
• Limit total number of cross-reference stream entries (#4269) by @stefan6419846
• Avoid excessive error messages (#4265) by @stefan6419846

Performance Improvements (PI)

• Read flat page label number trees once for all pages (#4251) by @kholdrex
• Collect the named destinations once when resolving links (#4249) by @MartinThoma
• Avoid scanning all objects in get_outline_root (#4245) by @kholdrex

Bug Fixes (BUG)

• Resolve indirect widths in CID font /W arrays (#4267) by @tim-hilde

Documentation (DOC)

• Block incremental writes of encrypted documents (#4246) by @metsw24-max

Developer Experience (DEV)

• Update to PyPy 3.12 and pinned requirements (#4244) by @stefan6419846

Maintenance (MAINT)

• Revert: Reject unsupported key lengths in the /Encrypt dictionary by @stefan6419846

Full Changelog

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

• Avoid repeated full file loads (#4240) by @stefan6419846
• Limit size of standard xref table (#4239) by @stefan6419846

Bug Fixes (BUG)

• Decode UniGB-UTF16 CMaps as UTF-16BE (#4231) by @4444wjt
• Keep 8-bit DeviceRGB image mode (#4230) by @DGrutt
• Preserve all annotation quadrilaterals when merging pages (#4223) by @repzakske

Robustness (ROB)

• Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

What's new

Security (SEC)

• Only open /DCTDecode image data with the Pillow JPEG plugin (#4222) by @metsw24-max

Full Changelog

Version 6.21.0, 2026-10-16

What's new

Security (SEC)

• Improve performance and limit field work (#4219) by @stefan6419846
• Limit stream parsing work (#4218) by @stefan6419846

New Features (ENH)

• Allow custom fit modes for named destinations (#4181) by @JackyHsu-X

Bug Fixes (BUG)

• Treat NUL as whitespace in ArrayObject (#4198) by @Zephyr761
• Avoid overwriting unread objects in add_form_topname (#4190) by @tigger0jk
• Read an indirect page box on a writer page (#4179) by @usmanmateen

Full Changelog

Version 6.20.1, 2026-10-12

What's new

Security (SEC)

• Prevent cyclic tree handling (#4188) by @stefan6419846

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158) by @yaourtv

Full Changelog

Version 6.20.0, 2026-10-09

What's new

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173) by @stefan6419846

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168) by @stefan6419846

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164) by @marshalltech81
• Parse numbers, indirect references, names and nulls faster (#4148) by @MartinThoma
• Do not inherit PdfObject from a Protocol (#4149) by @MartinThoma
• Speed up cloning direct objects (#4152) by @MartinThoma

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154) by @pasmud
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151) by @metsw24-max

Robustness (ROB)

• Multiple changes by @RavSinghChandan
• Accept an %%EOF marker that is not at the start of a line (#4136) by @Dmao233
• Font / _cmapy.py: More robust guards around fontTools (#4157) by @PJBrs
• Flatten the page tree iteratively (#4107) by @MartinThoma
• Ignore invalid character codes for TrueType and Type1 font widths (#4117) by @stefan6419846
• Restrict values to allowed range in CCITTFaxDecode (#4115) by @stefan6419846
• Drop a /Kids entry resolving to null instead of raising a cycle error (#4108) by @MartinThoma

Developer Experience (DEV)

• Declare official support for Python 3.15 by @stefan6419846
• Declare protocol data members on PdfReader and PdfWriter (#4106) by @ihsandeniz

Full Changelog

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

• Limit size of alphabetical page labels (#4096) by @stefan6419846

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979) by @j-t-1

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087) by @stefan6419846
• Reduce number of full data lookups for attachment mapping API (#4081) by @stefan6419846

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078) by @anandghegde
• Use page reference for existing internal link targets (#4076) by @r-kamei
• Arabic-Indic digits are reversed during text extraction (#4077) by @Syamjith-NK
• Parse a string rect for add_uri into a rectangle (#4074) by @RavSinghChandan

Full Changelog

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

• Further restrict FlateDecode recovery (#4073) by @stefan6419846
• Limit entry count for TrueType and Type1 font /Widths (#4072) by @stefan6419846
• Limit allowed length of tokens in parse_bfchar (#4071) by @stefan6419846

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062) by @r-kamei
• Repeat the letter for /S /A and /S /a page labels past Z (#4065) by @youdie006
• Use font color for FreeText default appearance (#4051) by @Yuki9814

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059) by @MeggyCal and @stefan6419846

Documentation (DOC)

• Use combined matrix in visitor examples (#4066) by @r-kamei

Full Changelog