What's new

Security (SEC)

• Limit iterations for outline retrieval and XForm text extraction (#3966) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Detect cycles in TreeObject.insert_child (#3964) by @stefan6419846

New Features (ENH)

• AppearanceStream: Allow arbitrary rotations and apply rotations for annotation appearance streams (#3917) by @PJBrs
• AppearanceStream: Consider more encodings for Type1 core fonts (#3905) by @PJBrs

Performance Improvements (PI)

• Build /ToUnicode source-code bytes directly in parse_bfrange (#3952) by @Anai-Guo

Bug Fixes (BUG)

• Preserve internal Link annotations when appending/merging (#3953) (#3954) by @Anai-Guo
• Fix false inline image end markers (#3922) by @ciphercom
• Reject typeless non-page /Kids entries in strict mode (#3955) by @Anai-Guo
• Apply character spacing (Tc) per glyph in layout-mode extraction (#3951) by @Anai-Guo
• Keep the Adobe CMYK inversion when an explicit /Decode is present (#3943) by @RavSinghChandan

Robustness (ROB)

• AppearanceStream: Only escape parentheses for 8-bit fonts (#3961) by @PJBrs
• Recover the trailer from a cross-reference stream when rebuilding the xref (#3950) by @Anai-Guo

Maintenance (MAINT)

• Deduplicate CatalogAttributes and CatalogDictionary (#3940) by @j-t-1

Code Style (STY)

• Type pages as a Sequence rather than a list (#3957) by @RavSinghChandan

Full Changelog

What's new

Security (SEC)

• Improve performance of read_until_whitespace (#3947) by @stefan6419846
• Limit CID width range and width count when loading fonts (#3946) by @stefan6419846
• Limit token length for ToUnicode entries (#3944) by @stefan6419846

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#3897) by @stefan6419846

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#3901) by @PJBrs
• Allow keeping original PDF header in non-incremental clone mode (#3918) by @pctablet505
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831) by @PJBrs
• Add actions base class (#3552) by @j-t-1

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#3938) by @RavSinghChandan
• Decode low-bit DeviceRGB images as RGB instead of palette (#3929) by @RavSinghChandan
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#3937) by @stefan6419846

Documentation (DOC)

• Image and attachment filenames are unsanitized (#3942) by @stefan6419846

Maintenance (MAINT)

• Update charset mappings (#3935) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (#3892) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Detect end of stream during inline image end marker detection (#3891) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Apply general limit for requested image size (#3888) by @stefan6419846
• Speed up recovery when reading broken cross-reference table (#3887) by @stefan6419846

New Features (ENH)

• Check whether image is displayed on a given page (#3738) by @andreasntr

Robustness (ROB)

• Several fixes by @metsw24-max

Full Changelog

What's new

Security (SEC)

• Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#3871) by @stefan6419846

Performance Improvements (PI)

• Avoid per-pixel getpixel loop for 1-bit indexed images (#3854) by @Samuel-Harris

Robustness (ROB)

• Several fixes by @metsw24-max

Maintenance (MAINT)

• Make mypy assert messages consistent (#3849) by @j-t-1

Full Changelog

What's new

Security (SEC)

• Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#3847) by @fredericoschardong

Robustness (ROB)

• Fix UnboundLocalError in _read_standard_xref_table on a malformed entry (#3841) by @joszamama
• Raise PdfStreamError on non-hexadecimal bytes in hex readers (#3832) by @metsw24-max

Full Changelog

What's new

Security (SEC)

• Prevent infinite loops when processing threads/articles (#3839) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Avoid infinite loops for outlines and text extraction (#3830) by @stefan6419846

New Features (ENH)

• Add Japanese predefined CMaps (#3800) by @yasuhiroiwaki
• Font: Collect all character widths, not only those that can be unicode mapped (#3798) by @PJBrs

Robustness (ROB)

• Recover a corrupt trailing startxref pointer (closes #3238) (#3826) by @gaoflow
• Handle /Pages node without /Kids during flattening (#3825) by @gaoflow
• Accept inline image EI marker at the end of a content stream (#3827) by @gaoflow

Maintenance (MAINT)

• Type the always-raising deprecation helpers as NoReturn (#3819) by @estelledc

Full Changelog