Version 6.15.0, 2026-08-06

What's new

Security (SEC)

• Improve performance of read_until_whitespace (#3947) by @stefan6419846
• Limit CID width range and width count when loading fonts (#3946) by @stefan6419846
• Limit token length for ToUnicode entries (#3944) by @stefan6419846

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#3897) by @stefan6419846

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#3901) by @PJBrs
• Allow keeping original PDF header in non-incremental clone mode (#3918) by @pctablet505
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831) by @PJBrs
• Add actions base class (#3552) by @j-t-1

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#3938) by @RavSinghChandan
• Decode low-bit DeviceRGB images as RGB instead of palette (#3929) by @RavSinghChandan
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#3937) by @stefan6419846

Documentation (DOC)

• Image and attachment filenames are unsanitized (#3942) by @stefan6419846

Maintenance (MAINT)

• Update charset mappings (#3935) by @stefan6419846

Full Changelog

Version 6.14.2, 2026-06-23

What's new

Security (SEC)

• Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (#3892) by @stefan6419846

Full Changelog

Version 6.14.1, 2026-06-23

What's new

Security (SEC)

• Detect end of stream during inline image end marker detection (#3891) by @stefan6419846

Full Changelog

Version 6.14.0, 2026-06-22

What's new

Security (SEC)

• Apply general limit for requested image size (#3888) by @stefan6419846
• Speed up recovery when reading broken cross-reference table (#3887) by @stefan6419846

New Features (ENH)

• Check whether image is displayed on a given page (#3738) by @andreasntr

Robustness (ROB)

• Several fixes by @metsw24-max

Full Changelog

Version 6.13.3, 2026-06-17

What's new

Security (SEC)

• Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#3871) by @stefan6419846

Performance Improvements (PI)

• Avoid per-pixel getpixel loop for 1-bit indexed images (#3854) by @Samuel-Harris

Robustness (ROB)

• Several fixes by @metsw24-max

Maintenance (MAINT)

• Make mypy assert messages consistent (#3849) by @j-t-1

Full Changelog

Version 6.13.2, 2026-06-10

What's new

Security (SEC)

• Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#3847) by @fredericoschardong

Robustness (ROB)

• Fix UnboundLocalError in _read_standard_xref_table on a malformed entry (#3841) by @joszamama
• Raise PdfStreamError on non-hexadecimal bytes in hex readers (#3832) by @metsw24-max

Full Changelog

Version 6.13.1, 2026-06-08

What's new

Security (SEC)

• Prevent infinite loops when processing threads/articles (#3839) by @stefan6419846

Full Changelog

Version 6.13.0, 2026-06-05

What's new

Security (SEC)

• Avoid infinite loops for outlines and text extraction (#3830) by @stefan6419846

New Features (ENH)

• Add Japanese predefined CMaps (#3800) by @yasuhiroiwaki
• Font: Collect all character widths, not only those that can be unicode mapped (#3798) by @PJBrs

Robustness (ROB)

• Recover a corrupt trailing startxref pointer (closes #3238) (#3826) by @gaoflow
• Handle /Pages node without /Kids during flattening (#3825) by @gaoflow
• Accept inline image EI marker at the end of a content stream (#3827) by @gaoflow

Maintenance (MAINT)

• Type the always-raising deprecation helpers as NoReturn (#3819) by @estelledc

Full Changelog

Version 6.12.2, 2026-05-26

What's new

Security (SEC)

• Optimize _decode_png_prediction regarding memory and speed (#3806) by @stefan6419846
• Improve loop control in text extraction (#3805) by @stefan6419846

Full Changelog

Version 6.12.1, 2026-05-22

What's new

Security (SEC)

• Limit input size and element count for XMP metadata (#3796) by @stefan6419846

Robustness (ROB)

• Prevent cyclic parent hierarchies for inherited dictionaries (#3795) by @stefan6419846
• Deal with invalid first code in LZW decoder (#3794) by @stefan6419846

Full Changelog