RealObjects PDFreactor 12.7.1 change log

PDFreactor 12.7.1 (2026-08-14)

The following issues were fixed:

Merging documents with a very large amount of bookmarks can cause conversions to terminate with exceptions. (#10054)
Inset box-shadows at high -ro-rasterization-supersampling values are rendered incorrectly. (#9959, #9960)
Using asset packages in combination with merge mode append fails. (#9983)
Some code snippets in the documentation are incorrect. (#9702)

The following CVEs in 3rd party dependencies were mitigated:

Mitigated CVEs in packaged Java runtime. (CVE-2026-41254, CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147)
CVE-2025-66453
CVE-2026-19032
CVE-2026-54078 (#10033)
CVE-2026-54079 (#10034)
CVE-2026-54080
CVE-2026-54081
CVE-2026-54082
CVE-2026-54512
CVE-2026-54513
CVE-2026-54514
CVE-2026-54515
CVE-2026-54518
CVE-2026-59888
CVE-2026-64607
CVE-2026-68497
PDFreactor Web Service
- CVE-2026-6790
- CVE-2026-8384
- CVE-2026-10050
- CVE-2026-10051
- CVE-2026-54225
- CVE-2026-54516
- CVE-2026-54517
- CVE-2026-57819
- CVE-2026-59889
- CVE-2026-64958
- CVE-2026-65432

The following dependencies were updated:

Packaged Java runtime Eclipse Temurin 21.0.11 to 21.0.12
com.fasterxml.jackson.* 2.19.0 to 2.22.1
org.apache.httpcomponents.client5.* 5.5 to 5.6.3
org.verapdf.* 1.28.1 to 1.30.2
PDFreactor Web Service
- com.fasterxml.jackson.* 2.21.1 to 2.22.1
- org.apache.cxf.* 4.1.7 to 4.1.8
- org.eclipse.jetty.* 12.0.33 to 12.0.38

PDFreactor 12.7.0 (2026-06-30)

The changes include:

PDFreactor Web Service
- The default configuration has been changed:
  - The service now blocks access to Local addresses during conversions. (#9962)
  - The API is now considered untrusted by default, which improves security. (#9962)

The following issues were fixed:

Fixed various security-related issues. (#9816, #9819, #9820)
Excessively complex connection rule expressions can lead to effectively non-terminating conversions. (#9964)

PDFreactor 12.6.1 (2026-06-19)

The following issues were fixed:

The log does not include the end date of subscription license keys. (#9871)

The following CVEs in 3rd party dependencies were mitigated:

PDFreactor Web Service
- CVE-2026-41838
- CVE-2026-41840
- CVE-2026-41841
- CVE-2026-41842
- CVE-2026-41843
- CVE-2026-41844
- CVE-2026-41845
- CVE-2026-41846
- CVE-2026-41848
- CVE-2026-41850
- CVE-2026-41851
- CVE-2026-41852
- CVE-2026-41853
- CVE-2026-41854
- CVE-2026-44417
- CVE-2026-44618
- CVE-2026-44930
- CVE-2026-49875
- CVE-2026-50623
- CVE-2026-50627
- CVE-2026-50628
- CVE-2026-50629
- CVE-2026-50630
- CVE-2026-50631
- CVE-2026-50632
- CVE-2026-50633
- CVE-2026-50634
- CVE-2026-50645

The following dependencies were updated:

PDFreactor Web Service
- org.springframework.spring-* 6.2.18 to 6.2.19
- org.apache.cxf.cxf-rt-* 4.1.5 to 4.1.7

PDFreactor 12.6.0 (2026-05-13)

The new features and improvements include:

The check mark symbols of AcroForm check boxes and radio buttons can now be specified via the proprietary CSS property -ro-pdf-form-check-type. (#9811)

The following issues were fixed:

Certain rare style combination may cause non-terminating conversions. (#9825)
Exceeding content detection in certain structures can cause conversions to terminate with exceptions. (#9808)
The JavaScript DOM method Element.getAttributeNames() is missing. (#9836)

The following CVEs were mitigated:

Mitigated CVEs in packaged Java runtime. (CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282)
CVE-2026-5588
PDFreactor Web Service
- CVE-2026-22735
- CVE-2026-22737
- CVE-2026-22740
- CVE-2026-22741
- CVE-2026-22745
- CVE-2026-42402
- CVE-2026-42403
- CVE-2026-42404

The following dependencies were updated:

Packaged Java runtime Eclipse Temurin 21.0.10 to 21.0.11
org.bouncycastle.bc* 1.80 to 1.84
PDFreactor Web Service
- org.springframework.spring-* 6.2.16 to 6.2.18
- org.apache.neethi.neethi 3.2.1 to 3.2.2

PDFreactor 12.5.0 (2026-03-25)

The following issues were fixed:

In certain documents using multi-column can result in exceptions due to incomplete layouts. (#9717)
Multi-column spanner boxes with forced column breaks cause exceptions. (#9730)
Multi-column spanner elements that begin with floated or positioned elements cause exceptions. (#9737)
Merging documents with a huge amount of bookmarks can cause conversions to terminate with StackOverflowErrors. (#9519, #9615)
Overlaying a PDF with a shorter PDF can cause conversions to terminate with exceptions. (#9747)
Using the inset function with an explicitly specified border radius of zero causes a terminating exception. (#9798)
Using the none keyword for color components in certain CSS color functions, like lch or lab causes terminating exceptions. (#9797)
When PDF tagging is enabled DOM element IDs containing any of the characters ! and ^ can cause conversions to terminate with exceptions. (#9555)
Creating inspectable PDFs terminates with an exception when exceeding content is detected inside a page margin box. (#9756)
When passing down styles to iframes inside running elements, an exception occurs due to unfinished layout. (#9772)
href attributes in SVG without the xlink namespace are not supported. (#9693)
lengthAdjust in SVGs uses inaccurate width determination and breaks the SVG when the text with a white-space that is not collapsed. (#9773)
Unsupported CSS variables in external SVGs can affect embedded SVGs in the same host document. (#9789)
Some WebP images cannot be decoded. (#9726, #9729)
In certain cases when using the CSS functions leader and target-counter, the determined page number is incorrect. (#9706)
Grid layouts with flexible tracks and direction RTL can lead to overflowing grid items. (#9752)
Using named strings inside running elements collapses spaces unexpectedly if the named strings can be empty. (#9762)
JavaScript window.requestAnimationFrame() callbacks don't have a timestamp parameter.
This causes missing logos in amCharts 5.15. (#9721)
PDF attachments with the locations document specified via CSS on elements spanning multiple pages are added multiple times. (#9761)
Using -ro-image-resampling on an image which is referenced multiple times causes the default compression to change from jpeg(80%) to lossless(). (#9779)
Recompressing JPEG images in debug mode causes these images to be added to the debug resources attachment twice. (#9780)
PDFreactor Web Service
- Server log mode live causes conversions to hang or stop logging. (#9727)
- Specifying complex configuration types in the Python CLI client doesn't work properly. (#9687)

The following CVEs were mitigated:

Mitigated CVEs in packaged Java runtime. (CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945)
PDFreactor Web Service
- CVE-2025-11143
- GHSA-72hv-8253-57qq
- CVE-2026-1605

The following functionalities were deprecated:

Using PDFreactor without a license key is deprecated. Currently, without a license key, PDFreactor runs in evaluation mode. In evaluation mode PDFreactor currently works just like the full version, but the resulting PDF document will include watermarks and additional evaluation pages. This will no longer be possible in future versions.

The following dependencies were updated:

Packaged Java runtime Eclipse Temurin 21.0.9 to 21.0.10
com.twelvemonkeys.imageio.* 3.12.0 to 3.13.1
org.apache.pdfbox.* (repackaged) 3.0.5 to 3.0.7
PDFreactor Web Service
- com.fasterxml.jackson.* 2.19.0 to 2.21.1
- org.springframework.* 6.2.12 to 6.2.16
- org.eclipse.jetty.* 12.0.30 to 12.0.33
- org.apache.cxf.* 4.1.3 to 4.1.5

PDFreactor 12.4.0 (2025-12-04)

The following issues were fixed:

Certain combinations of border styles can cause conversions to terminate with exceptions when they have a conformance set that disallows semi-transparency. (#9648)
In rare cases, two floats surrounded by text near a page break can cause exceptions. (#9695)
A large number of inline elements without any line break opportunity between them may cause errors. (#9630)
Complex floats spanning multiple pages may cause excessive runtime. (#9685)
In some cases grid layouts inside multi-column or region layouts may overflow instead of breaking onto the next page. (#9663)
JavaScript optional chaining (the ?. operator) is not supported for all objects, which breaks Highcharts 12.2 and newer. (#9688)
The property -ro-pdf-tag-type has no effect on page floats. (#9678)
Footnote and sidenote markers may erroneously create nested Lbl tags in tagged PDFs. (#9655)
Unlike form fields, signature fields do not receive an alternative name (TU) entry from -ro-alt-text or ARIA attributes. (#9480)
Raster Image Output
- Rotating images, via the CSS properties transform or -ro-image-orientation, may cause them to be rendered incorrectly. (#9653)

The changes include:

JavaScript processing now supports ECMAScript 2025.
Note: Java 20 or newer is required for ECMAScript 2025 support. Using Java 17-19 automatically disables ECMAScript 2025 features. (#9688)

The following CVEs were mitigated:

Mitigated CVEs in packaged Java runtime. (CVE-2025-61748, CVE-2025-53066, CVE-2025-53057)
PDFreactor Web Service
- Mitigated transitive CVEs in packaged application server Jetty. (CVE-2025-59419, CVE-2025-58057, CVE-2025-58056, CVE-2025-55163, CVE-2025-48924, CVE-2025-11226)

The following dependencies were updated:

Packaged Java runtime Eclipse Temurin 21.0.8 to 21.0.9
org.graalvm.js.js-language (modified and repackaged) 24.0.2 to 25.0.1
PDFreactor Web Service
- org.eclipse.jetty.jetty-home 12.0.25 to 12.0.30

PDFreactor 12.3.2 (2025-10-30)

The following issues were fixed:

Using the CSS color function gray or grey erroneously causes ConformanceExceptions for certain levels of PDF/A and PDF/X. (#9623)
Request headers from networkSettings.requestHeaders are not always applied. (#9635)

The following CVEs were mitigated:

Mitigated CVEs in packed Java runtime. (CVE-2025-30749, CVE-2025-30754, CVE-2025-50059, CVE-2025-50106)
PDFreactor Web Service
- Mitigated CVE in Spring Framework. (CVE-2025-41249)

The following dependencies were updated:

Packaged Java runtime Eclipse Temurin 21.0.7 to 21.0.8
PDFreactor Web Service
- org.springframework.*-6.2.10 to 6.2.12

PDFreactor 12.3.1 (2025-10-01)

The following issues were fixed:

Using certain CJK characters may result in invalid PDFs. (#9577, #9547, #9402, #9239)
Cyclic regions may cause conversions to terminate with exceptions. (#9596)
Complex multi-columns in rare cases cause conversions to terminate with exceptions. (#9612)
The overflow CSS property is not applied to SVG elements. (#9582)
Interactive radio buttons are not created when not inside an HTML form element. (#9561)
The alpha value of outline colors may affect the transparency of elements with mixed blend mode. (#9601)
When the input document is set as a file path, the Python CLI overwrites the baseUrl. (#9609)

PDFreactor 12.3.0 (2025-09-05)

The new features and improvements include:

Missing fontconfig on Linux is now detected and logged on startup. (#9553)

The changes include:

Multiple HTML headings in heading groups are no longer fully supported. This can be restored via styles. (see migration guide for details)

The following issues were fixed:

Certain unexpected values in SVGs cause the conversion to terminate with an exception. (#9554, #9567)
In rare cases multi-column layouts may cause the conversion to terminate with an error. (#9515)
Setting a conformance level on a document that contains an invalid color may cause the conversion to terminate with an exception. (#9556)
Setting both hyphens:none and overflow-wrap: break-word on certain elements may cause the conversion to terminate with an exception. (#9529)
getClientRects() and getBoundingClientRect() fail on empty SVG text elements, which breaks plotly.js v3.1.0. (#9566)
In certain cases, the height of images as flex items is computed incorrectly. (#9544)
PDF merging in overlay mode or with non-consecutive pages does not retain the attachments from all PDFs. (#9525, #9526)
In some cases merged documents do not retain their PDF/UA-1 conformance. (#9542)
Using PDF merging or encryption causes the setting disablePdfStructureOptimization to be ignored. (#9531)
Default XHTML cleanup Cyberneko erroneously converts supplementary plane code points to Unicode escape sequence. (#9509)
Color emojis are not visisble when the setting ProcessingPreferences.SAVE_MEMORY_IMAGES is used. (#9546)
Certain SVG-based color fonts slow down conversions significantly. (#9551)
License key file specified through the PDFreactor installer is not correctly deployed. (#9580)
PDFreactor Web Service
- EncryptionSettings.allowFillIn is not available in typed clients (#9579)
- Encryption enum is erroneously marked as deprecated in Java client (#9581)
- PDFreactor Web Service installed via RPM does not start on systems without internet access (#9584)
PDFreactor Docker Image
- Certain URLs to JS modules cause the conversions to terminate with an exception in PDFreactor Docker image. (#9570)

The following functionalities were deprecated:

Support for multiple HTML headings in heading groups are deprecated. (see migration guide for details)
The level of HTML h1 heading elements being influenced by elements, like sections, is deprecated. (see migration guide for details)

The following CVEs were mitigated:

PDFreactor Web Service
- Mitigated CVE in Apache CXF. (CVE-2025-48913)
- Mitigated CVE in Spring Framework. (CVE-2025-41242)
- Mitigated CVE in Jetty. (CVE-2025-5115)
PDFreactor Docker Image
- Mitigated multiple CVEs in Linux packages of Docker image. (CVE-2025-49796, CVE-2025-49794, CVE-2025-6021)

The following dependencies were updated:

PDFreactor Web Service
- org.eclipse.jetty*-12.0.22 to 12.0.25
- org.springframework.*-6.2.8 to 6.2.10
- org.apache.cxf.*-4.1.2 to 4.1.3

PDFreactor 12.2.1 (2025-07-02)

The following issues were fixed:

PDFreactor Docker Image
- In certain situations, defective fonts can cause conversions in Docker to terminate with an error. (#9514)

PDFreactor 12.2.0 (2025-06-16)

The new features and improvements include:

Fonts in WOFF2 format are now supported. (#8452)
The CSS property "hyphenate-limit-chars" is now supported. (#9110)

The changes include:

The default XHTML cleanup now handles prefixes with missing namespace declarations by inserting dummy namespace declarations, instead of failing. (#9493)

The following issues were fixed:

Some emoji fonts can cause conversions to not terminate. (#9405)
In rare cases, layout involving inline-blocks and floats causes exceptions or does not terminate at all. (#9425)
In rare cases, multi-column spanner elements are moved to the next page, even though they would still fit. (#9456)
In documents where break avoidance styles have been set on all available break positions, while there are also page margin boxes, then content may overflow the page. (#9445)
Text lines containing soft-hyphens may overflow their container. (#9427, #9431)
In certain cases, using soft-hyphens and custom line break opportunities causes exceptions. (#9430)
Page groups are not updated correctly after changes have been made via JavaScript. (#9434)
In certain region layouts, break avoid styles are not applied correctly in the last two regions of a region flow. (#9435)
Exceptions may occur when having collapsed tables inside balanced multi-column elements. (#9433)
In edge cases, the CSS property "text-overflow" is applied even though the text still fits. (#9428)
Intrinsic sizing of elements is incorrect for elements with negative values for the CSS property "text-indent". (#9426)
The function "replace" of the Element.classList property is not supported. (#9490)
Running element is not updated on following pages. (#9440)
PDF contains an empty page with a size of zero if "break-before: left" is used in multi-column. (#9422)
SVGs with external resources are not displayed. (#9497)
PDFreactor terminates with NoClassDefFoundError when optional dependencies are missing. (#9232)
PDFreactor Web Service
- Security connection rules for "port" and "entry" don't work in PDFreactor Web Service. (#9478)
- The client version of the PDFreactor Web Service Java client is incorrect. (#9496)
- Calling /service/rest/status increases the "finished conversions" counter erroneously. (#9451)
- HTTP Cache does not work in PDFreactor Web Service. (#9438)

The following functionalities were deprecated:

The alternative XHTML cleanups JTidy and TagSoup are now deprecated for removal in Q4 2025, as since #9493 they have no relevant advantages over the default cleanup. (#9494)
Embedding prerendered thumbnail images of pages into PDFs, via the configuration property "addPreviewImages", is now deprecated for removal in Q4 2025, as it leads to larger output files without a benefit.
The legacy JavaScript engine Rhino is now deprecated.
DOM mutation events in JavaScript are now deprecated.

The following CVEs were mitigated:

Mitigated CVE in Apache HTTPClient. (CVE-2025-27820)
Mitigated CVE in optional XHTML cleanup JTidy. (CVE-2023-34623)
PDFreactor Web Service
- Mitigated multiple CVEs in Spring Framework. (CVE-2025-41234, CVE-2025-22233)
- Mitigated multiple CVEs in Jetty. (CVE-2025-25193, CVE-2025-24970, CVE-2025-1948, CVE-2024-57699, CVE-2024-52046, CVE-2024-12801, CVE-2024-12798)
PDFreactor Docker Image
- Mitigated multiple CVEs in Linux packages of Docker image. (CVE-2025-27363, CVE-2025-24928, CVE-2025-24528, CVE-2025-4802, CVE-2025-0395, CVE-2024-56171, CVE-2024-12243, CVE-2024-12133)

The following dependencies were updated:

com.ibm.icu.icu4j-76.1 to 77.1
org.apache.httpcomponents.client5.*-5.4.2 to 5.5
org.verapdf.*-1.26.5 to 1.28.1
com.fasterxml.jackson.*-2.18.3 to 2.19.0
net.sf.jtidy.jtidy-r938 to com.github.jtidy.jtidy-1.0.5
org.apache.pdfbox.*-3.0.4 to 3.0.5
uk.org.okapibarcode.okapibarcode-0.5.0 to 0.5.1
PDFreactor Web Service
- org.eclipse.jetty*-12.0.16 to 12.0.22
- org.springframework.*-6.2.3 to 6.2.8
- org.apache.cxf.*-4.1.0 to 4.1.2
- org.apache.geronimo.specs.*-1.0 to 1.1.1
PDFreactor Preview
- com.formdev.flatlaf-3.5.4 to 3.6

PDFreactor 12.1.0 (2025-03-05)

The new features and improvements include:

Added support for OpenType color font formats CBDT, SBIX and OpenType-SVG. (#7857, #9353, #9354)
Added support for color emojis (Java 17+ recommended). (#7857)
The MIME types of PDF attachments can now be set via CSS, JS or the API. The default auto detection was also improved. (#9358)
Added the option to use perceptual and relative colorimetric conversion, when converting between CMYK and RGB using ICC profiles and Java 20+.
Barcodes can now be rotated, like images, using the CSS property "-ro-image-orientation". (#9384)
The default fonts can now be addressed via "-ro-"-prefixed font-family names, listed in the manual.
The variant of the default CJK font is now selected automatically when a language is set in the document via a "lang" attribute.

The changes include:

Updated included default fonts to latest Noto fonts and added color emoji font.
CSS RGB color values are no longer normalized to 255th increments, now keeping a higher precision. (#9344)
PDFreactor Library
- Support for Java versions 8 to 16 is deprecated for removal in Q4 2025. Future versions of PDFreactor will require Java 17+.

The following issues were fixed:

Region breaks inside multi-column elements, which themselves are inside a last region element, cause exceptions. (#9347)
In certain cases an absolutely positioned element placed after a forced break causes an exception. (#9369)
Trying to merge certain PDFs causes an exception. (#9403)
Using mix-blend-mode in PDF/A or PDF/X causes conformance exceptions, even when the conformance level supports it, i.e. PDF/A-2, PDF/A-3 and PDF/X-4. (#9393)
Perceptive color conversions are now the default in Java 20+, restoring the behavior of older Java versions when converting colors using CMYK ICC profiles. (#9328)
Highcharts charts in certain flex layout constructs are partially rendered. (#9316)
In certain cases, floated elements inside nested inline and table elements were positioned incorrectly. (#9360)
The intrinsic width of elements containing floats with a clear value is determined incorrectly. (#9361)
In certain cases row flex items grow too wide. (#9333)
The baseline of inline flex containers is not determined correctly in certain cases. (#9335)
Split flex items in non-wrapping row direction are not aligned correctly after page breaks. (#9399)
Auto heights of grid items in a flex column are not resolved correctly. (#9321)
Paragraphs containing empty inline elements only are erroneously not treated as empty. (#9350)
Inside a last region element, the content of multi-column elements overflows at the bottom instead of flowing into the next column. (#9357)
In rare cases text fragments can overflow their line when no break is possible before them. (#9386)
Words containing soft-hyphens are split using automatic hyphenation. In certain cases this can lead to superfluous letters on the next page. (#9394)
Missing content and incorrect layout when inserting cloned nodes with JavaScript. (#9327)
Running elements don't work in page margin boxes of blank pages. (#9337)
Incorrect table layout when using "insertRow" and "insertCell" JavaScript methods. (#9366)
Certain combinations of nested inline elements can cause missing hyphens from hyphenation. (#9389)
Higher plane code points, e.g. emojis, can cause incorrect widths. (#9395)
Some transforms of SVG patterns are applied incorrectly, breaking Highcharts pictorial charts.
PDFreactor Web Service
- Disabling SSL certificate validation does not work in Web Service. (#9372)
- Python CLI: Relatively linked resources are not loaded when converting local files. (#9310)
- Node client does not write cookies from ConnectionSettings object to request. (#9363)
- Configuration property "baseUrl" is incorrectly marked as deprecated in .NET client. (#9398)
PDFreactor Docker Image
- Mitigated multiple CVEs in Linux packages of Docker image. (CVE-2019-12900, CVE-2024-3596, CVE-2024-10963, CVE-2024-10041, #9374)

The following dependencies were updated:

org.verapdf.*-1.26.1 to 1.26.5 (#9391, CVE-2024-52800)
com.fasterxml.jackson.*-2.18.1 to 2.18.3
PDFreactor Web Service
- org.apache.cxf.*-4.0.5 to 4.1.0 (#9373, CVE-2025-23184, CVE-2024-29736)
- org.springframework.*-6.2.2 to 6.2.3

Documentation updates include:

AngularJS has been replaced in sample documents. (#9292)

PDFreactor 12.0.2 (2024-11-21)

The following issues were fixed:

The default sans-serif core font "Arimo" uses incorrect font weights. (#9332)
Missing font cache location can cause conversions to terminate with an exception. (#9331)
Images with a "thumbnail" EXIF dictionary erroneously use the "orientation" from that dictionary. (#9323)
PDFreactor Web Service
- "setApiKey" method is missing in Java client. (#9338)
- "NetworkSettings", incl. "requestHeaders", specified on the client are not applied. (#9329)

The changes include:

Corrected resolution of percentage widths in row flex, causing minor changes in some layouts.

PDFreactor 12.0.1 (2024-11-13)

The following issues were fixed:

Blocking external JavaScript via connection rules causes unexpected exception. (#9297)
Updated Batik to version 1.18, correcting some unexpected behaviors, e.g. "stop" elements without "offset" attribute erroneously being considered illegal instead of defaulting to 0. (#9121)
PDFreactor Web Service
- Numerical server parameters cannot be set. (#9303)
- It is not possible to set the "apiKey" in the PHP client. (#9315)
- Web Service from tarball cannot be started via included script in some cases. (#9300)
- RPM installation requires pre-installed Java. (#9307)
- Updated Spring Framework dependencies (org.springframework.spring-*) from version 6.1.13 to 6.1.14 (CVE-2024-38820)

The changes include:

Pages Per Sheet mode no longer disables links, bookmarks, tags and comments. (#8849)
Updated ICU4J to version 76.1, providing minor improvements to JavaScript date and number formatting.

PDFreactor 12.0.0 (2024-10-16)

The new features and improvements include:

Added proprietary support for sidenotes (also known as page marginalia). (#6410)
Floated elements now support CSS shapes and the corresponding CSS properties "shape-outside", "shape-image-threshold" and "shape-margin", incl. a proprietary option to use the visual outline of the content of the element. (#7717, #8440)
Added a browser-like HTTP resource cache, optionally across conversions, providing significant performance gains. (#7328)
Added support for HTTP/2, browser-like cookie handling and HTTP resource caching, either per conversion or shared. (#6735, #7359)
The paint order of floated, transformed or positioned elements can cause unexpected text selection behavior in viewers. The new proprietary property "-ro-paint-reordering" can force those elements to be added to the PDF in document order. (#8724, #8657, #8418, #8088, #7340)
Many more kinds of gradients (from CSS, SVG or Canvas) are now converted to PDF gradients instead of rasterizing them, including those with varying transparency or the repetition mode "reflect", and PDF gradient structures have been optimized, providing smaller file sizes as well as faster conversions and faster loading in viewers. (See fixes)
Multi-column elements now support the new value "balance-all" for the CSS property "column-fill", which forces balancing on all pages, instead of only the last page. (#8513)
The CSS "width" value "fit-content" is now supported. (#8755)
Clipping at the bleed box of a page can now be disabled via CSS, allowing content in the media box outside the bleed box. (#9186)
Introduced the new proprietary CSS properties "-ro-change-bar-name" and "-ro-change-bar-exclusion" that allow to disable change bars in specified areas. (#9218)
The Exceeding Content observer now handles page margin boxes, page floats, footnotes and sidenotes by adapting the rectangles they are compared against. (#8986)
The "BookletMode" API setting can now specify the spacing between pages, e.g. for completely marginless booklets. (#9285)
Added new error policy "WARN_EVENT" which causes PDFreactor to terminate with an exception when a warn-level message would be logged. (#4333)
When PDFreactor is deployed as Linux systemd service, systemd log entries can now be browsed using "journalctl -u". (#8463)
Source files for Java and .NET clients are now included in the appropriate packages. (#8778)
JavaScript
- By default JavaScript is now enabled and uses a new engine, based on GraalJS, which requires Java 17. Disabling JavaScript or using the old engine, based on Rhino, is still possible. (#8354)
  - This improves JavaScript syntax support from partial support for ECMAScript 2015 (ES6) to full support for ECMAScript 2023. (#7260, #7264, #7412, #7413, #8078, #8079, #8813)
  - Additional functionalities have been added to native JavaScript objects as well as DOM objects and existing ones have been improved. (#6127, #7108, #7427, #8593, #8658, #8814, #8867, #8883, #9083)
  - Improved and added new APIs, like MutationObserver. (#5711)
  - Added support for JavaScript Modules, via "module" type and "import" statement. Also added support for import maps, currently limited to the "imports" module specifier map. (#9078)
  - More JavaScript libraries are supported and existing support has improved, e.g. Highcharts, Raphael.js. and Vue.js. (#7484, #8746, #8983, #9011)
- Added new method "compactifyTable()" to Awesomizr that rearranges table structures to fit into their pages. (#9003)
- Added new method "autoFillPages()" to Awesomizr which can dynamically fill the document with empty pages up to a specified page count. (#8507)
Footnotes
- Footnotes can now break onto the following page or be moved there entirely, significantly reducing the amount of unused space. (#8536, #9077)
- Footnotes defined inside multi-column contexts can now be placed into their column or page. (#8430)
PDF Merging (#8353)
- When merging tagged PDFs, tags are now preserved. For overlays the tags of the content document are retained. Which document is the content document is configurable. (#5715, #9230)
- Merging now properly retains links, form fields incl. page references, PDF stamps and attachments. (#6507, #8307, #8322, #8405, #8749)
- Merging documents with conformance, e.g. PDF/A, now results in a merged document with the same conformance, if possible. (#6514)
- Added new "overlayFit" property to configure how pages with different dimensions should be resized when they are overlaid when merging. (#6292, #8706)
- Conformance validation is now supported for merged documents. In such cases the final merged document is validated. (#8766)
- Password protected PDFs can now be merged or, optionally, omitted via the IGNORE_INVALID_MERGE_DOCUMENTS_EXCEPTION error policy. (#8717, #8697)
- The configuration for the merging of documents is now handled through the new MergeSettings API object.
PDF Tagging and Accessibility
- ARIA attributes in HTML are now taken into account when determining PDF tag types. The CSS property "-ro-pdf-tag-type" still has priority. (#7901)
- Automatic determination of PDF tags has been improved.
- The property CSS "-ro-pdf-tag-type" has been extended to optionally tweak the automatic determination of PDF tags instead of fully overriding it.
- Further attributes are automatically added to tags, including those describing text decorations. (#9212)
- Improved tagging of form fields, both interactive and non-interactive. (#8472)
- Improved order of tagged page margin boxes, also relative to the page content. Paint order has been corrected accordingly, for better selection behavior. (#8957, #9175)
- Images and other replaced elements with no alt text are now tagged as artifacts and a warning is logged.
List Items
- List item markers have been significantly improved, incl. support for the "::marker" pseudo-element, making them interoperable with browsers. (#7746)
- Added support for the CSS function "symbols", that allows specifying simple counter styles in place. (#8647)
Logging
- Many log warnings and messages now contain the location, in the source document or style sheet, of the likely cause.
- Improved various log messages and the levels at which they are logged as well as added more prefixes. (#8947, #8948)
- Logging of problems during CSS parsing has been improved to be more helpful. For example there are now fewer unnecessary warnings and valid but unsupported CSS is now logged as such. (#8318, #9000)
- Rasterization of SVGs in PDF output is now logged. (#6134)
- When conformance validation mode is enabled, the cause of a failed validation is now logged more prominently. (#8664)
CSS
- The font-relative length units "cap", "ic", "lh" and "rlh" are now available without the "-ro-" prefix. (#9164)
- PDFreactor now supports more viewport relative length units, including ones for logical directions. (#8857)
- Improved the handling of CSS shorthands, especially in regards to CSS wide key words, like "inherit". Also longhands can now be tracked back to shorthand sources in PDFreactor Inspector. (#8614)
- The CSS property "counter-set" is now supported without the "-ro-" prefix. (#8309)
- The proprietary CSS property "-ro-anchor" now supports multiple values which are concatenated to a single string. (#9217)
CSS selectors
- The CSS pseudo-class selectors ":is" and ":where" are now supported. (#8905)
- The ":not" pseudo class now supports complex selectors. (#8313)
- The flags for setting case sensitivity on CSS attribute selectors "s" and "i" are now supported. (#8694)
- Blank pages now use the page name and groups of the preceding page. (#8720)
Media Queries and Media Features
- Extended support for Media features, with the new features "update" and "scripting". Also default values of certain features now depend on the output format and configuration. (#8774, #8991)
- Media features can now be queried from JavaScript, via the function "window.matchMedia()". (#8990)
Text and Inline Layout
- The new proprietary CSS property "-ro-pdf-text-rendering" allows rendering text content as vector graphics with no embedded font, making it non-selectable. It can be applied to SVG text as well. (#8515, #8920)
- The maximum amount of consecutive hyphenated lines can now be specified via the CSS property "hyphenate-limit-lines". (#9014)
- Added support for the CSS properties "text-underline-position" and "text-underline-offset". (#8679, #8678, #8602)
Fonts
- Synthetic bold and italic can now be prohibited via the CSS property "font-synthesis". (#8590, #8646)
- Updated included fonts to latest version of The Noto Fonts Project, including new scripts.
- Some included fonts now have a bold variant, significantly improving the overall render quality and especially the legibility of bold CJK glyphs.
Image Input
- Improved support for WebP images, incl. the new modes "lossless" and "lossy with alpha". (#8612)
- Added partial support for PSD images (#8900)
- External links are now preserved when embedding PDFs as images. (#7443)
- Empty image clip-paths are now being ignored when "-ro-image-clip-path" is set to "auto". (#8963)
Print Marks
- How far crop marks run into the bleed area or stay away from it can now be configured via CSS. (#8442)
- Registration marks now move partially into the bleed area if they don't fit next to it. (#6669)
- Printer marks now have a white background or outline to ensure their visibility when they intersect the bleed area. (#8519)
Barcodes
- Added Support for UK Plessey and DPD barcodes as well as Swiss and UPN QR code variants.
- Added the "-ro-barcode-symbol-width" CSS property, allowing for customization of the symbol width of 1D barcodes. (#8707)
- Added the "-ro-barcode-letter-spacing" CSS property, allowing for the adjustment of the letter spacing of human-readable text. (#9012)
- Made the separator height of Composite and DataBar barcodes customizable using the last argument of "-ro-barcode-type".
- It is now possible to configure which code sets are used by Code 128 barcodes.
- Missing dash in USPS OneCode barcode is now added automatically. (#9244)
- Checksums of UPC/EAN barcodes are now automatically removed instead of causing an error if they are part of the specified barcode content.
- The subtype "databar truncated" is now available and DataBar Expanded and DataBar Limited are now subtypes of DataBar. (See related change)
PDF Output
- Added support for AES encryption. (#8545)
- Prefixes of font subsets are no longer random, making PDFs easier to compare programmatically. (#7622)
- ICC profiles used by multiple images are now only embedded once, reducing file size. (#9289)
Raster Image Output
- "ColorSpaceSettings.ConversionEnabled" and "ColorSpaceSettings.TargetColorSpace" can now be used with raster image output to convert the result to CMYK, using "ColorSpaceSettings.CmykIccProfile" if specified. (#6344)
PDFreactor Library
- For environments that require conversions in cold Java VMs, like CLI or cloud, there is now a static method that triggers a pre-initialization that speeds up the first conversion.
PDFreactor Web Service
- PDFreactor Clients now support Asset Packages. (#8226)
- The service is now flagged as unhealthy if it can't perform asynchronous conversions. (#8864)
- Added a new server parameter "shutdownIfCritical" that specifies whether the service should terminate automatically if it becomes unhealthy. (#8363)
- The service now terminates if an out-of-memory error occurs. (#7934, #8343)
- The prefix of service log messages can now be configured using the server parameter "serverLogMessagePrefix". (#8784)
- Updated Jetty application server to version 12. (#8274)
- Improved exception handling in .NET Client. (#8712)

The changes include:

Please refer to the migration guide for more information as these changes might impact existing integrations.
A new JavaScript engine, based on GraalJS, is used by default. (See features)
The font-size values "larger" and "smaller" are now larger/smaller than the parent font-size by a factor of 1.2, matching browser behavior.
The automatic document type detection has been improved and now also takes the file extension into account. (#8687)
PDF Tagging now processes ARIA attributes in HTML and automatic tagging has been further improved. We recommend re-validating if the tag structures of your documents are still as expected. (See features)
Generated content on replaced elements is now ignored, as required by the specification. (#9283)
File URLs with a non-empty authority component other than exactly "localhost" are now denied. They can be re-enabled using security settings. (#9124)
Font cache files are no longer created by default, except when using the PDFreactor CLI. (#8433)
Access to JavaScript-based PDF output options is now disabled by default. It can be re-enabled using security settings. (#9138)
Pages per sheet, incl. booklet, functionality now centers pages in their area on the sheet.
Rasterization CSS properties are now inherited, ensuring they affect all text shadows. (#8566)
The identifiers of regular and omnidirectional stacked DataBar barcodes have been corrected: Regular GS1 DataBar (Omnidirectional) barcodes are now created using "databar omnidirectional" instead of "databar normal" and GS1 DataBar Stacked Omnidirectional barcodes are now created using "databar omnidirectional-stacked" instead of "databar omnidirectional". (See related feature)
Removed the ZUGFeRD add-on from PDFreactor. (#8629)
API Changes
- The "fullCompression" configuration property has been removed. Its functionality is now always enabled, increasing the default PDF version to 1.5. Use "disablePdfStructureOptimization" to revert to 1.4. (#9027)
- The "fontCachePath" configuration property now specifies the directory where font cache files are put. (#8421)
- The "fontFallback" API property now not only affects per-character font-fallback, but also which fonts are tried when none were found for the "font-family" CSS property. (#9065)
- Added new MergeSettings configuration object used for the merging of documents.
- Added new EncryptionSettings configuration object.
- The Resource object now includes a "password" field.
- Several deprecated configuration properties were removed. See the migration guide for details.
PDFreactor Web Service
- Dropped support for Python 2 in the PDFreactor Python Clients. Python version 3.10 or newer is now required. (#8654)
- Dropped the Perl Client. (#9104)
PDFreactor Library
- Java 17+ is now required by default when using JavaScript. Java 8+ is still supported when no JavaScript is required or when using the legacy JavaScript engine "Rhino". Please note that future versions of PDFreactor will require Java 17+ and support for older Java versions is deprecated.
- When converting to multiple images, those can now be written directly into dynamically created OutputStreams, allowing e.g. writing them directly into a ZIP or as files into a folder. (#8182)
Command Line
- PDFreactor CLI (both Java and Python) now only accepts arguments in kebab-case notation. (#9030)
- The working directory for the PDFreactor command line binary (e.g. pdfreactor-cmd.exe) is now the current directory. (#8520)

The bug fixes include:

Various JavaScript improvements can also be considered fixes. (See features)
Too early or otherwise unexpected column or page breaks occur in certain circumstances. (#6275, #7055, #7643, #7794, #8583, #8693, #8719, #8726, #8763, #8772, #8793, #8896, #8965, #8966, #9173, #9208, #9279)
The "word-spacing" property does not affect the "max-content" width. (#8714)
Different values of the CSS properties "overflow-x" and "overflow-y" are not handled correctly. (#8827)
The behavior of "noscript" elements is inconsistent. (#8765)
Paint order of elements or margin boxes with the same z-index number is incorrect, also affecting text selection in PDFs. (#9225, #9176)
Invalid cross references and left/right page styles after JavaScript processing. (#7211)
Absolutely positioned content inside regions is placed incorrectly. (#5792)
Grid Items overlap when they are broken across regions. (#9209)
Content is aligned outside of its box when using grid and flex. (#9123)
Continuation markers are missing or incorrect in certain cases. (#8718)
The proprietary JavaScript function "ro.layout.getContent()" returns outdated results for counters in some cases. (#8663)
Block images inside inline elements are duplicated if the elements are manipulated via JavaScript. (#7273)
Running Elements may disappear when using "MathJax". (#7338)
File locks on font files are kept after the conversion has finished, up to the termination of the JVM. (#6354)
In a rare specific case links cause the output PDF to be corrupted. (#8702)
"BookletMode" API setting swaps left and right pages and "BOOKLET_RTL" page order reverses order of sheets. (#9284)
When using "pagesPerSheet" with raster image output the pages are scaled incorrectly. (#9179)
Some dependencies are outdated, containing CVEs.
Exceptions
- Certain documents with fragmented floated elements can cause exceptions. (#9063)
- Certain combinations of tables and flex layout cannot be laid out, causing an exception. (#8953)
- An exception is caused by flex-items that have an aspect-ratio of zero. (#9075)
- Using "-ro-scale-content" in conjunction with forced page breaks on grid items can cause exceptions. (#8858)
- Large complex tables with row spanning cells distributed over multiple pages can cause exceptions. (#8771)
- PDFreactor crashes if a complex table with row spanning cells is paginated over multiple pages. (#8987)
- Certain combinations of "dir" attributes and empty spans cause exception. (#9155)
- PDFreactor crashes if a large block element is placed within an inline element. (#8681)
- When CSS validation is disabled CSS transform functions without specified parameters cause an exception. (#9192)
- Conformance exceptions cause PDFreactor to not return a document in certain cases. (#8623)
- Certain combinations of links and border-radius can cause exceptions. (#9094)
- An extremely rare deadlock can happen during number formatting. (#8882)
Line Breaks
- Nested inline elements with "white-space: pre" may overflow their lines. (#8868)
- Nested inline elements with padding on the right may overflow instead of being broken to the next line. (#9060)
- The generated content of the "leader()" CSS function does not break to the next line correctly causing overflowing lines. (#8795)
- Some inline content involving non-breaking spaces does not break correctly causing overflowing lines. (#8769)
- Inline-block with specific nesting overflows the surrounding block element. (#8796)
Fonts, Text and Inline Layout
- Backgrounds, borders and outlines of inline elements in a paragraph with "text-align: justify" are painted with gaps between the fragments. (#6605, #7641, #9059)
- No-break space (U+00A0) and word joiner (U+2060) characters are handled incorrectly by "text-align: justify". (#9247, #9248)
- Soft hyphens cause mixed bidirectional text following in the same line to be laid out incorrectly. (#9261)
- Some complex cases of bidirectional text are not laid out or displayed correctly.
- Right-aligned text is not aligned flush with container edge. (#8618)
- Text overflows line when the last part is in a different element and starts with certain characters, like colons. (#9287)
- The synthetic baseline of replaced elements, like images, is the bottom border edge instead of the bottom margin edge. (#8470)
- Font kerning is not applied correctly around invisible soft hyphens. (#8683)
- In rare cases large fonts embedded into PDFs were missing some glyphs, causing missing text, or error messages in some viewers. (#8660, #8698, #8709, #9037)
- When bold text is rasterized, e.g. due to text-shadow, superfluous synthetic bold might be applied. (#8810)
- Text with "vertical-align: super" and "line-height: 0" shifts its line downwards. (#8924)
- In certain cases empty pseudo elements cause superfluous line breaks. (#8705)
- Empty inline elements are not positioned correctly in their line. (#8652)
CSS
- The declarations of page margin rules inside the same page rule do not cascade. (#8715)
- Setting a CSS shorthand property and retrieving the corresponding longhand properties via JavaScript, or vice versa, i.e. setting longhands and retrieving shorthand, does not return the set values. (#4905, #7197)
- When CSS shorthand properties with a CSS variable as a value are marked as important, they can still be overridden by non-important longhand properties. (#8806)
- The proprietary rule "@-ro-preferences" is only recognized when defined on the top level of the style sheet and not when it is inside another rule (e.g. "@media"). (#9023)
- Negative padding is erroneously used if it is the result of a calc-function. (#8999)
- Page margin boxes can be created even if their "content" property is "none". (#8736)
- Very large CSS counter values are imprecise. (#8672)
Floats
- In certain cases, elements that contain a floated element which itself was moved to the next page during layout, have a height that is too large. (#8610)
- Under rare circumstances elements inside floated elements overlap with content of other floats. (#8845)
Tables
- The height attribute is not supported on all table-related HTML elements. (#9050)
- Table content is laid out in incorrect order in special circumstances. (#8821, #8955)
- Large table captions can lead to overflowing table content. (#9100)
- The page break behavior of tables is incorrect when the table has a fixed height. (#8734)
- Incorrect table bottom border if "break-before: avoid" is set on table rows. (#8569)
- Tables with collapsed borders and "box-decoration-break: slice" are broken onto the next page even if they would barely fit on one page. (#8551)
- The distribution of heights in tables differs from browser behavior. (#8829, #8141)
- The height of a fragmented row spanning cell is wrong under certain circumstances. (#7977, #7882)
- Fast table layout ("display: -ro-fast-table") does not respect border widths, possibly leading to overlapping cells. (#8918)
- Fast tables ("display: -ro-fast-table") now have limited support for font fallback and "vertical-align", specifically "middle" and "bottom" in addition to "top". (Note: HTML tables default to middle.) (#8917)
Flex
- The width and height of flex items is incorrect in certain complex cases of nested items. (#8375)
- Percentage or aspect-ratio based sizes of flex items are incorrect in certain cases. (#8411, #8675)
- Wrapped column flex items with greatly varying sizes may overflow the page. (#9190)
- Flex containers with multiple lines and a specified height are not fragmented correctly between flex lines. (#8860)
- Items in nested column flex containers can be shrunk excessively instead of being distributed across pages. (#9278)
- When using automatic scaling to avoid overflow, certain flex layouts can cause documents to be scaled down excessively. (#8861)
- Nested flex containers with "height: 100%" are laid out incorrectly and overlap. (#8741)
Multi-Column
- Absolutely positioned elements inside a multi-column container should not be positioned relative to their column (can optionally be re-enabled). (#9079)
- Absolutely positioned elements directly before column span elements can cause missing content. (#9291)
- Page breaks inside of spanning elements in multi-column layouts are not avoidable. (#9265)
- In some cases dynamic changes to the height of elements inside a multi-column container lead to empty columns or pages. (#8745)
- Certain complex layouts lead to incorrectly named strings and seemingly empty columns or pages. (#8892)
- Multi-column balancing ignores the values of the CSS properties "orphans" and "widows". (#8616)
- In certain cases CSS styles for break avoidance are ignored during column balancing. (#5241, #8888)
- The margins at the bottom of the last column of a multi-column element or the last region of a region chain are incorrectly truncated to zero. (#8605)
- Empty block at the end of multi-column content has unexpected impact on layout. (#9171)
Counters
- The value of counters is incorrect when they follow an explicit nested counter of the same name. (#8620)
- In rare cases the layout of complex documents causes certain target-counters to have outdated values. (#8887, #8889)
- In rare cases target-counters are not updated correctly due to dynamic changes made via JavaScript. (#8703)
CSS Custom Properties
- Custom properties with a value of "initial" are not treated as invalid and CSS variables that use their fallback are not resolved correctly in certain cases when the fallback is also a CSS variable. (#9157)
- Custom properties starting with a number are ignored. (#8944)
Footnotes
- Paragraphs that contain many footnotes may be moved to the next page as a whole instead of moving only a few lines, when there is not enough space left for all footnotes. (#8537) (See features)
- Manipulating footnotes via JavaScript can cause incorrect layouts. (#8539)
- Footnotes are missing due to certain combinations of styles. (#8752)
- Footnote markers may overlap each other when "overflow-wrap" is set to "anywhere". (#8926)
Margins, Borders and Backgrounds
- When the CSS property "background" specifies both an origin and a clip rectangle, the value is treated as invalid. (#9145)
- The visualization of the "outline" property ignores the border-radius of the element. (#8970)
- Under certain circumstances the repeating background image of an element is repeated once too often, which is invisible but noticeable in PDFs. (#9062)
- Margins are collapsed incorrectly when the respective elements directly follow empty blocks. (#8656)
- Margin-bottom is used as margin-top under special circumstances. (#8971)
- "box-decoration-break: slice" behaves as "clone" under special circumstances. (#6872)
Image Input
- Some types of TIFF images are converted incorrectly. (#7733, #7735)
- The size of an SVG image is wrong under special circumstances. (#9001)
- The "patternTransform" SVG attribute is not applied when converting to PDF. (#9159)
- The XHTML cleanup tool "Cyberneko" breaks embedded SVGs. (#8684)
- When PDFs are used as images some raster images in those PDFs appear inverted or incorrectly colored in the PDFreactor Preview or in raster image output. (#9081)
- Image has incorrect colors after resampling, auto-conversion to CMYK, PDF/X conformance, and using ICC profile. (#9191)
- SVG "symbol" elements are not found when their root SVG element has "display: none" set. (#7092)
List Items
- List item marker position is wrong if the list item only contains an empty block element. (#8972)
- Alignment of list item marker is wrong under special circumstances. (#7368)
- The paint order of list item markers is incorrect. (#8409)
PDF Forms
- Field values of radio button groups are incorrect when the first button is not checked. (#8573)
- Radio buttons cause duplicate annotations in the PDF. (#8500)
PDF Tagging and Accessibility
- Clipped content, e.g. through the "clip-path" property, is not added to the PDF at all and so not available to screen readers. (#8561)
PDF Gradients (from CSS, SVG or Canvas) (See features)
- Color space conversion of PDF gradients with varying alpha values is inaccurate. (#8060)
- The color components of fully transparent color-stops incorrectly bleed into the neighboring color transitions. This for example causes gray tinges when the "transparent" color keyword is used. (#9219)
- Radial gradients with different center and focus points are converted to PDF gradients with the same coordinates for both points.
Barcodes
- The subtypes of Telepen, Code 2of5, Postnet and DataBar barcodes are not applied correctly.
- Baseline positioning of human-readable text is incorrect when font size is not default. (#8733)
Logging
- The message logged, when rasterized elements (e.g. when using the CSS properties "filter" or "box-shadow") are too large, does not provide enough information. (#8607)
- When a conversion is aborted due to a potentially malicious SVG the exception does not clearly state that. (#8862)
Segmentation
- Enabling PDF tagging nullifies the memory saving effects of segmentation. (#9205)
Performance
- Conversions of documents with many duplicate IDs and target-counters are unexpectedly slow. (#9197)
- The layout of deeply nested grid layouts is slow. (#9048)
- Large data-URIs can slow down conversions significantly. (#8781)
PDFreactor Web Service
- Cannot convert documents from string with more than 20,000,000 characters. (#9052)
- A connection timeout occurs when debug mode is enabled and loading of a resource from a network drive fails. (#7033)
- It is not possible to override the "User-Agent" header sent by PDFreactor Client requests. (#8682)
- The service's automatic temporary file cleanup also removes empty directories without validating their age. (#8692)
Documentation and Samples
- Client samples use file URLs as input documents. (#8627)
- Various documentation-related issues. (#9254, #8922, #8859, #6775)

PDFreactor 11.6.12 (2024-06-12)

The following issues were fixed:

PDF conformance validation is not available when using the monolithic JAR. (#9242)

The following dependencies were updated:

org.bouncycastle.*-1.75 to 1.78.1 (CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-34447)
org.verapdf.*-1.18.x to 1.26.1 (CVE-2024-28109)
PDFreactor Web Service only:
- org.apache.cxf.*-3.5.7 to 3.5.8 (CVE-2024-28752)
- org.springframework.*-5.3.33 to 5.3.36 (#9237, CVE-2024-22262)
- org.glassfish.jaxb.jaxb-runtime-2.3.8 to 2.3.9
- org.eclipse.jetty.*-9.4.53.v20231009 to 9.4.54.v20240208 (CVE-2024-22201)

PDFreactor 11.6.11 (2024-03-22)

The following issues were fixed:

Inline elements with border-radius nested inside link elements can cause exceptions. (#9201)
Page breaks in row-spanning table cells can cause exceptions. (#9203)
Applying display styles to page margin boxes can cause exceptions. (#9111)
Some valid custom XMPs are rejected as invalid and the exception does not contain useful information. (#9169)
Specifying an ICC profile that is not CMYK for color conversion causes internal exceptions instead of specific ones. (#8959)
In some cases grid cells can overflow their pages instead of being moved to the following page. (#8869)
In some cases the content of multi-column spanning elements is unnecessarily placed on the following page. (#9202)
When segmentation is enabled images that are used repeatedly may be embedded into the resulting PDF multiple times, unnecessarily increasing its file size. (#9178)

The following dependencies were updated:

PDFreactor Web Service only:
- com.fasterxml.jackson.*-2.15.3 to 2.17.0 (CVE-2023-35116)
- org.springframework.*-5.3.31 to 5.3.33 (CVE-2024-22243)

PDFreactor 11.6.10 (2024-01-11)

The following dependencies were updated:

PDFreactor Web Service only:
- Jetty application server 9.4.51.v20230217 to 9.4.53.v20231009 (#9150, CVE-2023-44487)
- com.fasterxml.jackson.*-2.15.2 to 2.15.3
- org.apache.cxf.*-3.5.6 to 3.5.7
- org.springframework.*-5.3.28 to 5.3.31

PDFreactor 11.6.9 (2023-09-21)

The following issues were fixed:

The layout of adjacent floats may not terminate under very specific conditions. (#9061)

The following features were implemented:

Box-shadows, text-shadows and filter drop-shadows are no longer rendered if their colors are all fully transparent. This significantly improves performance and output file size for certain frameworks, e.g. Bootstrap 5.2. (#9058)

PDFreactor 11.6.8 (2023-09-05)

The following issues were fixed:

Priorities of connection rules in security settings are reversed. Under specific circumstances this can lead to URLs being erroneously allowed. (#9055)

PDFreactor 11.6.7 (2023-08-25)

The following issues were fixed:

Complex multi-column layouts may not utilize available space for additional columns. (#9049)
Font fallback from specific fonts may cause superfluous line-breaks. (#9046)
Font fallback is not applied to supplementary plane code points. (#9033)
Applying the "clip-path" property with an "inset" value that uses "calc" may cause exceptions. (#9025)
Negative word-spacing erroneously affects empty inline elements at the start of their lines. (#9024)
ICC Profiles of grayscale images are not included in output PDFs. (#9016)
Named strings may be resolved incorrectly on empty pages. (#9010)
Relative positioning is incorrect when "calc" functions are used for "right" or "bottom". (#9009)
The glyphs of some macOS system fonts are not used. (#8878)
In rare cases segmentation can cause significantly increased memory consumption. (#8876, #8877)

PDFreactor 11.6.6 (2023-07-26)

The following issues were fixed:

Bidirectional text affected by "dir" attributes or "unicode-bidi" styles is sometimes reordered incorrectly.
The PDFreactor RPM installer overwrote all files when updating, including files that should be processed as config files. (#8710)

The following dependencies were updated:

org.bouncycastle.*-jdk15on-1.69 to *-jdk18on-1.75 (CVE-2023-33201)
com.fasterxml.jackson.core.*-2.13.4 to 2.15.2
com.fasterxml.jackson.core.jackson-databind-2.13.4.2 to 2.15.2 to match other Jackson dependencies
PDFreactor Web Service only:
- org.apache.cxf.*-3.5.5 to 3.5.6
- org.springframework.*-5.3.22 to 5.3.28 (#8982, CVE-2023-20860, CVE-2023-20861, CVE-2023-20863)
- com.fasterxml.woodstox.woodstox-core-6.2.6 to 6.5.1 (CVE-2022-40152)

PDFreactor 11.6.5 (2023-03-29)

The following issues were fixed:

Characters from the default CJK font can be misaligned when using Java 9 or newer. (#8934)
The Exceeding Content observer does not ignore running elements. (#8933)
Underlines of complex scripts, like Arabic, can be too long. (#8925)

PDFreactor 11.6.4 (2023-03-16)

The following issues were fixed:

The Exceeding Content observer can generate false positives for certain styles, including the default styles for footnotes. (#8923)
PDF signature form fields are not tagged in a PDF/UA compliant way. (#8921)
":first-letter" ignores the properties "text-shadow" and "box-shadow". (#8906)

PDFreactor 11.6.3 (2023-03-07)

The following changes were implemented:

Updated included Jetty application server to 9.4.51.v20230217.

The following issues were fixed:

Updated dependency "CXF" of PDFreactor Web Service to 3.5.5 (CVE-2022-46363, CVE-2022-46364, #8891)
Converting documents without a license key can lead to memory leaks. (#8919)
Creating object URLs in JavaScript can lead to memory leaks. (#8885)
Creating inspectable documents can cause exceptions for certain CSS values like the calc function. (#8914)
Using MathML when converting to continuous raster image output causes exceptions. (#8872)
Page breaks inside absolutely positioned elements can differ based on media size and position origin. (#8751)
Text in SVGs converted to raster image output is erroneously not bold in some cases. (#8895)
<span> elements do not have an HTMLSpanElement prototype in JavaScript. (#8874)
The Image constructor in JavaScript does not create an <img> element. Also the width and height properties of JavaScript Image objects return incorrect values when that element is not part of the DOM and layout. (#8898)

PDFreactor 11.6.2 (2022-12-13)

The following issues were fixed:

Under certain rare circumstances the PDFreactor Web Service can run out of file handles. (#8866)
JavaScript errors can cause exceptions when using JavaScript debugging. (#8816)
Setting "list-style-position: inside" on empty list items causes exceptions. (#8847)
Documents containing "nth-child" or similar CSS selectors and certain DOM structures are excessively slow when updating these structures via JavaScript. (#8850)
Updated dependency "Jackson Databind", as well as related "Jackson" libraries, to 2.13.4.2 (CVE-2022-42003)
Updated dependency "Woodstox" of PDFreactor Web Service to 6.4.0 (CVE-2022-40152)

PDFreactor 11.6.1 (2022-11-16)

The following issues were fixed:

Conversions that are performed after a timed out conversion may throw exceptions and fail in some cases. (#8840)
In certain cases a single-line column flex item that can not be fragmented and is moved to the next page causes incorrect vertical alignment of the previous flex items. (#8830)
In rare cases a flex item that causes a page break causes a second break before the next flex item. (#8836)
The JavaScript "Date" constructor cannot parse ISO dates with milliseconds that are not 3 digits. (#8841, #7939)

PDFreactor 11.6.0 (2022-11-09)

The following issues were fixed:

If the first word in a line with "word-wrap: break-word" overflows and consists of multiple elements
(e.g. a <span> starts inside it), it is erroneously broken to the next line at the boundary of the element. (#8828)
In rare cases, documents that reset page counters on named pages and are changed via JavaScript
may cause exceptions being logged and have incorrect page numbering. (#8805)
Negative bottom margins on a block elements may cause premature page breaks. (#8825)
Forcing multi-column breaks may cause superfluous layouts with no impact on the result. (#5946)

PDFreactor 11.5.1 (2022-10-17)

The following issues were fixed:

Asynchronously converted documents cannot be retrieved from storage under certain circumstances. (#8817)
Table cells with row or column spans can cause exceptions during JavaScript processing. (#8808)
Setting the display style "inline-block" on footnote calls causes exceptions. (#8807)

PDFreactor 11.5.0 (2022-09-20)

The following features and changes were implemented:

The PDFreactor Web Service now defaults to a flat structure for temporary documents,
improving support for document folders shared between instances. (#8783)
Barcode dimensions do not always match the visual size of the content. (#8732)
The JRE bundled with certain installer packages was updated to 17.0.4.1.
The realobjects/pdfreactor Docker image now includes a JRE instead of a JDK.
Also moved from AdoptOpenJDK 15.0.2 to Adoptium Eclipse Temurin 17.0.4.1. (#8788)
Updated realobjects/pdfreactor Docker image from Oracle Linux Server 8.3 to 9.0.
Various dependency updates.

The following issues were fixed:

Updated Jetty server of PDFreactor Web Service. (CVE-2022-2047, CVE-2022-2048)
Using the "clip-path" property causes exceptions on boxes with zero "border-radius". (#8797)
Extremely low font sizes in scaled down documents may cause exceptions. (#8780)
Certain rare table constructs can cause exceptions. (#8756)
Percentage widths of images with max-height are ignored in some situations. (#8790)
In some cases percentage widths in single column flex items are resolved incorrectly. (#8775)
Certain combinations of SVG effects are tiled incorrectly. (#8696)
PDFs used as images or background images are misaligned in some cases. (#8760, #8789)
Clipping/cropping paths of images are misaligned for background images. (#8655)
Gradient backgrounds are missing for line-split boxes. (#8768)
Empty CSS media query lists are not supported. (#8767)
Command line only applies debug mode when a debug dump directory is specified. (#8791)
Linux systems without a font configuration installed cause exceptions. (#8615)
File locks are retained after conversions merging existing PDFs. (#8787)

PDFreactor 11.4.8 (2022-07-07)

The following issues were fixed:

Floats do not influence the height of surrounding inline blocks. (#8704)
Boxes always overflow to the right when they have an explicit width wider than their container, which is incorrect in RTL contexts. (#8711)
In rare cases, elements that contain only out-of-flow elements can cause incomplete layouts. (#8739)
The paint order of independent inlines as well as flex and grid items is incorrect, which can negatively affect selections in PDFs. (#8747)
Trying to get PageDescriptions of empty pages causes exceptions. (#8743)
Scale content functionality is not affected by inline elements containing line breaks and affects log pages. (#7072, #7074)
In the Preview application synthetic bold text can overlap with the following text. (#8728)
Reaction to thread interruption is too slow for some parts of the conversion. (#7017)
PDF segmentation may abort with an exception if the ID of a 'target candidate' element contains quotation marks. (#8738)
Using Systemd logger on some systems can cause an exception on initialization. (#8723)
Documentation is unclear on default font mappings and conformance validation. (#7907, #8661)

PDFreactor 11.4.7 (2022-05-10)

The following issues were fixed:

SVGs in page margin boxes cause conversions to terminate with exceptions. (#8689)
Bookmarks in iframes cause conversions to terminate with exceptions. (#8700)
PDF conformances that prohibit transparency cause conversions to terminate with exceptions when no license key is used. (#8662)
Text in iframes does not reflect all styles, e.g. ignores letter-spacing, when using Java 9 or newer. (#8637)
Updated included Java, if any, to mitigate multiple CVEs.
Updated Jackson dependencies to mitigate CVE-2020-36518.
Updated Spring dependencies of PDFreactor Web Service to mitigate CVE-2022-22968.
Updated CXF dependencies of PDFreactor Web Service to mitigate CVE-2021-40690.

PDFreactor 11.4.6 (2022-04-01)

The following issues were fixed:

Updated Spring dependencies of PDFreactor Web Service to mitigate CVE-2022-22965.

PDFreactor 11.4.5 (2022-03-08)

The following issues were fixed:

Selection of internal font as fallback for missing characters is sometimes incorrect, causing unexpected results, like spaces being too wide. (#8659)
Absolutely positioned boxes without specified horizontal or vertical positions, and consequently to be placed at their static positions, are placed incorrectly when their parents are otherwise empty inline elements. (#8649)
The paint order for absolutely positioned elements is incorrect when their parents are inline elements, which may cause them to be erroneously hidden behind other elements. (#8624)

PDFreactor 11.4.4 (2022-02-17)

The following issues were fixed:

Specifying PDF/UA conformance without PDF/A conformance or an ICC profile causes color keywords to be interpreted as CMYK even when RGB is specified. (#8645)
Debug dump ZIPs are written even when they are empty. (#8641)
The combination of running elements and SVGs requiring font fallback can cause conversions to fail with exceptions. (#8640)
Baselines of table cells are not determined correctly if their rows contain additional cells with only floated elements. (#8636)
Clickable areas of SVG links containing transforms may be incorrect. (#8628)
The JavaScript methods "getComputedStyle" and "ro.layout.getContent" do not recognize pseudo element names that start with one or two colons. (#8626)
PDF links with certain complex shapes can cause an exception to be logged. (#8625)
Shear transforms, especially rotations, cause images to look blurry. (#8608)
Invalid document URLs cause exceptions if the debug setting "forceResult" is enabled. (#8603)
Image recompression has no effect on grayscale images. (#8600)
Table cells with row spans fragmented over multiple pages can cause conversions to fail with exceptions. (#8597)

PDFreactor 11.4.3 (2022-01-27)

The following issues were fixed:

PDFreactor does not support certain third-party class loaders, e.g. Quarkus. (#8630)
Intermittent exception when shutting down the PDFreactor Web Service. (#8631)

PDFreactor 11.4.2 (2021-12-09)

The following features and changes were implemented:

The human readable part of barcodes can now be disabled via the proprietary style "-ro-barcode-human-readable-position: none". (#8589)

The following issues were fixed:

Certain multi-colum layouts containing spanners may cause non-terminating conversions or incorrect layouts. (#8571, #8588)
Changing text content inside tables via JavaScript can cause incorrect layouts as well as logged exceptions. (#8580)
Certain SVG links, including those created by Highcharts since 9.3.2, can cause exceptions. (#8578)
Links with a width or height of 0 can cause exceptions. (#8572)
Specifying a non-existing page for "PDF as image" causes exceptions. (#8576)
Arabic shaping is not applied for the "-ro-glyph-layout-mode" default value "auto" when using Java 12 or older. (#8567)
"list-style" CSS shorthand property is resolved incorrectly, which can cause unnecessary connection attempts. (#8582)
When using hyphenation certain text can overflow its line. (#8577)
Using recompression on grayscale images can cause output that is too dark.
This also affects the alpha channels of recompressed images. (#8584)
The clickable areas of links in SVGs with a viewBox or complex nesting are determined incorrectly. (#8535)
The proprietary CSS property "-ro-links" does not affect replaced elements, e.g. barcodes, correctly. (#8592)
"Pages per Sheet" settings no longer have default values. (#8542)
Error pages for license issues are not written for image output formats. (#8585)
The "systemd" logging functionality is initialized on systems that don't support it, causing errors to be logged. (#8587)

PDFreactor 11.4.1 (2021-11-17)

The following features and changes were implemented:

Flex layout now supports the values "left" and "right" for the CSS property "justify-content". (#8546)

The following issues were fixed:

In certain documents, setting a left or right page break on the last element can cause a blank page to be appended to the end of the document. (#8506)
When CSS custom properties have font relative values, they are resolved against the element where the property is set, instead of where the CSS variable is actually used. (#8521)
Justified text causes unintended fragmentation of PDF attachments and links at word boundaries. (#8528)
Length of leaders is incorrect when leader characters are affected by kerning. (#8530)
Multiple layout passes (e.g. due to JavaScript) can cause inconsistent and incorrect layout in documents with footnotes, including too much whitespace or missing footnotes. (#8531, #8532, #8538)
When a CSS function is missing its closing bracket, the document conversion may not terminate. (#8533)
PDFreactor Web Service server parameter "hideVersionInfo" does not hide the version in PDF metadata. (#8540)
Page margin boxes are no longer created if they have "width" and "height" and no "content" property. (#8544)
In rare cases, a table with collapsed borders may be moved completely to the next page instead of breaking between two of its rows. (#8550)
Using segmentation mode may cause incorrect order of PDF bookmarks. (#8554)
Certain PDFs cause exceptions when merged using PDFreactor. (#8556)
PDFreactor throws exception if a page margin box with "width" and "height" but no "content" property is used. (#8557)

PDFreactor 11.4.0 (2021-09-24)

The following features and changes were implemented:

Improved determination of dimensions of SVGs without explicit width and height. (#8491)
Updated the column count computation of multi-column elements to the latest specifications. See the migration guide on how to mitigate possible changes. (#8512)
The content of multi-column elements is no longer visually clipped to its column and thus is allowed to overflow into the next column, as per the specification. This can be reverted via the custom CSS property "-ro-column-clip". (#8494)
Improved handling of the parameters of the CSS function "var". It is now possible to specify a fallback that contains commas or spaces. (#8482)
Improved quality of image downsizing for image output, especially for factors of more than 2. (#8498)
Grid layouts now support baseline alignment. (#8395)
Table root elements now support the "min-width" and "max-width" CSS properties. (#8450)
The "safe" and "unsafe" keywords of the alignment properties are now supported in all formatting contexts. (#8518)
Barcode content taken from the element content now collapses spaces based on the white-space CSS property. (#8448)
Improved error handling for barcodes. (#8447)
If necessary, interactive PDF forms now use a fallback font that can display most of the content at conversion time. (#8429)
PDF viewers now correctly highlight attachment annotations. (#8488)
Form fields support additional flags as well as the "maxlength" HTML attribute. (#8434)
Form field annotations now contain a reference to the page they are laid out on. (#8496)
ICU4J missing or being outdated is now logged. (#8445)
Added HTTP2 module to Jetty (see start.d/http2.ini). (#8475)
Various improvements to multi-column, flex and grid layouts as well as fixed tables inside flex layouts.
Various engine updates.
Various dependency updates. (#8476)

The following issues were fixed:

JavaScript Dates before the year 1600 are inaccurate, breaking Plotly.js graphs that contain dates. (#8408)
The "removeAttribute" function does not clear inline style or class list. (#8511)
Certain combinations of multi-column inside a region lead to columns not being laid out. This also prevents the detection of exceeding content of this column. (#8501)
Floated boxes with a height of zero should have no influence on the position of following floated boxes. (#8514)
Flex container with negative margins and border-box sizing causes issues with the sizing and placement of its items. (#8508)
Multi-column layouts are not supported inside grid items. (#8437)
Table row groups cannot be used as running elements if the preceding group is a header or footer group. (#8432)
PDFreactor throws exception if a page break is caused by a table with cells with absolutely positioned content only. (#8444)
PDFreactor throws exception if a multi-column layout is scaled down with a small value for -ro-scale-content. (#8315)
PDFreactor throws exception if a running element uses block elements inside inline elements. (#6215)
PDFreactor throws exception in certain complex documents. (#8505)
The CSS function "rgb" causes an exception if there are missing parameters set using the "var" function. (#8483)
CSS style properties of a page margin box are not applied, if they use CSS variables. (#8486)
In certain cases, the usage of a cross-reference at a break, whose target is in the same paragraph, causes an exception. (#8451)
CSS style sheets that cannot be loaded via @import rules cause an exception. (#8461)
Font names cannot be properly read by Adobe Illustrator. (#8516)
Updated Xerces, solving CVE-2012-0881. (#8489)
Security setting "hideVersionInfo" does not hide the version in PDF metadata. (#8490)
Node.js client separates cookies in HTTP header with comma instead of semicolon. (#8497)
Systemd logger does not log any conversion information. (#8466)
Pages Per Sheet mode must be more robust towards erroneous input. (#8455)

PDFreactor 11.3.1 (2021-08-10)

The following issues were fixed:

Tables with auto margins and percentage widths are not centered if they are nested within another table with percentage widths. (#8467)
Images floated to top or bottom as page floats have a height of zero. (#8453)
Having a region layout container on a page can make the footnote area on that page disappear. (#8458)
Floating an element to the top as a page float causes text on that page (or column) to no longer snap to its line grid. (See manual for details.) (#8454)
Page breaks are applied to the contents of absolutely positioned elements too early if bottom margins, borders or paddings are set on any of their ancestors. (#8449)
In rare cases, a page break in the content of a multi-column element causes an exception. (#8471)
A rare element structure causes an exception in certain cases. (#8479)
Style of empty trailing "tspan" SVG element following space is applied to previous character. (#7011, #8464)
RGB raster image in SVGs are color space converted for CMYK output PDFs, even when such conversion is not enabled. (#8438)
PDFreactor Web Service Monitoring API does not return IDs of queued conversions. (#8456)
Documentation of server parameter "systemdLogLevel" is incorrect. (#8462)
Documentation of barcode Code 3 of 9 is incorrect. (#8480)

PDFreactor 11.3.0 (2021-06-30)

The following features and changes were implemented:

PDFs as image sources are now also displayed in image output and the Preview Application. (#6921)
Added preliminary support for WebP, lossy simple VP8 only. (#7795)
Added support for the validation of PDF/UA documents. (#8269)
Added support for URL rewrites via the API property "urlRewriteSettings". (#8352)
Form fields, incl. signature fields, can now be set to "read-only", "required" or "no-export" via the proprietary CSS property "-ro-pdf-form-field-flags" or matching HTML attributes. (#8372)
Improved determination of clickable areas of links and added the proprietary CSS property "-ro-link-area" for further configuration. (#8368)
The scroll coordinates for bookmarks and internal links are now configurable via the proprietary CSS property "-ro-destination-area", including improved default behavior. (#8371)
Implemented the prefixed CSS property "-ro-overflow-clip-margin". (#8387)
Added support for the FusionCharts JavaScript library. (#5348)
Significantly improved performance of documents with very large floated elements. (#7798)
PDF conformance adapting configuration options is now logged in detail.
Added support for piping (stdin in addition to stdout) for the Java Command Line API. (#8351)
Added support for file URLs outside of asset packages (when security settings allow it). (#8339)
Logging to "journalctl" is now supported and can be configured through the "systemdLogLevel" parameter. (#8276)
Improved PDFreactor client async samples so that they use connection settings objects. (#8381)
Added basic Docker documentation to PDFreactor manual. (#8380)
The netstandard2 pdfreactor.dll is now located in netstandard2/lib instead of netstandard2/bin. (#8355)

The following issues were fixed:

Non-content strings in PDF tagging, like Alt-texts, ignore non-Latin characters. (#8344)
Base64 data URIs fail to decode if they contain spaces. (#8423)
Redirected document URLs are not used as default base URL. (#8397)
Hyphenation of some non-lowercased words is incorrect. (#8415)
JavaScript "String()" and "new String()" ignore "toString" functions. (#8436)
PDF tagging for elements with z-index can cause exceptions. (#8413)
PDFreactor throws an exception when a block element inside an inline element is removed via "display: none". (#8200)
An exception occurs in some documents when inserting content into a multi-column element via JavaScript. (#8426)
XMLHttpRequests blocked by security settings can cause Java exceptions instead of handling the error in JS. (#8407)
PDFreactor throws an exception when a document is manipulated via JavaScript in a special way. (#8417)
Percentage max-widths of replaced elements inside table cells are not supported. (#8389)
Percentage values inside certain absolute positioned elements are not resolved correctly. (#8369)
The percentage width of a fixed table is wrong if the table is part of a shrink-to-fit layout. (#8193)
Certain floated elements are positioned incorrectly and have a zero width if spread across pages. (#8427)
In rare cases multi-column elements are moved to the next page too early. (#8431)
In certain contexts too much content is moved to the next page due to bottom margins. (#8435)
Absolutely positioned elements inside relatively positioned elements overflow the page instead of being fragmented correctly. (#8441)
In some cases the "break-inside: avoid" style set on an ancestor of a replaced element flex item is ignored. (#8394)
The proprietary CSS pseudo-class selector ":-ro-no-content" does not match elements that contain zero-width or other spaces. (#8377)
Content with zero width is still underlined. (#8378)
There are thin lines between box-shadows and elements with opaque background. (#8412)
Overriding the tagging of list items can cause invalid PDF tag tree structure. (#8406)
PDF/UA unnecessarily disables encryption and PDF scripting. (#8404)
Error policies should not be disabled when document is converted in debug mode. (#8341)
Link text spread across lines creates multiple link annotations instead of one with multiple areas. (#8439)
PDF signature fields are not properly registered as form fields and missed by 3rd party tools when there are no other form elements. (#8382)
When a user without user.home runs PDFreactor the font cache is created in the root directory. (#8420)
Node.js client cannot stream directly into Express response objects. (#8374)
Update Jetty XML configuration files to match application version. (#8273)

PDFreactor 11.2.2 (2021-04-28)

The following features and changes were implemented:

Declaring a form element as a signature field now disables the form annotation. (#8364)
Single-byte encoding specified inside document with apparent multi-byte encoding is now ignored in favor of heuristic detection. (#8361)
Updated dependency ICU4J to version 69.1, which includes Unicode CLDR 39.
Various minor dependency updates, incl. Jetty.

The following issues were fixed:

When SVGs without any specified dimensions are flex items their size may be incorrect. (#8362)
Images are erroneously influenced by floats in different containers. (#8348)
Percentage sizes relative to flex items are not resolved correctly if the item is not stretch aligned. (#8356)
In some cases, a float right after a page break is not positioned correctly, overlapping text. (#8366)
Color space conversion replaces CSS spot colors with their converted alternative colors (instead of preserving the spot colors and converting only the alternative colors). (#8373)
Changing the inline style of an element via JavaScript can lead to incorrect named pages. (#8345)
In certain documents, an exception can occur when text flows around a floated box directly after a page break. (#8358)

PDFreactor 11.2.1 (2021-03-24)

The following issues were fixed:

Images with fixed widths and auto heights in flex layouts have zero heights after certain breaks. (#8335)
Nested grid containers directly in flex containers cause unexpected page breaks. (#8329)
Merging specific PDF documents requires excessive amounts of time and memory. (#8347)
When using Java 16, JavaScript methods that accept functions as parameters are not called correctly.
Vertical coordinates of PDF tag BBox attributes are offset. (#8346)
The order of bookmarks erroneously depends on the stacking contexts of elements. (#8338)
The content of block elements in inline link elements is not clickable. (#8333)
User specific font folder is not scanned for system fonts on Windows. (#8340)
Documentation of PDFreactor Webservice callback states incorrect time units. (#8331)

PDFreactor 11.2.0 (2021-02-25)

The following features and changes were implemented:

Highcharts 9.0 is now supported.
The CSS property "outline-offset" is now supported. (#8310)
Improved support for the min-content and max-content property values in conjunction with grid layouts.
URLs with "about" scheme are now handled specifically.
The PDFreactor Webservice Jetty now contains a sample "proxy.ini". (#8321)

The following issues were fixed:

PDFreactor Web Service can become slow when the document is written to disc. (#8323)
The aspect ratio of images that are flex items is not applied correctly in certain cases, sizing the images incorrectly or distorting them. (#8312)
Large images with a cyclic percentage "max-width" are too wide if they are part of a shrink-to-fit computation. (#8326)
Tables with "width: auto" are too wide if they have a horizontal margin. (#8327)
Table cell width computation is wrong in tables with "table-layout: auto" in certain cases. (#7246)
"box-sizing: border-box" is not evaluated for shrink-to-fit widths in several cases (including table cells).
Inline styles being updated for "style" attribute changes can be accidentally disrupted via DOM events.
The "className" DOM property of SVG elements does not return an SVGAnimatedString.
PDF segmentation can cause internal links to not point to the first page of the target element. (#8319)
PDFreactor Web Service callbacks use GET requests instead of POST. (#8324)
Specifying "debugSettings" "all" does not set the log level. (#8325)
The "disableSystemFonts" option is documented incorrectly. (#8316)

PDFreactor 11.1.0 (2021-02-05)

The following issues were fixed:

PDFreactor throws exception when an element inside a multi-column has "display" set to "table". (#8304)
URLs containing line breaks are deemed invalid instead of being cleaned up. (#8294)
Style sheets referenced via @import rules and containing BOMs have their first rule ignored. (#8271)
Borders are missing in some cases where the height of their elements is zero. (#8302)
Images with percentage max-heights do not contribute to grid row height. (#8286)
Height of image is zero when it has a max-height with a percentage "calc" function. (#8277)
Block image does not shrink-to-fit in table if an explicit width is set on its cell. (#6638)
Items of a wrapped column flex container, with auto margins in cross direction, are sized as if stretched.
Size of flex items is incorrect in certain cases when using percentage values. (#8101, #8244)
Absolutely positioned images with percentage max-height lose their aspect ratio in grid layouts. (#8281)
Break styles on elements inside floated elements are ignored. (#8172)
Illegal property values interrupt parsing of style sheets of external SVGs. (#8154)
The "overflow" CSS property may disable overprinting for following elements. (#8278)
Canvas arcs ending in quarter circles cause additional lines to be drawn. (#8047)
Table captions are not handled properly if their caption-side differs from their DOM position. (#7634, #7667)
Bottom caption is not displayed correctly in tables broken across multiple pages or columns. (#7243, #7435)
Unexpected page break before table if it contains a bottom caption as first child of the table element. (#7633)
Node.js client does not handle exceptions. (#8303)
Java client cannot send document containing non-UTF-8 encoded special characters. (#8248)
Java client throws exception when Exceeding Content feature is used. (#8230)
PDFreactor does not warn that merging PDFs is not possible when using an invalid license key. (#8288)
Segmentation does not handle server timeouts, potentially keeping failed conversions in memory. (#8285)
Additionally, it now preloads up to 100 MB of the input document to avoid server timeouts.

The following features and changes were implemented:

When specifying a local debug directory, debug files are now zipped and dumped regardless of whether the conversion finishes successfully or not. (#8287)
A JSON schema for the data models consumed or produced by the PDFreactor Web Service is available under /rest/schema. (#8191)
Security connection rules can now filter connections depending on their resource type.
Blob URLs are no longer subject to connection security rules, similar to data URIs.
The CSS property "gap" is now supported for flex layout, on top of grid and multi-column. (#8146)
Footnote calls inside non-first repeated table headers or footers are now suppressed.
"table-layout: fixed" is no longer allowed for tables with a width of "max-content".
Table captions are now recognized as captions even if there are no rows, cells or row groups.
The PDFreactor Web Service now provides more information on missing files from configuration parameters. (#8218)

PDFreactor 11.0.1 (2021-01-26)

The bug fixes include:

Fixed an issue in the license check mechanism. (#8300)

PDFreactor 11.0.0 (2020-12-11)

The changes include:

Please refer to the migration guide for more information as these changes might impact existing integrations.
The minimum requirement is now Java 8, recommended is Java 15.
Parts of the API have changed and some configuration properties have been deprecated.
The deprecated legacy Java API has been removed.
The command line interface has changed, now accepting only simple parameters as well as a JSON string for more complex configurations. (#8202)
CSS parsing and handling as well as some defaults have been adapted to more closely match specifications and browser behavior. (#7737, #7761, #7985)
The CSS function "attr" now accepts the correct parameters (name, type, fallback), same as "-ro-attr". (#6361)
For consistency counters and named strings can no longer be manipulated in running elements or table headers or footers that are not on the first page of their table.
On errors the PDFreactor Web Service clients now throw exception objects containing the available result data. (#7678)
When detecting whether the input document is HTML the doctype name is now checked in addition to the root element name. (#7927)
Generic font families are now always resolved to core fonts, when those are available. (#8081)
The previous barcode and QR code functionalities have been deprecated in favor of a new one (see below).
Removed the "ro.zugferd" JavaScript object.
The Web Service Wrapper APIs have been renamed to Web Service Clients.

The new features and improvements include:

The new configuration property "inspectableSettings" enables the creation of documents that contain extensive layout and style metadata. Those documents can be analyzed using the PDFreactor Inspector (currently in beta). Please see pdfreactor.com for further information.
Support for CSS Grid Layout. (#6894)
The CSS property "float" now supports the values "-ro-top" and "-ro-bottom", which turn boxes into page floats, i.e. floats them vertically to the top or bottom of their page or column. (#6315)
Added support for HTML image maps. (#8020)
Introducing new barcode functionality, controlled entirely via proprietary CSS and adding support for many new types, including "Aztec Code" and "MaxiCode", deprecating the previous functionalities. (#3170, #5599, #5659)
Support for the visual CSS properties "clip-path", "mix-blend-mode" and "empty-cells" has been added. (#7528, #7582, #8235)
The new proprietary pseudo-elements "::-ro-before-break" and "::-ro-after-break" allow specifying continuation markers that will be visible at every break between the pages the element is fragmented across. (#6823)
Custom counter styles and list style types can now be specified via "@counter-style" rules, including extensions to existing counter styles. (#7747)
Line breaking behavior is now configurable via the CSS property "-ro-line-break-opportunity", which can amend or replace the default behavior from the Unicode Standard. (#6794)
The new proprietary value "-ro-scale-down" of the CSS property "text-overflow" allows visually scaling down paragraphs that overflow at the end of lines to automatically make their text fit their width. (#7987)
Absolutely positioned elements can now be placed relative to the trim or bleed box via the proprietary CSS property "-ro-position-origin", which can override their containing block to any page box. Also, the default containing block determination has been improved, mostly for page boxes. (#6140, #7843)
Encoding detection from content, like HTML "meta" elements with "charset", is now more robust. Heuristic detection from the text content has also been improved. (#7316)
Orientation and resolution are now read from image metadata, like EXIF. The orientation is applied automatically, but can be overridden via the CSS property "-ro-image-orientation". By default, the resolution is not applied, which can be changed via "-ro-image-resolution". For PDFs used as images the orientation is read per page. (#5074, #6787, #7142, #8089)
Image clip paths can now be disabled via the new proprietary CSS property "-ro-image-clip-path". (#7141)
Text layout has been improved for non-Latin scripts. This allows Khmer (Cambodian) text to be laid out correctly. This can also be enabled for Latin via the proprietary CSS property "-ro-glyph-layout-mode", which enables support for OTF ligatures. (#7018)
Support for the creation of change bars, via the proprietary CSS property "-ro-change-bar". (#7577)
Footnotes in multi-column layouts are now handled per column. Also, footnotes can now be laid out in various ways by applying the CSS properties "display" or "-ro-footnote-display" to the footnote area. (#6191, #7833)
Support for binary data in JavaScript has been improved, including support for "Blob" objects. XMLHttpRequest can now return Blob, ArrayBuffer and "x-user-defined" strings. Blobs can also be retrieved from "canvas" elements, converted via FileReader as well as passed to URL.createObjectURL() and PDF attachments. This adds support for libraries like JSZip. (#7679)
Text can now be transliterated, e.g. from various non-Latin scripts to Latin, via the new value "transliterate" of the proprietary CSS property "-ro-text-replace". (#8104)
Digital signature fields can now be added to PDF forms via the proprietary CSS property "-ro-pdf-signature-field-name". (#6720)
PDF pages can now be rotated (in PDF viewers that support it) in 90° steps via the new proprietary CSS property "-ro-pdf-page-rotation". (#7293)
Image output now optionally accepts a pixelDensity API property to determine the size of images. It can now also dither GIF and monochrome TIFF CCITT output and writes resolution metadata to PNG, JPEG and TIFF output. (#7731, #7732)
Authentication credentials that are part of a URL are now used when accessing that URL. (#7515)
The "font-weight" CSS property now accepts any number from 1 to 1000. (#7580)
The "rgb" and "rgba" CSS color functions are now synonymous, with an optional alpha value, and additionally support the new color syntax. The same applies to "hsl" and "hsla". (#7546, #8087)
"BoxDescription" JavaScript objects now contain information about the generated content of non-inline elements. (#8219)
"PageDescription" JavaScript objects now contain PDF page box rectangles, like "bleedRect". (#7877)
Unprefixed the CSS property "-ro-bleed-width" to "bleed" and added the value "auto".
Unprefixed the CSS property "-ro-marks". Please note that "marks" has different values.
Unprefixed the CSS properties "-ro-bookmark-level", "-ro-bookmark-label" and "-ro-bookmark-state".
CSS gradient functions now support multi-position color stop syntax. (#7978)
CSS resources not loaded due to connection security are now logged more verbosely. (#7937)
The size of small-caps is now based on the font. (#7548)
Conversion timeouts can now be specified per conversion, via the configuration property "conversionTimeout". This is more reliable than the previous Java functionality. Also, separate timeouts can be specified for JavaScript processing. (#8071, #8072)
Uncaught exceptions in JavaScript will now optionally terminate the conversion. This is configurable via an error policy. (#7647)
Version information can now be hidden from PDF metadata and HTTP communication via the "hideVersionInfo" security setting. (#7963)
When requesting HTTP resources, PDFreactor now includes "Accept" headers with values matching the expected formats. (#7942)
The "licenseKey" configuration property now also accepts URLs. (#5986)
There is now a POM containing all dependencies of the modular PDFreactor JAR. (#6079)
The Python command line now supports Asset Packages as input. (#7550)
Conversion requests to the PDFreactor Web Service can now be prioritized via the configuration property "requestPriority". (#7558)
Multiple PDFs converted via the PDFreactor Web Service can now be downloaded as a bundle, i.e. a ZIP file. (#7031)
The PDFreactor Web Service .NET client now targets .NET Standard 2.0. (#7617)
The PDFreactor Web Service Java client can now be integrated in OSGi environments. (#7400)
The network port used by the PDFreactor Web Service can now be configured in the installer. (#7820)
The log level for conversions via the PDFreactor Web Service now defaults to the "serverLogLevel" server parameter. (#7701)
The favicon of the PDFreactor Web Service can now be changed. (#8012)
PDF Segmentation now warns about specific document-related issues that may cause unexpected results. (#8213)
Debug mode now attaches the configuration of the conversion to the output PDF as JSON. (#8010)
Significantly optimized performance for various functionalities, including huge tables, repeated inline style updates, large amounts of target counters, debug mode and safe memory mode. (#7564, #8007, #8261)

The bug fixes include:

Corrected various cases that lead to conversions terminating with exceptions. (#6143, #7345, #7465, #7522, #7637, #7720, #7787, #7824, #7838, #8009, #8035, #8069, #8091, #8093, #8116, #8134, #8215, #8253)
Layout and general issues when using JavaScript processing haven been resolved. (#6081, #7785, #7997, #8026, #8169)
Float layout has been revised, solving multiple layout issues. (#6099, #7654, #7810, #7813, #8011, #8133)
The computation of target-counter values is now more robust, avoiding incorrect results in specific cases. (#7292, #7869)
Flex layout have been enhanced to handle complex cases correctly. (#7845, #7883, #7958, #8131, #8176, #8194)
Corrected page breaks in and around flex layouts for special cases. (#7867, #7928, #8127)
Some unexpected behaviors in table layout have been corrected. (#6184, #8003, #8187, #8201)
Table width computation has been refined to be more browser-like. (#6666, #7146, #7506, #7871)
Layout of nested tables has been corrected for some cases. (#6601, #7661, #8004, #8028)
Page breaks in and around tables are now placed as expected in various special cases. (#5643, #7615, #7616, #7736, #7996, #8203, #8239)
Table and cell borders at page breaks are handled correctly for more cases. (#6788, #6789, #7809)
SVG 1.2 features are now supported for all SVGs. (#7305)
SVGs are now handled correctly when they contain elements with namespaces. (#6792)
Embedded SVGs now respect the "overflow" CSS property, still defaulting to "hidden" for HTML parent documents. (#7535)
Links in SVG are now correctly applied in nested structures. (#8020, #8096)
SVGs are no longer affected by translucent borders in PDFs. (#8232)
Setting 'value' on a TextArea in JavaScript now has the expected visual result. (#8242)
Setting 'list' attribute on an Input element no longer makes that element invisible. (#8076)
Large elements with "break-inside: avoid" are now moved to the following page consistently. (#7782)
Auto height of positioned elements with multiple child elements is now resolved correctly from the "top" and "bottom" CSS properties. (#7825)
Absolutely positioned elements that are fragmented across multiple pages no longer affect subsequent non-positioned content. (#7818)
The influence of HTML "br" elements on line height has been refined to be more browser-like. (#7853)
Text segmented by inline elements no longer overflows lines in cases where those elements do not match up with the line break opportunities. (#7642)
Elliptic radial gradients are now sized and positioned correctly when the vertical radius is the larger one. (#7994)
Overflow values making elements monolithic now have priority over forced break styles. (#8000)
Named pages specified following empty elements are now processed correctly. (#8245)
Running elements interacting with other running elements or named strings are now handled correctly. (#7344, #8126)
Page break behavior around multi-column spans containing break styles is now correct. (#8058)
The bullets of list items with "list-style-position: inside" are now positioned correctly for all text-alignments and directions. (#8231)
"scrollWidth" and similar properties, available via JavaScript, no longer return "0" for "inline-block" and similar display types or images. (#8255)
Combinations of the "transform" and "opacity" CSS properties are now correctly converted to PDF structures. (#8130)
The "transform-origin" CSS property no longer ignores certain combinations of values. (#8095)
Tables with border-radius now handle hidden overflow correctly for cell backgrounds. (#8027)
getComputedStyle() in JavaScript now consistently takes into account the "pixelsPerInch" and "pixelsPerInchShrinkToFit" configuration properties. (#7537)
PDF/UA-1 conformance no longer forces output intents. (#7703)
The PDFreactor Web Service configuration file is now read correctly on Windows. (#7698)
The PDFreactor Web Service will now respond with an appropriate error message if the requested content type of a conversion does not match the configured output format. (#7536)
Eliminated erroneous warning messages produced by certain REST resources from the log output. (#7855)
Querying the PDFreactor Web Service status via "/rest/status" no longer increases the conversion counter of the monitoring REST API. (#8184)
Exceptions for license key issues are now properly thrown when configured. (#7666)
Fonts that are not embedded now have bold and italic applied correctly. (#8085)
Block images inside inline elements are no longer positioned incorrectly due to lack of margin collapsing. (#6401)
The "name" attribute of HTML anchor elements no longer has priority over the "id" attribute. (#8098)

Release History

PDFreactor 12.7.1 (2026-08-14)

The following issues were fixed:

The following CVEs in 3rd party dependencies were mitigated:

The following dependencies were updated:

PDFreactor 12.7.0 (2026-06-30)

The changes include:

The following issues were fixed:

PDFreactor 12.6.1 (2026-06-19)

The following issues were fixed:

The following CVEs in 3rd party dependencies were mitigated:

The following dependencies were updated:

PDFreactor 12.6.0 (2026-05-13)

The new features and improvements include:

The following issues were fixed:

The following CVEs were mitigated:

The following dependencies were updated:

PDFreactor 12.5.0 (2026-03-25)

The following issues were fixed:

The following CVEs were mitigated:

The following functionalities were deprecated:

The following dependencies were updated:

PDFreactor 12.4.0 (2025-12-04)

The following issues were fixed:

The changes include:

The following CVEs were mitigated:

The following dependencies were updated:

PDFreactor 12.3.2 (2025-10-30)

The following issues were fixed:

The following CVEs were mitigated:

The following dependencies were updated:

PDFreactor 12.3.1 (2025-10-01)

The following issues were fixed:

PDFreactor 12.3.0 (2025-09-05)

The new features and improvements include:

The changes include:

The following issues were fixed:

The following functionalities were deprecated:

The following CVEs were mitigated:

The following dependencies were updated:

PDFreactor 12.2.1 (2025-07-02)

The following issues were fixed:

PDFreactor 12.2.0 (2025-06-16)

The new features and improvements include:

The changes include:

The following issues were fixed:

The following functionalities were deprecated:

The following CVEs were mitigated:

The following dependencies were updated:

PDFreactor 12.1.0 (2025-03-05)

The new features and improvements include:

The changes include:

The following issues were fixed:

The following dependencies were updated:

Documentation updates include:

PDFreactor 12.0.2 (2024-11-21)

The following issues were fixed:

The changes include:

PDFreactor 12.0.1 (2024-11-13)

The following issues were fixed:

The changes include:

PDFreactor 12.0.0 (2024-10-16)

The new features and improvements include:

The changes include:

The bug fixes include:

PDFreactor 11.6.12 (2024-06-12)

The following issues were fixed:

The following dependencies were updated:

PDFreactor 11.6.11 (2024-03-22)

The following issues were fixed:

The following dependencies were updated:

PDFreactor 11.6.10 (2024-01-11)

The following dependencies were updated:

PDFreactor 11.6.9 (2023-09-21)

The following issues were fixed:

The following features were implemented:

PDFreactor 11.6.8 (2023-09-05)

The following issues were fixed:

PDFreactor 11.6.7 (2023-08-25)

The following issues were fixed: