What's new

Security (SEC)

• Limit the allowed size of xref and object streams (#3733) by @stefan6419846

Robustness (ROB)

• Consider strict mode setting for decryption errors (#3731) by @stefan6419846

Documentation (DOC)

• Use new parameter names for compress_identical_objects by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Disallow custom XML entity declarations for XMP metadata (#3724) by @stefan6419846

New Features (ENH)

• Skip MD5 key derivation for AES-256 encrypted PDFs (#3694) by @Ygnas

Bug Fixes (BUG)

• Use remove_orphans in compress_identical_objects (#3310) by @j-t-1
• Fix PdfReadError when xref table contains comments before trailer (#3710) by @rassie
• Correctly verify AES padding during decryption (#3699) by @stefan6419846
• Fix stale object cache from non-authoritative object streams (#3698) by @astahlman
• Fix extract_links pairing when annotations include non-links (#3687) by @ReinerBRO

Documentation (DOC)

• Add AI policy (#3717) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Avoid infinite loop in read_from_stream for broken files (#3693) by @stefan6419846

Robustness (ROB)

• Resolve UnboundLocalError for xobjs in _get_image (#3684) by @Yuki9814

Full Changelog

What's new

Security (SEC)

• Improve performance and limit length of array-based content streams (#3686) by @stefan6419846

Full Changelog

What's new

New Features (ENH)

• Expose /Perms verification result on Encryption object (#3672) by @costajohnt

Performance Improvements (PI)

• Fix O(n²) performance in NameObject read/write (#3679) by @dmitry-kostin
• Batch-parse all objects in ObjStm on first access (#3677) by @dmitry-kostin

Bug Fixes (BUG)

• Avoid sharing array-based content streams between pages (#3681) by @stefan6419846
• Avoid accessing invalid page when inserting blank page under some conditions (#3529) by @j-t-1

Full Changelog

What's new

Security (SEC)

• Limit allowed /Length value of stream (#3675) by @stefan6419846

New Features (ENH)

• Add /IRT (in-reply-to) support for markup annotations (#3631) by @costajohnt

Documentation (DOC)

• Avoid using PageObject.replace_contents on PdfReader (#3669) by @stefan6419846
• Document how to disable jbig2dec calls by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Improve the performance of the ASCIIHexDecode filter (#3666) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Allow limiting output length for RunLengthDecode filter (#3664) by @stefan6419846

Robustness (ROB)

• Deal with invalid annotations in extract_links (#3659) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Use zlib decompression limit when retrieving XFA data (#3658) by @stefan6419846

Full Changelog

What's new

Security (SEC)

• Prevent infinite loop from circular xref /Prev references (#3655) by @rampageservices

Bug Fixes (BUG)

• Fix wrong LUT size error (#3651) by @stefan6419846
• Fix handling of page boxes defined on /Pages (#3650) by @stefan6419846

Full Changelog