Commit 46efa4d
authored
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
Bump itextpdf.version from 9.6.0 to 9.7.0 (#2746)
Bumps `itextpdf.version` from 9.6.0 to 9.7.0.
Updates `com.itextpdf:kernel` from 9.6.0 to 9.7.0
Updates `com.itextpdf:itext-core` from 9.6.0 to 9.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/itext/itext7/releases">com.itextpdf:itext-core's
releases</a>.</em></p>
<blockquote>
<h1>iText Core/Community 9.7.0</h1>
<p>Our third iText Core release of 2026 brings some significant new
capabilities. We've added support for the WebP image format, introduced
dynamic page margins and footnotes to the layout module, and
strengthened decompression bomb protection. We've also improved append
mode reliability and updated several security-related dependencies.</p>
<h2>WebP Image Format Support</h2>
<p>iText now natively supports the WebP image format, developed by
Google to provide superior lossless and lossy compression for web
images. This new capability allows you to integrate high-quality, highly
compressed modern web images directly into your PDF workflows,
significantly reducing file sizes without sacrificing visual
fidelity.</p>
<p>Our implementation uses the TwelveMonkeys ImageIO library for WebP
decoding on Java and is delivered as a separate, optional module:
<code>webp-image-support</code>. When the module is present on the
classpath, iText Core automatically detects and processes WebP images
without requiring any additional configuration.</p>
<h3>Capabilities</h3>
<ul>
<li>Automatic WebP image type detection via ImageTypeDetector</li>
<li>Lossy and lossless WebP image decoding</li>
<li>ICC color profile handling for accurate color reproduction</li>
<li>Transparency (alpha channel) support</li>
<li>Base64-encoded WebP images in HTML/SVG sources</li>
</ul>
<h3>Notes/Limitations</h3>
<ul>
<li>For animated WebP images only the first frame will be rendered.</li>
<li>The rotation property is not (yet) supported, but browsers currently
ignore this anyway.</li>
<li>The module is not currently supported on Android, due to the
<code>javax.awt</code> and <code>imageio</code> decoding libraries not
being available.</li>
</ul>
<h2>Dynamic Margins & Footnotes</h2>
<p>We have completely overhauled the way iText handles complex document
layouts. This not only allows developers to adjust page margins on the
fly, but also includes footnote support with automatic numbering,
customizable footnote containers, and intelligent layout logic that
ensures footnote anchors and text remain perfectly positioned.</p>
<p>To achieve this, we have introduced a powerful new framework for
managing complex document layouts. This overhaul allows developers to
adjust page margins on the fly using the new SectionBreak element.
Additionally, we’ve launched comprehensive footnote support, enabling
automatic numbering, customizable footnote containers, and intelligent
layout logic that ensures footnote anchors and text remain perfectly
positioned.</p>
<h2>Signatures and Validation</h2>
<p>We’ve resolved critical issues related to Append Mode, ensuring that
incremental updates to PDF documents are more reliable. This includes
better tracking of modified objects and fixing stream inconsistencies,
allowing for a more robust document history and preservation of digital
signatures.</p>
<p>Page rotation handling for signature layers is also improved, and we
fixed some edge-case crashes during form flattening.</p>
<p>To ensure uninterrupted support for digital signature validation, we
have released a new version of our EU Trusted Lists resources. This
update incorporates the recently updated European Journal sources,
maintaining compliance with the latest eIDAS standards.</p>
<h2>Security and Stability</h2>
<p>iText’s protection against "decompression bombs" inside PDF
streams has been enhanced, particularly for single /FlateDecode streams
and image-based decompression bombs. The change applies a 100× growth
factor limit to all streams by default. Note that the existing API to
override protection remains in place, in cases where edge cases may
trigger false positives. However, this should be extremely unlikely for
real-world uses cases.</p>
<p>Additionally, we have implemented a high-level safety mechanism to
detect and terminate infinite layout loops, and the Jackson JSON
dependency for Java has been bumped from 2.21.2 to at least 2.22.0 to
resolve CVE issues.</p>
<h2>Pull Requests</h2>
<p>For this release we've incorporated two pull requests. The first is
from iText alumni <a href="https://github.com/denighte">Dmitry
Radchuk</a> to <a
href="https://redirect.github.com/itext/itext-java/pull/310">add
support</a> for the :is() and :where() selectors for the
styled-xml-parser module utilized by the pdfHTML add-on. Therefore, full
details can be found in the <a
href="https://github.com/itext/itext-pdfhtml-java/releases/tag/6.3.3">pdfHTML
6.3.3</a> release notes.</p>
<p>The <a
href="https://redirect.github.com/itext/itext-java/pull/318">other pull
request</a> comes from <a
href="https://github.com/netliomax25-code">Netliomax25</a> who proposed
a way to increase security in iText’s PDF/UA accessibility checks,
specifically for rich text inside annotations. The fix swaps in a
hardened XML parser to block potential XML External Entity injection
attacks.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/itext/itext-java/commit/bf7a554be39cb5418c248b0cc1f64c6fa2a3258d"><code>bf7a554</code></a>
[RELEASE] iText 9.7.0</li>
<li><a
href="https://github.com/itext/itext-java/commit/7b3e71384b201734393b93239a74041d3262d6f0"><code>7b3e713</code></a>
Don't layout absolutely positioned wrappers in other absolutely
positioned wr...</li>
<li><a
href="https://github.com/itext/itext-java/commit/7919d661ad8d8b49e8c51eb12c9d519abf276b47"><code>7919d66</code></a>
[RELEASE] 9.7.0</li>
<li><a
href="https://github.com/itext/itext-java/commit/b6bcf5905d491305bfe407ca92e0339d2397604a"><code>b6bcf59</code></a>
Bump jackson dependency to 2.22.0</li>
<li><a
href="https://github.com/itext/itext-java/commit/6f9282f36549550e11d576b6a23e8ea5f1ce157f"><code>6f9282f</code></a>
Support absolutely positioned elements recalculation when certain axis
coordi...</li>
<li><a
href="https://github.com/itext/itext-java/commit/a07fcb841f9d6c820fcbccf49c56a64b5b621862"><code>a07fcb8</code></a>
Add missing copyright headers</li>
<li><a
href="https://github.com/itext/itext-java/commit/183208fc34e5fd6ce407dc35eb350b263991dfd6"><code>183208f</code></a>
Fix sign module tests in new graalvm</li>
<li><a
href="https://github.com/itext/itext-java/commit/d6ff980f6abdd091de73e32a0ba3139c5803b4e6"><code>d6ff980</code></a>
Add ability to ignore area break and section break using properties</li>
<li><a
href="https://github.com/itext/itext-java/commit/137f9addf900ab91575ec3bd0c23ba8bebefaed9"><code>137f9ad</code></a>
Fix partial and nothing layout result handling for
FootnoteAnchorRenderer</li>
<li><a
href="https://github.com/itext/itext-java/commit/8c6b430b766b6e9d84aa727c98841fd3c2e7b4d4"><code>8c6b430</code></a>
Introduce tagging for footnotes</li>
<li>Additional commits viewable in <a
href="https://github.com/itext/itext7/compare/9.6.0...9.7.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.itextpdf:layout` from 9.6.0 to 9.7.0
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent 678e466 commit 46efa4d
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
82 | 82 | | |
83 | 83 | | |
84 | 84 | | |
85 | | - | |
| 85 | + | |
86 | 86 | | |
87 | 87 | | |
88 | 88 | | |
| |||
0 commit comments