pypdf is a pure-Python PDF library for splitting, merging, cropping, and transforming PDF pages. It can also extract text and metadata, add custom data, viewing options, and passwords, and supports encryption and decryption (with extra crypto dependencies).
Project status
- Actively maintained: Yes, GitHub updates are very recent (last push 2026-10-14), with multiple security and robustness focused updates in September and October 2026.
- Apparent cadence: Fast and regular, with updates every 3 to 10 days in late September and October 2026 (6.19.0 on 09-16, 6.20.0 on 10-09, 6.20.1 on 10-12).
AI summary generated
Recent updates
6.21.1
Version 6.21.1 introduces a security hardening related to how /DCTDecode image streams are decoded with Pillow. It updates image decoding to only allow the Pillow JPEG plugin for these streams and adds a regression test to enforce the behavior.
BreakingSecurity6.21.0
pypdf 6.21.0 focuses on security/performance hardening by limiting work during form field traversal and PDF content stream parsing. It also adds a new capability for named destinations to control the fit mode, plus several targeted bug fixes around PDF structure edge cases.
SecurityFeatures6.20.1
Version 6.20.1 includes a security fix intended to prevent cyclic tree traversal, and a bug fix related to how text field default appearances are parsed for color information. The code changes are broader than the release notes, including additional parsing, error handling improvements, and at least two behavioral bug fixes not mentioned in the notes.
Security6.20.0
Version 6.20.0 adds PDF 2.0 BrotliDecode support and introduces security limits to cap per-stream decoding work. It also improves performance for font parsing (CFF/CMaps), adds several robustness guards (page tree flattening and parsing tolerance), and extends typing support for PdfReader and PdfWriter.
SecurityFeatures6.19.0
Version 6.19.0 focuses on tightening PDF text and page-label handling, improving performance of appearance stream generation and attachment mapping, and fixing several PDF parsing/merge edge cases. It also introduces a new JavaScript document open action API and deprecates PdfWriter.add_js in favor of that approach.
Security6.18.1
pypdf 6.18.1 primarily hardens PDF parsing against malformed or adversarial inputs, adding multiple defensive limits around CMap decoding and decompression recovery. It also includes targeted text extraction and annotation fixes, plus a small documentation update to reflect a corrected visitor example.
Security6.18.0
Version 6.18.0 introduces a new configuration system for resource limits (via a pypdf.Configuration object and context-based overrides), plus a new appearance-stream feature to draw borders and backgrounds. It also adds a security hardening to limit the length of indirect object tokens. The release notes document the migration approach, but the code diff shows additional behavioral and API-shape changes that are not explicitly called out.
BreakingSecurityFeatures6.17.0
Version 6.17.0 focuses on parsing improvements for fonts, performance gains in text extraction, and several robustness fixes for malformed PDFs. Release notes also include a security hardening for roman numeral labels, plus documentation guidance to use AnnotationFlag when setting annotation flags.
BreakingSecurityFeatures6.16.2
Version 6.16.2 primarily ships bug fixes related to outline item removal, layout mode text extraction (space width and text leading), and correct updating of annotation appearance matrices during page transforms. It also improves RC4 fallback behavior when OpenSSL cannot provide RC4.
Breaking6.16.1
Version 6.16.1 primarily introduces a security hardening to prevent unbounded work during outline retrieval and XForm-based text extraction. The release notes describe limiting iterations, and the code implements explicit traversal counters and hardcoded limits with warnings and (for outlines) hard failures.
Security6.16.0
pypdf 6.16.0 adds multiple AppearanceStream improvements (arbitrary rotation support, better font encoding handling for Type1 core fonts), plus targeted robustness and parsing fixes. The release also includes security hardening for cyclic PDF tree structures and performance improvements in cmap parsing. Code changes also include some behavior shifts not explicitly called out in the release notes.
BreakingSecurityFeatures6.15.0
Version 6.15.0 introduces security-oriented limits for font and ToUnicode parsing, plus a performance improvement to read_until_whitespace. It also adds RTL-related PDF handling (including ActualText for RTL appearance streams), introduces an actions base class, and updates charset mappings, alongside a documentation note about unsanitized image and attachment filenames.
SecurityFeatures6.14.2
Version 6.14.2 is a security release addressing a potential infinite loop when decoding incomplete inline images using ASCII85 or ASCIIHex. The code changes also adjust error handling behavior around inline image parsing and normalizes some error message text.
BreakingSecurity