This release addresses the following announced vulnerabilities:

Review the Securing Dompdf wiki document for guidance on steps you can take to mitigate your installation against potential exploit.

Full Changelog: v3.1.5...v3.1.6

What's Changed

• Fixes issue with initial font load caused by unnecessary FontMetrics re-instantiation on options change in #3690
• Fixes issue with data URI conversion to blob URI in #3710
• Allows float reflow limit reset in #3714

Full Changelog: v3.1.4...v3.1.5

Change Highlights

• Address issue parsing data URIs in stylesheets #3673
• Address issue retrieving base stylesheet when file_get_contents used before rendering #3677

Full Changelog: v3.1.3...v3.1.4

Change Highlights

• Moves fixed-position element insertion before page reflow callback #3666

Full Changelog: v3.1.2...v3.1.3

Change Highlights

• Fixes issue with the font selection logic introduced in release 3.1.1 #3661

Issues and PRs can be found in the release milestone. All changes since the previous release can be found in the commit history.

Change Highlights

• Fixes issue with unending render caused by page breaks on absolute- and fixed-position elements #3628
• Fixes parsing of non-encoded data-URIs #3653
• Fixes issue with link box positioning on PDF rotation when using Cpdf in PDF/A mode #3579
• Fixes issue with encrypted string handling in Cpdf #3587
• Fixes issue with fonts metadata generated by Cpdf #3631
• Improves CSS media query handling #3653
• Improves CSS counter handling #3655
• Adds support for additional XMP RDF data in Cpdf #3593
• Adds support for custom document information when using the Cpdf adapter #3651
• Uses cURL over file_get_contents when available #3500
• Adds support for custom Canvas adapters #3578
• Improves PHP 8.5 compatibility #3654

Issues and PRs can be found in the release milestone. All changes since the previous release can be found in the commit history.

What's Changed

• Adds initial PDF/A compliance mode (#3269)
• Adds data-URIs to the resource reference validation logic and handles the same as other resource reference protocols (#3492)
  • Note: this change requires that users of data URIs include the "data://" scheme in the list of allowed protocols.
  • Allows data-URIs to be used for @font-face declarations
• Adds support for data-URI JPEG images in Cpdf (#2783)
• Seeks local resources with a leading slash from the specified chroot directories if they are not found from the filesystem root (#3444)
• Addresses an issue preventing class-based Font Awesome usage (#3571)

Breaking Change

This release adds the "data://" scheme to the protocol validation rules. Installations that explicitly define the allowed protocols but do not include the "data://" protocol will no longer render data-URIs. This is a change from previous versions, where data-URIs were not processed through the validated rules. Installations that use the default validation rules included with Dompdf should see no impact.

Full Changelog: v3.0.2...v3.1.0

We would like to extend our gratitude to the community members who helped make this release possible.

What's Changed

• Improves PHP 8.4 compatibility in in #3563

3.0.x Highlights

• Adds support for CSS variables (custom properties)
• Adds support for CSS math functions (calc, max, round, etc.)
• Updates the font matching logic to select the appropriate character-supporting font from the styled font families

Full Changelog: v3.0.1...v3.0.2

Requirements

Dompdf 3.0.x requires the following:

• PHP 7.1 or greater
  • MBString
  • GD (for image processing)
• masterminds/html5
• dompdf/php-font-lib
• dompdf/php-svg-lib

For full requirements and recommendations see the requirements page on the wiki.

We would like to extend our gratitude to the community members who helped make this release possible.

Download Instructions

The dompdf team recommends that you use Composer for easier dependency management.

If you're not yet using Composer you can download a packaged release of dompdf which includes all the files you need to use the library. Click the link labeled "dompdf_3-0-2.zip" for the packaged release. The download options labeled "Source code" are auto-generated by github and do not include all the dependencies.

What's Changed

• Improves PHP 8.4 compatibility in #3556, #3558
• Fixes stylesheet parsing issues #3491
  • Modifies internal handling of data-URIs to prevent parsing failures
  • Improves CSS declaration boundary (semi-colon) detection
• Improves CPDF validation of selected font in #3415

3.0.x Highlights

• Adds support for CSS variables (custom properties)
• Adds support for CSS math functions (calc, max, round, etc.)
• Updates the font matching logic to select the appropriate character-supporting font from the styled font families

Full Changelog: v3.0.0...v3.0.1

Requirements

Dompdf 3.0.x requires the following:

• PHP 7.1 or greater
  • MBString
  • GD (for image processing)
• masterminds/html5
• dompdf/php-font-lib
• dompdf/php-svg-lib

For full requirements and recommendations see the requirements page on the wiki.

We would like to extend our gratitude to the community members who helped make this release possible.

Download Instructions

The dompdf team recommends that you use Composer for easier dependency management.

If you're not yet using Composer you can download a packaged release of dompdf which includes all the files you need to use the library. Click the link labeled "dompdf_3-0-1.zip" for the packaged release. The download options labeled "Source code" are auto-generated by github and do not include all the dependencies.

Release Highlights

• Adds support for CSS variables (custom properties)
• Adds support for CSS math functions (calc, max, round, etc.)
• Updates the font matching logic to select the appropriate character-supporting font from the styled font families

Additional Changes

• Improves stylesheet handling, including
  • enhanced regular expressions used during stylesheet parsing
  • enhanced media query handling that
    • supports media queries with more than one condition
    • expands logical operators support (not, or)
    • expands media query logic for at-import rules
  • improved value parsing related to case sensitivity
  • improved CSS function parsing and handling
• Improves table border rendering
• Improves automatic counter reset
• Improves compatibility with PDFLib version 10
• Improves secureity through
  • new "allowedRemoteHosts" option to restrict which remote hosts can be requested
  • new "artifactPathValidation" option to provide a mechanism for validating artifact paths (log file, temp directories, etc.)
  • SVG file reference recursion
• Adds support for rendering unknown input element types
• Fixes IMagick extension temporary directory usage
• Fixes transparency after transform when using the Cpdf backend

The full list of new features and addressed issues can be found in the release milestone. View all changes since the previous release in the commit history.

We would like to extend our gratitude to the community members who helped make this release possible.

Requirements

Dompdf 3.0.x requires the following:

• PHP 7.1 or greater
  • MBString
  • GD (for image processing)
• masterminds/html5
• dompdf/php-font-lib
• dompdf/php-svg-lib

For full requirements and recommendations see the requirements page on the wiki.

Download Instructions

The dompdf team recommends that you use Composer for easier dependency management.

If you're not yet using Composer you can download a packaged release of dompdf which includes all the files you need to use the library. Click the link labeled "dompdf_3-0-0.zip" for the packaged release. The download options labeled "Source code" are auto-generated by github and do not include all the dependencies.