Vanilla.PDF Files

Vanilla.PDF 2.3.0

This release adds AES-256 encryption and resolves several encryption correctness issues that could cause documents to be written with weaker protection than requested or rejected by third-party readers. It also hardens thread safety and the release/packaging pipeline.

✨ Features

• AES-256 (V=5, R=6) encryption creation — documents can now be encrypted with AES-256 (#431)
• Accept a null pointer for zero-length buffer data across the C API (#429)

🔒 Encryption correctness

• Emit /V 4 with /AESV2 for AES-128 instead of silently producing RC4 (#453)
• Encrypt array-filter streams instead of writing them in the clear (#460, [#462])
• Correct the round-counter off-by-one in the R6 hash termination (#457)
• Truncate the RC4 key to n bytes for the revision-3 standard security handler (#439)
• Emit a conformant /P so third-party readers accept RC4/AES-128 encrypted documents (#421)

🐛 Bug fixes

• Correct PNG Average/Paeth predictor reconstruction in FlateDecode (#440)
• Make XrefEntry_InUse report entry usage instead of the lazy-load flag (#447)
• Overwrite the stale Limits key on TreeBase::Rebuild (#419)
• Reject an invalid 1-based page index in PageTree::Insert/Remove (#418)
• Standardize content object/operation cast API consistency (#413)
• Add a missing <cstring> include for std::strlen/std::memcpy (#414)

🧵 Thread safety

• Synchronize File::GetByteRange seek+read against the shared input cursor (#408)
• Make the document registry create-guard liveness-aware (#428)
• Fix a data race in Document catalog lazy initialization (#391)

🧪 Testing

• Add encryption interoperability checks against qpdf + pyhanko (#424)

📦 Build, CI & release pipeline

• Move tag creation into the release pipeline and create the tag by publishing the draft (#379, [#402])
• Harden the release publish path — GITHUB_TOKEN, publish by id, NuGet trusted publishing via OIDC (#449, [#399])
• Migrate SBOM attestation to actions/attest and attach a signed provenance bundle as a release asset (#438, [#403])
• Conventional deb/rpm package names; exclude the internal CLI tool from packages (#398)
• Switch VS 2026 Windows runners to the msvc-18 presets; add Ubuntu 26.04 to CI (#401, [#380])
• Lint PR titles against Conventional Commits; flag failed auto-backports; add job timeouts (#435, [#445], [#446])
• Tighten code-coverage thresholds and general release-readiness cleanup (#436, [#417])

📚 Documentation

• Rewrite the README, NuGet readme, and Read the Docs documentation; restore badges; mark Conan/Homebrew as incoming (#260, [#397], [#394])

⬆️ Dependencies

• Update vcpkg to 2026.06.24 (from 2026.05.25) and routine GitHub Actions group bumps

Full Changelog: https://github.com/vanillapdf/vanillapdf/compare/v2.2.1...v2.3.0