iText Suite 9.7: WebP Images, Dynamic Margins/Footnotes, and New Script Support!

This iText Suite release from Apryse centers on three themes: bringing a modern, widely used web image format natively into PDF, giving developers far more control over complex page layouts, and complex script support for languages that are frequently underserved by document tooling. There’s also a solid round of improvements to the pdfHTML and pdfOCR add-ons, enhanced decompression bomb protection, and other security improvements.

Native WebP Image Format Support

WebP now accounts for roughly 20% of all websites and 30% of the top 1,000 most visited sites, with adoption from Google, YouTube, Facebook, Instagram, X, and Amazon. Compared to JPEG or PNG, WebP typically achieves 25 to 35% smaller file sizes at equivalent visual quality, while also supporting transparency, animation, and both lossy and lossless compression in a single format.

Until now, if a WebP image needed to end up in a PDF, you had to convert it to JPEG or PNG first. iText Core 9.7.0 removes that step: it can now decode WebP images directly, whether they’re embedded programmatically or picked up automatically during HTML-to-PDF conversion via pdfHTML, including base64-encoded WebP data in HTML and SVG sources.

The functionality ships as a separate, optional webp-image-support module. Decoding uses the TwelveMonkeys ImageIO library on Java and SkiaSharp on .NET, and once the module is on your classpath (or referenced in your .NET project), iText’s ImageTypeDetector picks up WebP images automatically, with no additional configuration required. Both lossy and lossless WebP decoding are supported, along with ICC color profile handling for accurate color reproduction and alpha channel transparency.

Dynamic Page Margins & Footnotes

This release includes a substantial overhaul of how iText’s layout module handles complex documents. Previously, once a page’s margins were set, they were effectively fixed for that page. iText Core 9.7.0 introduces a new SectionBreak element that lets developers adjust margins on the fly, mid-document, as content requires it, useful for anything from varying header and footer treatments across sections to accommodating different content types (text, images, or signature fields) in the margin area itself.

Built on top of this new framework is full footnote support: automatic numbering, customizable footnote containers, and layout logic that keeps footnote anchors and their corresponding footnote text correctly bound to the same page, even as content reflows.

For anyone generating long-form or academic-style documents programmatically, this closes a gap that previously required manual workarounds to get footnotes to behave correctly across page breaks.

pdfCalligraph 5.1.0: New Script Support

PDF, as a format, supports rendering text (placing glyphs at coordinates), but it does not natively perform shaping: the process of turning a linear sequence of Unicode characters into the correct, often reordered and contextually joined, arrangement of font glyphs a reader actually recognizes.

iText Core handles this natively for Latin, Cyrillic, Greek, Armenian, and Georgian scripts, as well as Chinese, Japanese, and Korean. But for scripts where letterforms change shape depending on their neighbors, get reordered, or rely on stacked diacritics, among them Arabic, Hebrew, and the many Brahmic and Southeast Asian scripts across South and Southeast Asia, that shaping logic falls to pdfCalligraph, iText’s add-on for complex script support, and this release is a significant one for it.

pdfCalligraph 5.1.0 adds three new writing systems: Sinhala, the script for Sri Lanka’s official language, spoken by over 16 million people; Tibetan, used for the Tibetan language as well as Dzongkha and other Himalayan languages, added at a customer’s request; and S’gaw Karen, a Sino-Tibetan language spoken by roughly 3 million people in Myanmar and Thailand, using the Mon-Burmese script family and also added at a customer’s request.

Each required dedicated shaping, reordering, and line-breaking work rather than a simple extension of existing script support, and validating directly against HarfBuzz reference output.

Alongside the three new scripts, this release resolves a long list of Arabic rendering issues, covering missing OpenType feature application, incorrect diacritic placement, and crashes triggered by certain Urdu fonts. iText Core itself now also logs an informational warning when it detects text that requires pdfCalligraph for correct rendering but the add-on isn't present, a small change that should help developers catch script-rendering issues during development rather than after a document ships with garbled text.

pdfHTML 6.3.3: New CSS Selectors and Grid Fixes

pdfHTML, iText’s add-on for converting HTML and CSS into PDF, picks up three CSS pseudo-class selectors this release: :is(), :where(), and :not(). These let you write more compact, maintainable selectors, for example targeting a parent element based on what it contains, without resorting to verbose selector lists or JavaScript-side workarounds. Specificity handling between :is() and :where(), nested selectors, and combinators are all resolved correctly.

pdfHTML is also more forgiving of malformed CSS. Previously, encountering an invalid unit value (a customer reported hitting this with a stray %% in real-world HTML) would cause conversion to fail outright; now pdfHTML logs a warning and keeps going.

Two bugs affecting CSS Grid layouts have also been fixed: one caused list items and their symbols to render twice inside grid containers using certain inline-table and list structures, which could bloat output file size and slow conversions dramatically; the other caused grid cells split across a page break to use the wrong renderer, producing duplicated or misplaced content on the following page.

pdfOCR 5.0.1: Stability and Input Handling

pdfOCR, iText’s add-on that makes scanned or image-based content searchable, gets a more modest but useful update this release. IOcrEngine.doImageOcr can now accept an image stream directly, rather than requiring a file on disk, which is a welcome change for environments where writing temporary files is restricted or undesirable. OcrPdfCreator.makePdfSearchable has been updated to take advantage of this too, avoiding temporary files internally.

Two smaller but meaningful fixes round out the release. The default recognition vocabulary for parSeq models has switched from a generic Latin-extended set to French, giving noticeably better out-of-the-box accuracy for accented characters common in European languages (multilingual model configurations are unaffected, as they continue to specify the broader vocabulary explicitly). And a crash in pdfOCR’s text line sorting logic, triggered by an edge case in how small, accumulating rotation angles were compared, has been fixed.

Signatures, Validation, and Trust Lists

Append Mode, used to add incremental updates to a PDF (such as a new digital signature) without disturbing the existing document history, is more reliable in this release. iText now does a better job of tracking modified objects and resolving stream inconsistencies, which helps preserve document history and existing signatures across incremental updates. Page rotation handling for signature appearance layers has also been corrected, and a crash affecting some form-flattening edge cases has been fixed.

We’ve also published an updated version of our EU Trusted Lists resources, incorporating the latest European Journal sources to keep signature validation aligned with current eIDAS requirements.

Security and Stability

Protection against decompression bombs, maliciously or accidentally crafted PDF streams that expand to consume excessive memory when decompressed, has been strengthened, with particular attention to single /FlateDecode streams and image-based decompression bombs. A 100x growth factor limit now applies to all streams by default; the existing API for overriding this in edge cases remains available, though this should be rare in practice.

Community contributor Netliomax25 also hardened iText’s PDF/UA accessibility checks against XML External Entity injection in rich text annotations, by swapping in a more secure XML parser.

Separately, the BouncyCastle dependency on Java was updated to address a recently disclosed CVE, and Jackson was bumped to 2.22.0 to stay current on security patches.

Release Notes and Showcase PDF

You can find more on what’s new in iText Suite 9.7 in the release announcement , or check the release notes on the iText Knowledge Base for full technical detail, downloads, and related documentation. Full changelogs for pdfOptimizer 4.1.4, pdfSweep 5.0.7, and pdfXFA 5.0.7, also updated alongside this release, are available there too.

As with every release, we’ve turned the iText Core release notes into a showcase PDF document. It is a PDF 2.0 document that conforms to PDF/A-4F, PDF/UA-2, and WTPDF, is digitally signed, and has its own source code and resources embedded so you can regenerate it yourself.