pdf_cos changelog and release notes | pub.dev

NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →

5.1.028 Sept 2026

Bump the app to 5.1.0+40 and the lockstep package suite to 5.1.0 (dart_pdf_cli 0.2.1, dart_pdf_editor_flutter_gpu 0.4.1, dart_pdf_printing 0.2.1), wit

Bump the app to 5.1.0+40 and the lockstep package suite to 5.1.0
(dart_pdf_cli 0.2.1, dart_pdf_editor_flutter_gpu 0.4.1, dart_pdf_printing
0.2.1), with every runtime inter-package constraint at ^.
This is a minor release: no public API breaks since 5.0.0, with two things
integrators should know:

dart_pdf_editor: DartPdfEditorLocalizations gained the abstract getters
sigUseTrackpad and sigTrackpadHint; a custom subclass implements them,
extending a bundled locale class picks them up.
pdf_graphics: the render-command codec is now wire format v11 (v10 paint
dedup and aligned path blocks, then Type3 cell back-references). Buffers
are not compatible across versions, and deserializeCommands /
deserializePageText throw FormatException on a mismatch.

Write the 5.1.0 changelog sections from the commit bodies since
app-v5.0.0: the P-521 order fix, faster ECDSA, tolerant zlib inflate on
the web, the object-cache key and its side map, T-table AES, web SHA-2,
JPEG 2000, in-place updates on recovered documents, rollbackTo and
openAppended(password:) in pdf_cos; the page-loss fix under a short /Count,
linear page loops, reusable signature crypto cores and onFields in
pdf_document; the flagged masked-image output change, codec v10/v11,
cached luminosity masks, the revision-stable colour context, ICC, colorant
buffer and text-extraction speedups in pdf_graphics; trackpad signatures,
annotation previews, touch row menus, the moved-stamp white box, the web
worker fixes and in-place revisions in dart_pdf_editor; the new overprint
and ICC fixtures. Dev dependency ranges (<6.0.0) already admit 5.1.0.

Store notes cover trackpad signatures, annotation previews, touch row
menus, the moved-stamp fix, the page-loss fix, P-521 signatures and the
speedups, written platform-neutral per release-notes/README.md, across 20
iOS locales, 21 Play changelogs (40.txt) and both Linux metainfo copies.
The forms guide now says it applies to 5.1.0.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Open source →

Additional notes

Verify P-521 ECDSA signatures. The P-521 order constant was 609 bits instead of the 521-bit NIST n, so every P-521 signature, OpenSSL's and our own, was rejected.
Make ECDSA about 8-9x faster: Jacobian a=-3 arithmetic with one inversion per scalar multiplication, Shamir's trick for u1*G + u2*Q, and curve constants parsed once per curve. P-256 verify goes from 11.3 to 1.3 ms (AOT). Signing uses the same arithmetic and stays byte-identical (RFC 6979). verifyCertificateChain now verifies each certificate against its issuer once instead of twice.
Stop Flate streams decoding empty on the web. On dart2js, archive's ZLibDecoder read any bytes after the Adler-32 (a trailing EOL before endstream) as a second zlib header, failed it and returned nothing for the whole stream: pages rendered blank, fonts went missing, and CosCompactor (Reduce file size) re-deflated the empty result into the file. The new inflateZlib stops at the final block, as zlib does, and FlateFilter uses it. CosCompactor inflates strictly (header, length and Adler-32 checked) and never replaces a payload of more than 16 bytes with an empty one. The VM path is unchanged.
Key the loaded-object cache by object number in the low bits. The old key (objectNumber * 65536 + generation) clustered in the VM's int hash, so whole-graph walks spent most of their time probing: PdfCompressor.optimize runs 0.39-0.69x and applyRedactions about 0.31x on 14k-37k-object files. References the packed key cannot hold exactly (an object number of 2^32 or more, as an edit on a file with a junk /Size allocates, or a generation over 65535) are cached in a side map, which also stops n 65536 R resolving to object n+1.
Decode JPEG 2000 about twice as fast, byte-identical: EBCOT tier-1 keeps neighbour significance incrementally, and the inverse wavelet lifts with stride-2 parity loops.
Run AES with word-oriented T-tables, about 7x faster, byte-identical. AES-128/256 streams decrypt faster everywhere, and an R6 (AES-256) open goes from 28.9 to 9.8 ms (AOT).
On the web, compute Algorithm 2.B's SHA-384/512 on 32-bit halves instead of package:crypto's emulated 64-bit words, so an R6 open in the browser is about 7x faster. The VM keeps package:crypto.
applyIncrementalUpdate now folds edits into a document opened through xref recovery instead of refusing it, so each edit no longer re-runs a full-file recovery scan. The recovery scan itself is one pass for both obj and trailer (0.56-0.61x on large files).
Add CosDocument.rollbackTo(length), which takes a document back to an earlier revision it folded in with applyIncrementalUpdate, in place, keeping the caches of objects the undone updates did not touch. It returns null, changing nothing, when that length is not journaled.
CosDocument.openAppended accepts an earlier revision's prefix as well as an append, and takes a password for revisions it cannot donate keys to. It donates the security handler only while the revision's /Encrypt matches the dictionary the keys were derived from, entry for entry, so a revision that re-keys /Encrypt under the same object number authenticates its own password.
Add ContentOperationCursor.nextOperator and takeOperation, and CosTokenBuffer.keywordCode, so an interpreter can dispatch short operators on an int code and read numeric operands without allocating operation objects. nextOperation and parse keep their contract, and materialized operands follow the same int-or-real rule on the web as on the VM.
Add PdfPerf counters for glyph outline builds and the overprint colorant buffer (glyphOutlinePaths, colorantBufferPages, colorantDraws, colorantRasterized, colorantBackdropReads, colorantGroups).

5.0.024 Sept 2026Breaking

Roll the Unreleased sections over with Breaking changes subsections and migration notes, and write the ones the batch never got: AF* scripts, comb/Max…

Bump the app to 5.0.0+39 and the lockstep package suite to 5.0.0
(dart_pdf_cli 0.2.0, dart_pdf_editor_flutter_gpu 0.4.0, dart_pdf_printing
0.2.0 - their dependency majors moved under types they expose). This is a
major release because public behaviour and API changed incompatibly since
4.5.0:

dart_pdf_editor: PdfFormFieldKind gained radioGroup/comboBox/listBox/
signature and PdfBundledSubstitute gained carlito (exhaustive switches
break); setFormFieldText now runs keystroke/validate scripts, returns
false for refused input and stores the normalised value; shells without
a viewMode: own a per-window PdfViewModeController, so hosts that drove
the mode through preferences must pass one; DartPdfEditorLocalizations
gained abstract getters.
pdf_document: setTextValue truncates to /MaxLen and recalculates AF
calculated fields; every fill removes /XFA and /NeedsRendering; list
boxes draw every row; validate() untrusts a chain the /DSS says is
revoked; PdfTrustStore.addCertificate/addDer gained {source}.
pdf_cos: decryptObjectGraph leaves a signature's /Contents as-is; OCSP
delegated responders must be CA-issued with id-kp-OCSPSigning.

Roll the Unreleased sections over with Breaking changes subsections and
migration notes, and write the ones the batch never got: AF* scripts,
comb/MaxLen/password fields, XFA detection, encrypted signing and tab
order in pdf_document; openAppended in pdf_cos; the /ImageMask box filter,
justified-text reflow spaces and multi-select field context in
pdf_graphics; the form-layer, secret-store, Tab navigation and
thumbnail drag-out work in dart_pdf_editor; multi-select values in the
CLI; the print range and copies fixes in dart_pdf_printing; the new
fixtures. Dev dependency ranges on workspace packages now admit <6.0.0 so
the workspace resolves and publishing still accepts the hosted 4.5.0.

Store notes cover form calculations and checks, Tab and multi-select,
password fields kept out of the file, field creation, signing encrypted
PDFs, revocation checks with EU/Adobe trust lists, and Calibri via
Carlito, across 20 iOS locales, 21 Play changelogs, and both Linux
metainfo copies. The forms guide now says it applies to 5.0.0.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Open source →

Additional notes

Breaking changes

StandardSecurityHandler.decryptObjectGraph (and encryptObjectGraph) now leave a signature dictionary's /Contents untouched, as ISO 32000 7.6.1 requires (StandardSecurityHandler.isSignatureContents: /Type /Sig or /DocTimeStamp, or a dictionary with a /ByteRange when /Type is missing). Code that decrypted /Contents itself after loading must stop doing so - the loader now hands over the raw CMS bytes.
OCSP delegated responders are accepted only when the CA issued and signed them and they carry id-kp-OCSPSigning (OcspResponse.responderFor), and OcspResponse.forCertificate matches the whole CertID. Responses that used to pass on a serial match alone, or from an unauthorized responder, are now ignored.
X509Certificate gained members (listed below). Only classes that implements X509Certificate need to add them.

Changes

Add CosDocument.openAppended, which reopens a document after appended updates and reuses its already-authenticated security handler (while the /Encrypt object is unchanged), so follow-on revisions of an encrypted file do not need the password again.
Harden OCSP for revocation checking: OcspResponse.forCertificate matches the whole CertID (serial, issuer name hash and issuer key hash) instead of the serial alone, a delegated responder must be issued and signed by the CA and carry id-kp-OCSPSigning (responderFor), and the nonce extension and revocation reason are parsed (nonce, echoesNonce, ocspNonceValue).
X509Certificate exposes extendedKeyUsages, isCa, hasOcspNoCheck and isValidAt, and now reads the RSA key of an id-RSASSA-PSS certificate.
issueCertificate can add OCSP (AIA), CRL distribution point, extended key usage and ocsp-nocheck extensions, and can issue a subordinate CA (isCa).

Open source →