pdfme

Bug fixes

• Designer: stop the endless onChangeSelection loop — the Designer now notifies onChangeSelection only when the selection actually changes, and no longer fires an empty notification on mount. (#1692, fixes #1691)
• Designer: options.theme now applies to the property panel — the property panel is rendered with the Designer's own antd instance, so host theme tokens take effect. (#1693, fixes #1690)
• lineTitle headings in the property panel now use the theme's text color and divider color, so they stay readable and consistent in both light and dark themes.
• Shift + Arrow nudges by 0.1mm in the Designer. (#1685)
• Playground mobile layout fixes. (#1675)

Features

• Configurable Designer sidebar widths. (#1682, #1310)
• drawSvg supports stroke-dasharray and stroke-dashoffset. (#1679)

Visual changes (please check if you customize the theme)

• Border color changed globally, including the default light theme: colorBorder goes from #d9d9d9 to #8e8e8e (3:1 contrast) across Designer, Form and Viewer.
• Placeholder color changed: colorTextPlaceholder now uses colorTextSecondary for better contrast.
• Automatic dark theme: when the host passes a dark colorBgBase, antd's darkAlgorithm is applied automatically.

Known issue

• The selection can be cleared after calling updateOptions. This will be fixed in the next release.

Other

• README demo GIF and docs updates; removed an unused CI workflow. (#1676, #1681)

Full Changelog: https://github.com/pdfme/pdfme/compare/6.2.6...6.2.7

What's Changed

• fix(common): harden isUrlSafeToFetch IP parsing and reject localhost aliases (d03d0bc)

Security

This release fixes GHSA-2rg9-wxfw-wrr7 (severity: Low) in @pdfme/common (affected: 5.5.10 – 6.2.5).

@pdfme/common 6.2.6 hardens the URL safety check used when fetching external resources (isUrlSafeToFetch). The following targets are now rejected: CGNAT addresses (100.64.0.0/10), *.localhost, localhost.localdomain / ip6-localhost / ip6-loopback, IPv6 unique local addresses (fc00::/7) and link-local addresses (fe80::/10). If you load images or fonts from these targets, host them at a public URL or pass the data directly.

Full Changelog: https://github.com/pdfme/pdfme/compare/6.2.5...6.2.6

This release fixes several bugs, all contributed by @brgl8. Thank you!

Fixes

• Page number in Preview and Designer: {currentPage} in read-only fields now shows the correct page number in Preview and the Designer. (#1670)
• JSON parsing of input values: Values that cannot be JSON are no longer passed to JSON.parse. (#1667)
• Font parsing: Each font is now parsed once and reused across generate calls, which makes repeated generation faster. (#1668)
• Encrypted PDFs: Strings in encrypted PDFs are now decrypted from their bytes, and objects that are not encrypted are skipped. (#1666)
• String handling: Fixed string handling. (#1671)

This release adds image columns to tables. You can switch any table column to Image in the Designer, upload PNG or JPEG images per cell in the Designer and Form, and render them in generated PDFs. Tables also get per-column vertical alignment, and column styles now stay with the right column when a column is removed.

Features

• Image columns in tables: A table column can now hold images instead of text. It is opt-in per column with columnStyles.cellType ('text' | 'image', default 'text'). Each image cell's value is a PNG or JPEG data URL, so inputs stay string[][]. Other values (URLs, GIF, WebP, SVG, broken data) are not drawn and log one warning; empty cells are left blank. Row height follows columnStyles.imageHeightMode: fixed uses columnStyles.imageHeight in mm (default 20mm), and auto follows the image's aspect ratio at the column width, capped to fit the page on a blank basePdf. Images are drawn with contain fit and positioned by the column's horizontal and vertical alignment. Header cells stay text, image cells do not change column widths, and the image plugin does not have to be registered. (#484, #1660)
• Column Style card in the Designer: The table's Column Style card is now one merged card with a block per column. For each column you can set the type (Text or Image), horizontal and vertical alignment, and, for image columns, the height mode (fixed mm or auto). With 7 or more columns, each column starts collapsed to a one-line summary. Switching a column between Text and Image clears that column's body cells. (#1663)
• Image cells in the Designer and Form: While an image cell is being edited, you can select a PNG or JPEG file or remove the image. Empty cells show a placeholder, and clicking an empty image cell in the Form or Designer opens the file picker. If the browser blocks the picker, use the Select image button. (#1663)
• Per-column vertical alignment: New columnStyles.verticalAlignment map, with the same shape as alignment. It overrides Head Style and Body Style for that column, including the header cell, and also sets the vertical position of images. Columns without a value render exactly as before. (#1663)

Fixes

• Column styles after removing a column: Deleting a table column in the Designer now shifts every columnStyles map (alignment, fontName, the new image keys, and others) so each style stays on its column. Before, a style set on a later column ended up on the wrong column. (#1658)

Upgrade notes

• Existing templates: Templates without cellType or verticalAlignment keep the same row heights and PDF output. One page-break edge case changed: when a table with repeatHead is the only field on its page and only its header fits there, the table now moves to the top of that page together with its first row, instead of leaving a header-only page. (#1660)

Maintenance

• Dropped the deprecated @types/bwip-js (bwip-js ships its own types), upgraded Vitest to 5 and Vite+ to 1.0, and improved Sentry setup for the playground build. No runtime changes to the published packages. (#1657, #1659, #1661, #1662)