Version 1.30.4 (November 9, 2026)

Security

• fixed a local file disclosure vulnerability that allowed custom XSLT policies to read local XML files through document() (GHSA-73f4-hgcx-xc59; commit)

Jakarta

• aligned the Jakarta version with the javax version: changes that were missing in the core-jakarta 1.30.3 are now included

Docker images

• added linux/arm64 builds alongside linux/amd64 for the CLI, REST, and Arlington Docker images (commits 1 2)

Validation

• (PDF/UA-1,2, WTPDF-1) fixed handling of the rule about a missing parent element (commit)
• (PDF/UA-1) fixed rule 7.18.1-3 to apply the alternative-description requirement only to Widget annotations associated with form fields (commit)

Core library

• fixed invalid JSON output in feature reports (commit)
• restored the original Adobe XMP Toolkit license and README, added copyright and license notices for veraPDF additions, and prevented veraPDF GPL/MPL headers from being added to XMP source files (commits 1 2 3)

PDF Parser

• fixed a race condition that could return a null PDF name when the dynamic name cache was cleared concurrently (commit)