deps(fuzz): Bump QuestPDF from 2026.5.0 to 2026.8.0

[dependabot]

Updated QuestPDF from 2026.5.0 to 2026.8.0.

Release notes

Sourced from QuestPDF's releases.

2026.8.0

🚀 This release is dedicated to performance, parallelism, and use of available resources. 🚀

Documents render faster, allocate a fraction of the memory they used to, and scale across all available CPU cores. No code changes are required — existing documents benefit simply by upgrading the package.

The numbers below were measured on a MacBook Pro M5 (18-core CPU), using the invoice document from the Getting Started tutorial, across various levels of parallelism, over a sample of 5,000 documents.

• Reduced allocated memory amount and allocated object count by 85%.
• Improved single-threaded performance by around 15%.
• Substantially improved parallel scaling: throughput previously peaked at 4 threads and flattened beyond that, and now scales with available CPU cores — with around 4x better scaling.
• Improved performance and scalability for text-heavy documents.
• Improved cache usage (mainly for fonts) and significantly reduced locking.

✨ Other improvements:

• Added support for soft hyphens: the library does not hyphenate text automatically, but soft hyphen characters (U+00AD) are now correctly interpreted as optional break points and rendered as hyphens when a line breaks.
• Added the TextStyle.BreakAnywhere API, which allows a text span to break between any two characters, not only at word boundaries such as spaces or hyphens. Useful for content without natural break points, e.g. long URLs, identifiers, hashes, or file paths.
• Improved the visual position of the underline and double underline text decorations.
• Improved reliability of the Companion App integration: document previews are now refreshed from a consistent snapshot, and rendered pages are transferred more efficiently.
• Increased the zlib compression level used for PDF generation from 1 to 3, which produces significantly smaller files (for text-heavy documents) with a minimal increase in generation time.
• Updated the Skia native dependency to version m152.

⚠️ Breaking change

XPS generation has been removed. The format was supported only on Windows, had several rendering issues that could not be reliably resolved, and had negligible adoption. The GenerateXps and GenerateXpsAndShow methods are still present, but calling them now results in a compilation error, and code compiled against an earlier version throws an exception at runtime. Please use PDF generation instead.

2026.7.3

• Breaking change: The Rotate API now rotates elements around their center instead of the top-left corner. Center-origin rotation is the expected behavior in virtually all use cases.
• Behavioral change: Generated images now use a white background by default, so the output matches how the document appears in a PDF viewer. Previously, PNG and WEBP images had a transparent background. To restore the old behavior, enable ImageGenerationSettings.UseTransparentBackground (applies only to formats supporting transparency: PNG and WEBP).
• Automated table semantic tagging is now applied whenever a Table element is placed inside a SemanticTable container, even indirectly. Nested semantic captions are now supported as well.
• Image elements now emit the /BBox attribute, improving PDF/UA-1 compliance with validators that require it.
• Improved the stability and speed of the QuestPDF Companion integration. The integration now requires .NET 8 or newer.
• Improved the developer experience of the GeneratePdfAndShow and GenerateXpsAndShow methods.
• Deprecated AsSemanticHorizontalHeader in favor of SemanticHorizontalHeader for API naming consistency.
• Deprecated RotateLeft and RotateRight in favor of RotateLayoutCounterclockwise and RotateLayoutClockwise, which better describe what these methods do.

2026.7.2

• Fixed a rare Windows x64 concurrency issue where generated PDF documents appeared correct in viewers, but selected and copied text was corrupted.
• Improved text rendering representation to resolve rare compatibility issues in certain PDF viewers that could cause incorrect results when selecting or copying text.
• Improved compatibility for complex glyphs, such as ligatures, by annotating them with the /ActualText tag. This improves text selection, copying, extraction, and screen-reader accessibility. Ligatures remain disabled by default.
• Added support for the AllowModification permission in DocumentOperations when encrypting PDF documents with 128-bit or 256-bit keys.
• Added minor fixes and expanded test coverage for the DocumentOperations API.

2026.7.1

Improved performance

PDF generation is now significantly faster. The Skia native dependency has been recompiled with speed-oriented optimizations (favoring performance over binary size) and with SIMD instructions enabled.

The impact depends on document content and platform. For example, generating image-heavy documents that require image rescaling can be several times faster on Windows x64 🎉

Note: this change slightly increases the size of the native dependency by around 20%.

---

Continuous performance monitoring

We have also built a solid foundation for measuring library performance going forward. A new GitHub Actions workflow benchmarks QuestPDF across all supported operating systems, processor architectures, and .NET releases.

This infrastructure helps us ensure that performance remains stable and consistent across all platforms, and allows us to detect regressions early — before they ever reach a release.

2026.7.0

• Updated licensing terms and conditions to version 3.0, including the removal of the developer seat limit for all paid licenses (details: https://www.questpdf.com/pricing).
• Added full support for .NET Native AOT and trimming.
• Added and improved warning messages related to library configuration.
• Fixed a rare rendering issue where the footer was placed incorrectly when the page content was empty.

2026.6.1

• Updated the Skia native dependency to M150.
• Improved text rendering stability when handling an excessive number of whitespace characters.
• Improved the failure message shown when the library runs on an unsupported platform (e.g., Android, iOS, or WASM).
• Improved platform compatibility checks and introduced more advanced fallback mechanisms.
• Improved diagnostics for missing font glyph exceptions.
• Improved PDF output consistency of section links by avoiding name escaping and removing unnecessary documentId prefix.
• Made the Image.Size property public.

2026.6.0

• Substantially revised the QuestPDF legal documents to better support enterprise procurement and compliance requirements and to define usage terms more clearly.
• Introduced native support for Windows ARM64 (win-arm64) environments.
• Improved compatibility with older Linux distributions (glibc 2.28 and newer).
• Reduced the NuGet package size by optimizing native dependencies.
• Renamed the TranslateX / TranslateY methods to OffsetX / OffsetY to improve discoverability.
• SVG rendering improvements:
  • Prevented zero-width strokes from being rendered as hairlines, aligning behavior with the SVG specification.
  • Added support for embedded Base64 images that use the modern href attribute instead of xlink:href.
  • Added support for the #RGBA and #RRGGBBAA color formats.
  • Added support for the transparent named color.
• Fixed PDF bookmark titles so they include only text from the associated paragraph, excluding the alternative text of images.
• Fixed SectionLink behaving incorrectly when target Section is placed in page header.
• Updated the Skia native dependency to version m149.
• Updated the qpdf native dependency to version 12.3.2.
• Modernized the build system for native dependencies, including how QuestPDF-specific patches are applied.
• Updated all GitHub Actions workflows to use standard runners, reducing costs and making it easier for everyone to contribute to the project.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, fuzz. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[ZL154]

Not merging this one for now. QuestPDF stays pinned at 2026.5.0 per #77: the 2026.6.0 recovery-code PDF breakage was never reproduced on arm64/musl, and the recovery-PDF path was just stabilized in v2.6.1. #214 took every other bump but deliberately held this pin. We'll revisit 2026.8.0 once the recovery-code PDF is verified on arm64/musl. Closing for now.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.