GroupDocs.Conversion for .NET 26.10 Release Notes

There are 60 features, improvements, and bug fixes in this release.

This release puts external resources under your control: a new per-resource handler lets you inspect, allow, skip or supply each resource a document loads, whitelist entries are now absolute URI prefixes, local files outside the document’s folder and UNC paths are no longer loaded by default, and scripts run only when you enable them. It also fixes conversions that ignored the requested output format or page selection, several MHT, MHTML, PostScript, PCL, CAD, 3D, e-mail and archive conversion failures and .NET Framework loading problems, and moves to a patched System.Security.Cryptography.Pkcs.

Full list of changes in this release

Major Features

• Per-resource control of external resources: a new IExternalResourceHandler, set through the ExternalResourceHandler property of the load options, is called for each resource a document asks to load and can allow it, skip it or supply its content.

• Stricter defaults for external resources: local files outside the document’s folder and UNC paths are no longer loaded, WhitelistedResources entries must be absolute URI prefixes, scripts in HTML, MHTML, XHTML and SVG documents run only with ExecuteScripts, and SVG, 3D, XBRL, XSL-FO, Markdown and e-mail-to-spreadsheet conversions now follow the same rules.

• Requested output formats and pages: conversions that always wrote DOCX, XLSX, PPTX or a multi-frame TIFF now write the requested format, and page selection now works for e-mail, web and multi-page TIFF to word-processing conversions, for Word Flat OPC documents, and for Project to PS and PCL.

• Fewer failed conversions: MHT and MHTML pages render instead of their MIME source, VCF files keep every contact, and PostScript with the run or file operator on .NET Framework, PSD, PSB and AI documents page by page, whole CAD drawings to TeX, XHTML with inline SVG, PDF, XPS and SVG to EPUB, Visio and SVG to spreadsheet, and e-mail, mailbox and archive files with problem items no longer fail.

• Evaluation and licensing: WebP conversions with a valid license carry no trial badge, and the 3-page evaluation limit now also applies to SVG, SVGZ, PS and PCL output.

• Security and .NET Framework: System.Security.Cryptography.Pkcs is raised to 8.0.2 (10.0.13 on .NET 10) to address CVE-2026-84008 and CVE-2026-70162, and conversions no longer fail to load RuntimeInformation or ValueTuple in .NET Framework projects or fail on .NET Framework 4.6.2 to 4.7.0.

Public API and backward incompatible changes

⚠️ Breaking changes

• External resources are handled more strictly by default: local files outside the document’s folder and UNC paths are no longer loaded, and scripts no longer run. See 2. Stricter defaults for external resources.
• WhitelistedResources entries must be absolute URI prefixes; any other entry makes the load fail with InvalidLoadOptionsException. See 3. Whitelist entries are absolute URI prefixes.
• An XBRL or inline XBRL document whose taxonomy lies outside its folder fails to load with InvalidLoadOptionsException unless FinanceLoadOptions.SkipExternalResources is false. See 4. XBRL and inline XBRL taxonomies.
• IResourceLoadingOptions has a new member, ExternalResourceHandler; only code that implements the interface itself must add it.

1. Per-resource handler for external resources

New in the GroupDocs.Conversion.Options.Load namespace:

• IExternalResourceHandler with the method void OnLoading(ExternalResourceLoadingArgs args).
• ExternalResourceLoadingArgs with the properties Uri (string), Skipped (bool) and Data (byte[]).
• The ExternalResourceHandler property (IExternalResourceHandler, default null) on IResourceLoadingOptions and on WebLoadOptions, XmlLoadOptions, WordProcessingLoadOptions, SpreadsheetLoadOptions, CsvLoadOptions, TsvLoadOptions, PresentationLoadOptions, EmailLoadOptions, SvgLoadOptions, FinanceLoadOptions and ThreeDLoadOptions.

The handler is called for each resource the document asks to load, with the decision of SkipExternalResources and WhitelistedResources in Skipped. It can set Skipped to load or skip the resource, or set Data to supply the resource’s content. UNC paths and javascript: and vbscript: references never load, whatever the handler sets. If the handler throws, the operation throws GroupDocsConversionException with your exception as InnerException and the message:

The external resource handler failed while a resource was being loaded: <message of your exception>

The following handler loads JPEG images from one trusted host in addition to what the defaults allow:

public class TrustedJpegHandler : IExternalResourceHandler
{
    public void OnLoading(ExternalResourceLoadingArgs args)
    {
        Uri uri;
        if (Uri.TryCreate(args.Uri, UriKind.Absolute, out uri)
            && uri.Scheme == Uri.UriSchemeHttps
            && string.Equals(uri.Host, "cdn.example.com", StringComparison.OrdinalIgnoreCase)
            && (uri.AbsolutePath.EndsWith(".jpg", StringComparison.OrdinalIgnoreCase)
                || uri.AbsolutePath.EndsWith(".jpeg", StringComparison.OrdinalIgnoreCase)))
        {
            args.Skipped = false;
        }
    }
}

WebLoadOptions loadOptions = new WebLoadOptions
{
    ExternalResourceHandler = new TrustedJpegHandler()
};
using (Converter converter = new Converter("sample.html", (LoadContext loadContext) => loadOptions))
{
    converter.Convert("converted.pdf", new PdfConvertOptions());
}

2. Stricter defaults for external resources

With SkipExternalResources left at its default true:

• Local files outside the document’s folder are no longer loaded. Earlier versions loaded local files while other external resources were denied.
• UNC paths (\\host\share and its other forms) are never loaded, even with SkipExternalResources set to false.
• Scripts in HTML, MHTML, XHTML and SVG documents do not run, and no script file is requested. Set the new ExecuteScripts property of WebLoadOptions or SvgLoadOptions to true to run the scripts of documents you trust.
• SVG and SVGZ documents converted without load options use SvgLoadOptions, which skips external resources. PossibleConversions.LoadOptions for these formats now returns SvgLoadOptions instead of PageDescriptionLanguageLoadOptions.
• 3D models load material libraries, textures and buffers only from their own folder, and never from a remote location. ThreeDLoadOptions now has SkipExternalResources, WhitelistedResources and ExternalResourceHandler.
• XML converted through an XSL-FO stylesheet no longer loads external images, Markdown documents no longer fetch remote images, and HTML and e-mail converted to spreadsheet formats no longer embed images from outside the document’s folder.

3. Whitelist entries are absolute URI prefixes

Each WhitelistedResources entry is now the absolute URI prefix of a trusted location, such as https://cdn.example.com/assets/ or file:///C:/assets/. Earlier versions matched an entry wherever it appeared in the URL, so entries such as jpg or example.com were accepted. An entry that is not an absolute URI prefix makes the load fail with InvalidLoadOptionsException, whatever SkipExternalResources is set to:

Whitelisted resource '<entry>' is not valid. Expected an absolute URI prefix without a query, fragment or encoded '/', '\' or '.', such as 'https://cdn.example.com/assets/' or 'file:///C:/assets/'.

4. XBRL and inline XBRL taxonomies

FinanceLoadOptions now implements IResourceLoadingOptions and has SkipExternalResources (default true), WhitelistedResources and ExternalResourceHandler. While external resources are denied, an XBRL or inline XBRL document loads only when every taxonomy file it references is inside its own folder and the document is converted from a file path. Otherwise the load fails with InvalidLoadOptionsException, for example:

The XBRL document references '<reference>', which is outside the document's folder. External resources are denied, so the document cannot be loaded. Set FinanceLoadOptions.SkipExternalResources to false to load it.

For a document loaded from a stream:

The XBRL document references '<reference>'. It was loaded from a stream, so it has no folder to load local files from, and external resources are denied. Set FinanceLoadOptions.SkipExternalResources to false to load it.

To convert a filing that references a remote taxonomy:

using (Converter converter = new Converter("filing.xbrl", (LoadContext loadContext) => new FinanceLoadOptions { SkipExternalResources = false }))
{
    converter.Convert("filing.xlsx", new SpreadsheetConvertOptions());
}

5. Other behaviour changes

• ConversionEvents.OnDocumentFailed is now also called once for each contained document that cannot be loaded: an archive entry, an e-mail attachment, a mailbox item, or a file or OLE object embedded in a PDF, Word, Excel or PowerPoint document whose contents are converted. The context carries the item’s name, hierarchy level and item index, with FileType.Unknown as its source and converted format. The item is skipped, as before.
• In evaluation mode, the 3-page limit now also applies to SVG, SVGZ, PS and PCL output.
• PublisherDocumentInfo.PagesCount returns the number of pages of the Publisher document instead of always 1.
• Conversions write the requested format instead of always DOCX, XLSX, PPTX or a multi-frame TIFF, and honour page selection where they ignored it, so the output can differ from earlier versions for the same options.
• Transparent page backgrounds converted to J2K, JP2, WMF and WMZ are no longer black.
• The NuGet packages depend on System.Security.Cryptography.Pkcs 8.0.2 (10.0.13 for .NET 10), and the .NET 6 packages and GroupDocs.Conversion.LowCode also on System.Formats.Asn1 8.0.2.

Updated documentation

• Network access and data privacy – new: when the library accesses the network and how to run it offline
• Skip loading of external resources – the defaults, whitelist entries and their migration, the per-resource handler, scripts, XBRL and 3D
• Migration notes – migrating to 26.10
• Conversion events – OnDocumentFailed for contained documents that cannot be loaded
• Load options for markup, XML, Word processing, presentation, spreadsheet, CSV, e-mail, SVG, finance, 3D and page description language documents – the ExternalResourceHandler, ExecuteScripts, SkipExternalResources and WhitelistedResources options
• Convert finance documents and Convert to finance formats with advanced options – XBRL documents with a remote taxonomy