News
From a principle to a product.
The honest arc: years of standards research and private development, then a run of public releases in 2026. Newest first.
2026
Public releases
Documentation lands at nextpdf.dev
A full documentation site — guides, the API surface, conformance notes, and per-edition references — goes live, so evaluating NextPDF means reading the real docs, not a sales deck.
Read the docs ↗getnextpdf.com and the blog go live
The site you're reading — product pages, a migration hub, a showcase of real engine output, and a blog — launches as the front door to NextPDF.
Read the blog →An independently-certified information-security program
NextPDF is built by PATEON Network Technology, whose information-security management system is independently certified to ISO/IEC 27001:2022. The certificate (QCC/B86F/1224) is verifiable on the public IAF registry — we'd rather you check than take our word for it.
Verify on the Trust Center →Freezing the public API for the next major
The PDF inspection surface, the RFC 5280 PKI path-validation contracts, and the RAG vector-index interfaces graduate to a frozen, stable API — a commitment that they will not break under a minor release.
On engineering quality →PAdES signing, end to end
The high-level signing seam now produces CMS-verifiable signed PDFs at the B-B baseline, with the B-T timestamp and the long-term B-LT / B-LTA levels driven through the same call — from a baseline signature to archival-grade validation.
Signing, explained →NextPDF 6.0 — modern CSS layout, on by default
Our first major release. CSS Grid, Container Queries, and Subgrid graduate to Stable and are enabled by default, with a migration guide and a preflight scanner so the upgrade is mechanical. PHPStan Level 10 across the source, zero errors.
Read the changelog →NextPDF 5.0 — typography, post-quantum signing, e-invoicing groundwork
Vertical CJK, tate-chu-yoko, and Ruby typography; post-quantum signer interfaces (FIPS 204 / 205) and an RFC 3161 + RFC 5816 timestamp verifier; EN 16931 / Factur-X / ZUGFeRD governance; and reproducible builds.
Read the changelog →NextPDF 3.0 — typed exceptions and a decomposed HTML parser
Typed, context-carrying domain exceptions replace generic failures, and the HTML parser was broken out of a 3,876-line monolith into a focused orchestrator plus collaborators. Supply-chain hardening: SHA-pinned CI across every repository.
Why it matters →NextPDF 2.0 — the name
The engine took its NextPDF identity: the NextPDF\* namespace, the nextpdf/core package, and the nextpdf-labs organization. A mechanical, fully-documented rename.
Read the changelog →NextPDF 1.7 — worker-safe architecture and PHPStan Level 10
An immutable Config, process-lifetime font and image registries, and a DocumentFactory built for long-running workers (Octane, Swoole, RoadRunner). Static analysis raised to PHPStan Level 10 (max) with zero errors.
See the Laravel adapter →NextPDF 1.6 — a production Docker image
A multi-target Docker base image producing FPM (web) and CLI (queue-worker) variants from a single source — a sane starting point for running the engine in production.
See the integrations →NextPDF 1.2 — first public release
The PDF 2.0 generation core and HTML-to-PDF rendering go public under Apache-2.0 — the open foundation that every edition and adapter builds on.
Explore the editions →
2025
Private beta & adapters
Deterministic, reproducible output
Given the same inputs, the engine emits the same bytes — the property that makes golden-file testing and reproducible archival possible. Determinism was designed in, not bolted on.
See verifiable output →Archival and long-term signatures by design
Design work on PDF/A-2/3/4 archival output and the long-term PAdES levels (B-LT / B-LTA) — the profiles a document needs to keep verifying years after its signing certificate expires.
Hardening and adversarial review
A fail-closed posture became the rule rather than the exception: untrusted input is rejected with a typed error, outbound transports must be pinnable, and the dependency closure is SHA-pinned. Security is a property you can audit, not a banner.
Hybrid e-invoicing groundwork
Modelling the EN 16931 semantic invoice and the ZUGFeRD / Factur-X hybrid container — a readable PDF that also carries the structured XML a tax authority can parse.
The e-invoicing model →Connect: deterministic PDF tools for agents
A prototype of the Connect server — exposing NextPDF as deterministic tools over MCP, REST, and gRPC, so an AI agent can generate, inspect, and convert PDFs without hallucinating the output.
About Connect →Framework adapters take shape
Integration previews for Laravel, Symfony, and CodeIgniter — idiomatic facades and bindings so the engine feels native in each framework rather than bolted on.
See the integrations →Private design-partner builds
Closed builds put the engine in front of early partners under NDA. The worker-safe architecture — immutable config, disposable documents, registry warm-up — was proven under long-running PHP workers before any public release.
2024
Foundations
Clean-room lineage and documented provenance
The engine carries a documented, clean-room upstream lineage rather than an untraceable copy — provenance discipline that matters when you are deciding whose code to run in production.
Accessibility and signatures as non-negotiables
Conformance research into PDF/UA tagging and PAdES digital signatures. Regulation — the EU Accessibility Act, eIDAS — turns these from nice-to-haves into table stakes, so they were designed in, not added on.
Signing, explained →An information-security program from day one
The information-security management system that would later be independently certified to ISO/IEC 27001:2022 was established early — a deliberate choice for a vendor asking teams to run its code in production.
Trust Center →The testing pyramid and the oracle discipline
Output is never graded by the engine that produced it. Golden-file snapshots pin every render, and external oracles — qpdf, veraPDF — verify conformance independently. If we can't prove it, we don't claim it.
See verifiable output →Reading PDF 2.0 cover to cover
Spec-coverage research against ISO 32000-2 began in earnest, grounded in the primary standards rather than folklore. Every conformance claim traces to a clause, not a guess.
A PDF engine that refuses to guess
The founding principle: produce spec-exact output, or raise a typed error — never silently emit something a reader can't open. Everything after this followed from that one rule.
Why NextPDF →
Entries dated 2024–2025 describe development, research, and design milestones — not public version releases. The 2026 entries map to real tagged releases (see the changelog), and every standards or security claim is something you can verify yourself on theTrust Center or in the showcase.