Dear GroupDocs customers,
We are pleased to announce the release of GroupDocs.Merger for .NET v26.10. This release puts the loading of external resources under your control: images, stylesheets and other files a document references from outside itself are no longer loaded unless you allow them. It also brings nine fixes for EPUB and TeX documents processed from several threads, fixed-layout and other EPUB documents, auto-tagged PDF output, .NET Framework projects and the LowCode products.
Key New Features
Control of External Resources: LoadOptions has three new properties. SkipExternalResources is true by default, so remote and local resources a document references are skipped and the operation continues. WhitelistedResources takes absolute URI prefixes of trusted locations that are still loaded, and ExternalResourceHandler takes your own IExternalResourceHandler, whose OnLoading method can allow, skip or supply the content of each resource. Content the document carries itself (data: URIs, cid: references, MHTML parts and packaged media) still loads.
LoadOptions loadOptions = new LoadOptions(FileType.HTML)
{
// Load resources from one trusted location only; everything else stays denied
WhitelistedResources = new List<string> { "https://cdn.example.com/assets/" }
};
using (Merger merger = new Merger(@"c:\page1.html", loadOptions))
{
merger.Join(@"c:\page2.html");
merger.Save(@"c:\merged.html");
}
The options are read when the Merger is created, and documents joined to it follow them. For documents you trust, set SkipExternalResources to false to load everything as before.
Major Improvements & Fixes
Fixed EPUB documents intermittently failing with NullReferenceException or IndexOutOfRangeException when processed from several threads.
Fixed an ArgumentException when TeX documents are loaded from several threads.
Fixed-layout EPUB documents now have one page per book page, so page N is the book’s page N and GetDocumentInfo no longer reports twice the page count.
Fixed NullReferenceException for EPUB documents whose table of contents file does not have the .ncx extension.
A PDF document saved with auto-tagging now keeps the PDF format and the title of the source. It is no longer marked as PDF/UA-1 unless the source was, and an untitled source no longer gets the title “Tagged PDF”.
Fixed image joins failing to load System.ValueTuple in .NET Framework packages.config projects.
Fixed joins with SVG documents failing on .NET Framework 4.6.2 to 4.7.0 runtimes.
The packages now depend on System.Security.Cryptography.Pkcs 8.0.2 (.NET 6.0 and .NET 8.0) or 9.0.21 (.NET 10.0), the versions that fix CVE-2026-84008 and CVE-2026-70162.
LowCode products: an output path given as a bare file name is saved to the current directory, and JoinPdf, JoinDocx and JoinPptx reject a joined document of another format with FileTypeNotSupportedException before any output is written.
Breaking Changes
External resources are no longer loaded by default. Remote resources, UNC paths, local files (including files in the document’s own folder) and relative references that point outside the document are skipped. Earlier versions loaded them, so remote images and stylesheets of HTML, Word and presentation documents can now be missing from the output, and the page count of HTML and Word documents can change. Whitelist the locations you trust, or set SkipExternalResources to false for trusted documents.
LoadOptions is now sealed. A class derived from it no longer compiles; use LoadOptions directly or implement ILoadOptions.
A WhitelistedResources entry that is not a valid absolute URI prefix makes the Merger constructor throw ArgumentException, and a handler that throws makes the operation throw GroupDocsMergerException (“The external resource handler threw an exception; the resource was skipped. See the inner exception.”).
EPUB documents, and SVG and SVGZ documents in some operations, have their markup checked for external references. A document whose markup is not well-formed XML fails with GroupDocsMergerException (“The document’s markup could not be read to check it for external resources, so it was not loaded. Set SkipExternalResources to false without an ExternalResourceHandler to load it without the check.”).
Useful Links
Full Release Notes – View the complete list of changes and technical details.
Release Blog Post – Highlights of v26.10.
Download from NuGet – Update your project to the latest version.
Direct Download – ZIP and MSI packages.
Skip Loading of External Resources – How the whitelist and the handler work, and which formats they cover.
Network Access and Data Privacy – When GroupDocs.Merger accesses the network.
Updated GitHub Examples – Loading external resources from trusted locations, and deciding each resource with a handler.
Product Documentation – Explore guides and API references.
If your documents reference remote images or stylesheets, please review the breaking changes above before upgrading and allow the locations you trust. If you process EPUB or TeX documents from several threads, or save auto-tagged PDF documents, we recommend upgrading to this version.
As always, we value your feedback. Please let us know if you have any questions or feature requests for our upcoming releases!
Best regards,
The GroupDocs Team