## Problem/Motivation tecnickcom/tcpdf 6.x has reached end of life and receives no fixes anymore, including security fixes ([TCPDF#867](https://github.com/tecnickcom/TCPDF/issues/867)); 6.11.4 is the final release. TCPDF 7.0.0 (June 2026) turned `\TCPDF` into a compatibility facade over [tecnickcom/tc-lib-pdf](https://github.com/tecnickcom/tc-lib-pdf) 8.x. The public method signatures are unchanged, but output is not byte-identical and fonts are handled differently. The 2.x releases of this module require `tecnickcom/tcpdf: ^6.11.4`. Tested on 2026-10-03 with tecnickcom/tcpdf 7.0.13, tc-lib-pdf 8.78.1 and tc-lib-pdf-font 4.5.0 on Drupal 11.4 (PHP 8.5): 1. **No fonts after `composer install`.** `tc-lib-pdf-font` does not ship its fonts. They have to be built with `php vendor/tecnickcom/tc-lib-pdf-font/util/build_fonts.php`, which downloads about 117 MB of font sources and writes about 42 MB into `vendor/`. TCPDF only runs this step in its own `post-install-cmd`, which Composer does not execute for dependencies, and every update of tc-lib-pdf-font deletes the built fonts again. Upstream treats this as intended, see [tc-lib-pdf-font#20](https://github.com/tecnickcom/tc-lib-pdf-font/issues/20) and [tc-lib-pdf-font#2](https://github.com/tecnickcom/tc-lib-pdf-font/issues/2). 2. **Fonts could not be loaded in Drupal even when built**, because of a `vendor/composer/../` path. Fixed upstream in TCPDF 7.0.15: [TCPDF#880](https://github.com/tecnickcom/TCPDF/issues/880). 3. **HTML footers broke the document.** Fixed upstream in TCPDF 7.0.15: [TCPDF#881](https://github.com/tecnickcom/TCPDF/issues/881). ## Proposed resolution Support TCPDF 7 in a new major version (3.0.x). Allowing `^7` in 2.x is not an option: Composer would upgrade every site on the next `composer update`, and PDF generation breaks on all sites that have not built the fonts. Implemented in !18: - Require `tecnickcom/tcpdf: ^7.0.15`, `composer-runtime-api: ^2.1` and Drupal `^11.3 || ^12` (Drupal 10 is dropped). - Fonts: sites build them, either inside `vendor/` (optionally with a Composer script) or into a directory of their choice set with `$settings['tcpdf_fonts_path']`. The module passes the resolved directory to TCPDF as `K_PATH_FONTS` and reports missing fonts in the status report, with the build command. - `tcpdf.config.inc` only defines the constants that differ from TCPDF's defaults (`K_PATH_FONTS`, `PDF_IMAGE_SCALE_RATIO`). - The TCPDF cache directory (`temporary://tcpdf/cache`) is removed, as TCPDF 7 no longer uses it. - README: requirements, font build, local files (`K_ALLOWED_PATHS`) and `<tcpdf>` tags. - Tests: font directory, status report, and a generated PDF with a header callback and an HTML footer. CI builds the fonts in the Composer jobs. Using tc-lib-pdf directly, without the TCPDF facade, would change the API of `TCPDFDrupal` and `tcpdf_get_instance()` completely. That could be a later step. ## Remaining tasks - [x] [TCPDF#880](https://github.com/tecnickcom/TCPDF/issues/880) fixed upstream - [x] [TCPDF#881](https://github.com/tecnickcom/TCPDF/issues/881) fixed upstream - [x] Decide how sites get the fonts: build step, inside or outside of `vendor/` - [x] Open the 3.0.x branch and implement the points above (!18) - [x] Release 3.0.0 ## User interface changes The status report shows whether TCPDF finds its fonts. The entry for the TCPDF cache directory is removed. ## API changes - `<tcpdf>` tags in HTML are disabled by default: `K_TCPDF_CALLS_IN_HTML` is no longer set to `TRUE`. Sites that use them define `K_TCPDF_CALLS_IN_HTML` and `K_ALLOWED_TCPDF_TAGS` in `settings.php`. - TCPDF 7 only reads local files from trusted directories. Images outside of them need `K_ALLOWED_PATHS` in `settings.php`. - New setting `$settings['tcpdf_fonts_path']`. - `TCPDFDrupal` keeps extending `\TCPDF`; `tcpdf_get_instance()` and `DrupalInitialize()` are unchanged. ## Data model changes None. AI-assisted: Yes (draft of the issue summary)