JasperReports 7.1.1 PDFs: Fonts, Extra JARs and PDF/UA Tags

An HTML timesheet sent through a JasperReports text field came out as nine plain lines of 10-point Helvetica down the left margin. That run used JasperReports Library 7.1.1 (Maven Central, 1 November 2026, GNU LGPL v3), the Java engine that compiles JRXML band designs, fills them and writes PDF among other outputs. What follows is a checklist of what tripped up a Java 17 build on its way to a PDF, with every item reproduced in a run or traced to the changelog and the advisory databases.

We work at Iron Software, and the end of this article covers our library, IronPDF.

What an HTML Timesheet Looks Like in a JasperReports Text Field

HTML enters only as the content of a text element flagged markup="html", where a Swing JEditorPane parses it, per the markup sample in the vendor's docs. The test template is one such field, fed a timesheet the way a web app would serve it, <style> block and all.

import net.sf.jasperreports.engine.JREmptyDataSource; import net.sf.jasperreports.engine.JRException; import net.sf.jasperreports.engine.JasperCompileManager; import net.sf.jasperreports.engine.JasperExportManager; import net.sf.jasperreports.engine.JasperFillManager; import net.sf.jasperreports.engine.JasperPrint; import java.util.HashMap; import java.util.Map; public class TimesheetMarkupReport { public static void main(String[] args) throws JRException { // A stylesheet rule, a CSS grid and a table, as a web app would serve the timesheet. String html = "<style>.over { color: #c00; font-weight: bold }</style>" + "<h2>Timesheet, week 42</h2>" + "<div style='display:grid;grid-template-columns:1fr 1fr'><div>A. Novak</div><div>R. Osei</div></div>" + "<table border='1'><tr><th>Engineer</th><th>Hours</th></tr>" + "<tr><td>A. Novak</td><td>38.5</td></tr>" + "<tr><td>R. Osei</td><td class='over'>44.0</td></tr></table>"; Map<String, Object> parameters = new HashMap<>(); parameters.put("Html", html); // html-markup.jrxml holds one text field with markup="html" that prints the Html parameter. JasperPrint print = JasperFillManager.fillReport( JasperCompileManager.compileReport("html-markup.jrxml"), parameters, new JREmptyDataSource()); JasperExportManager.exportReportToPdfFile(print, "timesheet-markup.pdf"); } } 

Read with pypdf, the content stream of the 1,147-byte timesheet-markup.pdf holds nine text runs at x = 40, each about 12.58 points below the last and all in 10-point Helvetica, so the h2 is the size of a table cell. A. Novak and R. Osei, meant to sit side by side in the grid, follow each other down the page. Engineer, Hours and the four cell values do the same with no border drawn around them, and 44.0 prints in black because the .over class never took effect. There is not a single rectangle or line operator on the page.

Script never runs here, and the 7.0.2 release deleted the old Chrome add-on for JavaScript visualizations. For HTML-first teams, the vendor's route is a rebuild of each layout in Jaspersoft Studio.

Fonts That Stop a Report at Fill Time

Point a style at a family the JVM has never seen, such as fontName="Report Serif", and JasperFillManager throws JRFontNotFoundException before any page exists. The trace passes through TextMeasurer, since line breaking needs real glyph widths. According to the exception's Javadoc, refusing to guess is deliberate, because a stand-in font shifts the metrics and may clip text.

Leaving the font unset has a cost too. An invoice template that marks its title bold="true" and names no font exported a file with one font, Helvetica, and drew that title in the regular weight. The recommended route for bold faces and custom families is a font extension, registered in a properties file at the classpath root, though a pdfFontName attribute on each element also printed bold in a test run.

net.sf.jasperreports.extension.registry.factory.simple.font.families=net.sf.jasperreports.engine.fonts.SimpleFontExtensionsRegistryFactory net.sf.jasperreports.extension.simple.font.families.reportserif=fonts/reportserif/fonts.xml 

Add a fonts.xml mapping the family to DejaVu Serif regular and bold, and the export embeds both as subsets. A house typeface means maintaining that bundle alongside the templates.

Encryption, PDF Export and the Extra JARs They Need

Since 7.0.0 the PDF writer lives in jasperreports-pdf, and leaving it out produced a JRRuntimeException naming that artifact. The writer runs on 1.3.43.jaspersoft.2, a Jaspersoft fork of OpenPDF hosted in a Jaspersoft repository and absent from Central, so a Central-only mirror cannot resolve it as declared. Since 7.0.8 the writer also accepts stock OpenPDF 1.3.43 from Central in its place, and a swapped-in run exported both timesheet reports with one warning that link annotation tagging for PDF/UA was off. Its OpenPDF 3 sibling from 7.1.0, jasperreports-openpdf, pulls in a Jaspersoft build of OpenPDF 3.0.5 compiled for Java 21, and that build raised UnsupportedClassVersionError on Java 17.

Encryption brings in one more JAR, as this export of a compiled timesheet.jasper with two passwords shows.

import net.sf.jasperreports.engine.JRException; import net.sf.jasperreports.engine.JasperFillManager; import net.sf.jasperreports.engine.JasperPrint; import net.sf.jasperreports.engine.data.JRMapCollectionDataSource; import net.sf.jasperreports.export.SimpleExporterInput; import net.sf.jasperreports.export.SimpleOutputStreamExporterOutput; import net.sf.jasperreports.pdf.JRPdfExporter; import net.sf.jasperreports.pdf.SimplePdfExporterConfiguration; import java.util.HashMap; import java.util.List; import java.util.Map; public class EncryptedTimesheet { public static void main(String[] args) throws JRException { Map<String, Object> parameters = new HashMap<>(); parameters.put("Week", "week 43"); // Map rows need no bean class, and each key matches a field in the template. List<Map<String, ?>> rows = List.of( Map.of("project", "Billing API", "engineer", "A. Novak", "hours", 30.0), Map.of("project", "Data platform", "engineer", "R. Osei", "hours", 38.5)); JasperPrint print = JasperFillManager.fillReport( "timesheet.jasper", parameters, new JRMapCollectionDataSource(rows)); JRPdfExporter exporter = new JRPdfExporter(); exporter.setExporterInput(new SimpleExporterInput(print)); exporter.setExporterOutput(new SimpleOutputStreamExporterOutput("timesheet-week-43.pdf")); // A user password to open the file, an owner password to change it, and printing as the one permission. SimplePdfExporterConfiguration config = new SimplePdfExporterConfiguration(); config.setEncrypted(true); config.set128BitKey(true); config.setUserPassword("week43"); config.setOwnerPassword("payroll-admin"); config.setAllowedPermissionsHint("PRINTING"); exporter.setConfiguration(config); exporter.exportReport(); } } 

Run with only the JasperReports JARs, exportReport threw NoClassDefFoundError naming an org.bouncycastle.asn1 class (ASN1OctetString or ASN1Encodable, varying between runs) and left a 0-byte timesheet-week-43.pdf behind. Bouncy Castle does not arrive with the PDF extension, and the vendor's PdfEncrypt sample adds bcprov-jdk18on itself. With version 1.86 added at runtime, the result needed week43 to open, used 128-bit RC4 (V 2, R 3), and allowed printing and nothing else. That matches the usual password-protection split of an open password and a change password.

Advisories That Still Apply to 6.x and Early 7.x

The table lists the records in NVD, CVE.org, OSV and the GitHub Advisory Database on 3 November 2026 for the library and for the Jackson version its last 6.x release declares.

Both library records describe Java deserialization with a path to remote code execution, and neither is marked disputed. Of the Jackson entries, CVE-2026-91776 is one of the high ones, about jackson-databind keeping every unknown raw type ID. OSV holds CVE-2026-110879 and CVE-2026-68498 with no affected package attached, so a query for Jackson 2.17.1 does not return them, and their ranges come from CVE.org. The last 6.x release, 6.21.5, dates from 4 July 2025, before either library fix, and no later 6.x release is on Maven Central. A 7.1.1 build with the PDF extension and Bouncy Castle came back with zero OSV matches across its 34 JARs, and the move there runs through the template change below.

Version 7 Template Conversion and the PDF/UA Tagging Change

Version 7 swapped the Commons Digester parsers for Jackson XML, and its changelog says the 7.x library on its own cannot open .jrxml or .jrtx files saved by 6.x or earlier. Jaspersoft Studio 7 or newer converts them. Every .jasper file needs a fresh compile, imports change where packages moved into separate JARs, and the 3D pie, bar and stacked bar charts come out flat because the 7.1.1 chart theme hands each 3D type to its flat chart method. Since 7.0.6, jasperreports-maven-plugin can run the update and compile steps inside a build.

Accessibility work meets an edition line in the same changelog. Release 7.0.8 put PDF tagging behind a PdfTagger interface and moved its newest, fullest implementation into the JasperReports Library Professional extensions, and tagging is what PDF/UA and PDF/A files rely on.

Where an HTML Renderer Fits

Markup that loses its layout, fonts to package, extra JARs, a Jaspersoft repository, 6.x advisories and an edition line for tagging add up to a long list, and IronPDF for Java shortens it whenever the source is an HTML page.

Our timesheet string went to PdfDocument.renderHtmlAsPdf untouched on 2026.11.3, and the grid split the two names into columns while the .over rule printed 44.0 in bold red. The renderHtmlAsPdf example shows the call. For the password step, getSecurity().setPassword and setOwnerPassword do the work, and the ironpdf POM declares no Bouncy Castle dependency to add. Tagged output comes from convertToPdfUA and convertToPdfA in that one com.ironsoftware:ironpdf dependency, which has eleven 2026 builds on Maven Central, 2026.1.3 through 2026.11.3.

What This Means for HTML Reports on JasperReports

For reports that start as HTML pages, IronPDF is where we would begin, since the timesheet above needed no JRXML rewrite. A free trial key is enough to run your own page through it.

Did the version 7 template conversion or the font setup take your team longer?

JasperReports and Jaspersoft are trademarks of their owner, we have no affiliation with Actian or the Jaspersoft business, and the details above draw on the project's changelog, POMs and samples, NVD, CVE.org, OSV, Maven Central and our own runs.

Drafted with AI. JasperReports code run and claims checked by the Iron Software DevRel team against net.sf.jasperreports:jasperreports 7.1.1 on 3 November 2026, with the IronPDF details checked against the com.ironsoftware:ironpdf 2026.11.3 API.