Four names circulate for what people mean by DevExpress reporting, and picking the wrong one costs a subscription. XtraReports is the API and namespace. DevExpress Reporting is the marketing name for the same product, and the docs use both interchangeably. DevExpress Report Server is a separate hosting service for publishing and scheduling, priced separately. The Office File API is a fourth product entirely, and it is the one holding the general-purpose HTML-to-PDF converter. Buying Reporting and expecting the fourth thing is a procurement mistake, not a coding one.
Full disclosure. We build IronPDF at Iron Software, and this read looks at where DevExpress Reporting's second purchase for a working HTML-to-PDF converter costs a team, and where IronPDF renders the same page from one package.
Which DevExpress Product Are You Buying?
Inside DevExpress Reporting there are two ways to get HTML-flavoured content into a report, and neither is a browser. The first is XRLabel.AllowMarkupText, a small markup dialect covering line breaks, colour, bold, and size. The second is XRRichText, which imports HTML and RTF through the DevExpress word-processing document model.
// Two entry points, two different engines, neither a browser
var summaryLabel = new XRLabel { AllowMarkupText = true, Text = "<b>Q3</b> summary" };
var bodyBlock = new XRRichText();
bodyBlock.Html = File.ReadAllText("statement-body.html");
Both put content on the page. Neither guarantees the result matches what a browser draws, and DevExpress says so directly. Its HTML support limitations page states that the component is not designed to fully support the HTML format, that interpretation is limited and optimised for documents rather than web pages, and that it can display a document differently from a browser even when every tag imported. Some HTML tags and CSS attributes have no counterpart in the Open XML and RTF models underneath.
For a report built from DevExpress's own controls that is a non-issue. For a layout designed as a web page it is a rewrite, because the document-to-PDF path for Word content is a different problem from rendering a stylesheet, and IronPDF is the one of the two built for the stylesheet.
What Redistribution Grants You
Two things about DevExpress's commercial terms hold up under a direct read.
Its EULA states that the company charges no royalties for redistribution of components integrated into applications you engineer, and rights of use survive a lapsed subscription, so a team that stops renewing keeps a working licensed build and loses only updates and support. The End-User Report Designer is redistributable on the same terms, so shipping report authoring to your own customers adds no per-deployment fee. That is a materially different commitment profile from a model metering by server or by end user. IronPDF charges per developer once and redistributes with no royalty on the same basis, without a designer to licence alongside it.
Platform reach is the second. The current line supports WinForms, WPF, ASP.NET Web Forms, MVC, ASP.NET Core, Blazor Server, Blazor WebAssembly, and .NET MAUI for Android and iOS, and the Report Designer runs inside Visual Studio, VS Code, and JetBrains Rider. Version 26.1 shipped in June 2026 on the usual twice-yearly cadence, targeting .NET 8 through .NET 10 alongside .NET Framework 4.6.2 and later, with PDF/UA-2 export added to the PDF engine. Cross-tabs, subreports, chart types in the dozens, and parameter-driven queries against a live data source sit on top of that, and that spread is the ceiling of what the reporting subscription reaches, because IronPDF covers the same targets from one package with no designer to install per IDE.
Where Does the HTML-to-PDF Converter Live?
The one place DevExpress documents complete HTML-to-PDF conversion is RichEditDocumentServer.ExportToPdf, which lives in DevExpress.RichEdit.Core and is documented under the Office File API rather than under Reporting. A team already paying $799.99 per developer in the first year for Reporting, with a $399.99 renewal, is looking at a second subscription to get a general-purpose converter, and it still runs through the same word-processing engine with the same document-not-web-page limitations.
Deployment adds a second surprise. The default bitmap path in XRPdfContent, CreateDXBitmap, is documented as not working in Linux environments or on certain Azure hosting plans. A fix exists, adding DevExpress.Pdf.SkiaRenderer and, on Linux, SkiaSharp.NativeAssets.Linux, but the default configuration does not apply it and a deployment has to know that before the first container ships. IronPDF reaches Linux and Azure App Service from one package and one call, the same ones it uses on Windows, so the difference is not capability but how much environment-specific knowledge the team carries forward.
One upgrade trigger gets exaggerated, so here it is precisely. Reporting is sold standalone, and buying it does not require Universal. What holds up is that the Reporting subscription's WinForms integration covers ReportPrintTool and ReportDesignTool only, and DevExpress's own documentation states that adding further DevExpress UI controls, meaning new panels, buttons, or menus, requires a subscription including those controls. Customising the designer chrome therefore means WinForms at $1,099.99 first year and $549.99 renewal, or Universal at $2,299.99 first year and $1,149.99 renewal.
One CVE, Two Scores, and No Fixed Version on Record
Two CVEs name the reporting component, and both deserve care instead of a headline number.
CVE-2023-35814 is described by NVD as a failure in DevExpress before 23.1.3 to properly protect XtraReport serialized data in ASP.NET web forms, classed CWE-502. The scores diverge sharply, because NVD's primary assessment is 9.8 critical while the CNA's own secondary assessment on the same record is 3.5 low. The practical answer sits in the affected-version list rather than either score, covering everything before 21.2.12 plus the 22.1, 22.2, and 23.x lines up to the 23.1.3 fix.
CVE-2021-36483 is the older one. NVD rates it 8.8 high, published 4 August 2021, and describes insecure deserialization in DevExpress.XtraReports.UI through v21.1, with references to DevExpress Support Center tickets and ZDI-22-341. NVD lists no fixed version for it. That is a statement about the public record, not a claim the vendor ignored it, and anyone still on a 21.x build should treat the deserialization path as reachable rather than wait for a database field to fill in. Beyond those two, NVD carries other CVEs against DevExpress products naming no specific component, so confirm the affected assembly before citing one. Either way, deserialization surface is a category of exposure that a PDF pipeline built on rendering and encryption never opens.
Document Output at Two Subscription Prices
Scoped to document output alone.
| Capability (document output only) | DevExpress Reporting | IronPDF |
|---|---|---|
| PDF from a designed report | Native XRDocument export |
Renders markup, a URL, or a Razor view through ChromePdfRenderer
|
| HTML and CSS to PDF |
AllowMarkupText dialect or XRRichText, no browser engine |
Chromium rendering of HTML, CSS, and JavaScript |
| Razor view or URL rendered directly | Bound into a report definition first | Direct, via RenderUrlAsPdf or a .cshtml view |
| Editing an existing third-party PDF | Export pipeline only | Merge, split, stamp, fill forms |
| Per-developer cost for the HTML-to-PDF path | $799.99 first year for Reporting, plus a second subscription for the converter | 1 licence, 1 product, 0 converters to add |
Table 1. Document output only, DevExpress Reporting against IronPDF, excluding the designer, scheduler, and data-binding surface.
The last row is the one an architect signs off on. Every other row is a capability question, while that one is a renewal repeating annually for as long as the pipeline exists.
IronPDF Needs No Report Project
When the content is already markup and the deliverable is a file, the report definition is the step that disappears.
using IronPdf;
var reportRenderer = new ChromePdfRenderer();
// Print media so the template's @page rules and page breaks are honoured
reportRenderer.RenderingOptions.CssMediaType = IronPdf.Rendering.PdfCssMediaType.Print;
reportRenderer.RenderingOptions.MarginTop = 20;
using PdfDocument quarterly = reportRenderer.RenderHtmlAsPdf(quarterlyHtml);
quarterly.SaveAs("quarterly-2026-q3.pdf");
The PDF IronPDF returns keeps selectable text and the source stylesheet's layout intact, including the CSS constructs that importer has no counterpart for. Teams generating markup from MVC can render the Razor view itself, and page furniture is set through rendering options.
Everything upstream of that call belongs to DevExpress. A business user designing their own report, a parameter-driven query against a live data source, a cross-tab or a subreport all belong to the platform. DevExpress Reporting's ceiling is that all of it is priced into the export path too, including for a workload that never opens the designer. The pattern for the renderer half is worked through end to end. IronPDF has a free trial for running one of your existing report outputs through it first.
If you have shipped DevExpress Reporting to a Linux container, did the Skia packages come up during evaluation or during the first failed deploy? Drop a comment, because that ordering seems to decide how people remember the experience.
DevExpress and XtraReports are trademarks of their owner and this piece is not affiliated with the company. The pricing, licensing, HTML support, Linux export, and CVE details above are drawn from DevExpress's own documentation and NVD as they stood at the time of writing. If a detail has changed since, correct us in the comments.
