pontedilana/php-weasyprint

Added

• Support WeasyPrint 69.0 new --output-intent option

Security

• Fix potential SSRF and local file disclosure: option URLs are fetched server-side only when their scheme is allowed (http, https by default, configurable via the new $allowedSchemes constructor argument)
• Fix potential arbitrary file deletion at shutdown: removeTemporaryFiles() now only deletes files located inside the temporary folder
• Fix PHAR deserialization via the output filename (CVE-2023-28115 case-insensitive bypass): the output path is now validated against a scheme allow-list instead of a case-sensitive phar:// check

Security

• Fix potential shell-command injection through the WeasyPrint binary path: buildCommand() now verifies the binary is executable on the unescaped path and shell-escapes it before use
• Update symfony/process minimal version to mitigate CVE-2026-24739

Added

• Support WeasyPrint options (--info, --quiet, --verbose, --debug, --version, --no-http-redirects, --fail-on-http-errors)

Added

• Support WeasyPrint 68.0 new --attachment-relationship and --xmp-metadata options

Added

• Support WeasyPrint 67.0 new --allowed-protocols option
• Support Symfony 8.0
• More tests

Added

• Support PHP 8.5
• More tests

Added

• Support WeasyPrint 66.0 new --pdf-tags option

Added

• Add --timeout option to the WeasyPrint command-line call by default. This improves consistency with the internal process timeout already applied by Symfony Process. If you're running WeasyPrint inside a worker, queue, or other timeout-managed environment, you can disable it using $pdf->disableTimeout() or $pdf->setTimeout(null). (#15)
• Add disableTimeout() method to easily disable the new CLI timeout behavior

Security

• Update symfony/process minimal version to mitigate CVE-2024-51736

Added

• Support WeasyPrint 63.0 new srgb option
• Added support for PHP 8.4