Upgrading weasyprint 60 to 61
Breaking60.2 → 61.2Breaking1Security2New6Changed1Fixed18Other3
SecurityAlways uses the URL fetcher for attachments, fixing a security issue in WeasyPrint 61.0 and 61.1.Advisory ↗
BreakingUpgrade verdict
1 breaking change and 2 security fixes.
In plain terms
- If your code reads the list of attachments on a document, each item is now an object with attributes rather than a pair of values.
- This security update makes WeasyPrint fetch attachments through its normal URL fetcher, closing a hole that affected versions 61.0 and 61.1.
- WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
Must act 3 items need code or config changes
Python requirement changed in 61.0: >=3.7 → >=3.8.
What you must change
Breaking1
DocumentMetadata.attachments is now a list of Attachment objects instead of (url, description) tuples.
DocumentMetadata.attachmentsAttachmentSecurity2
Always uses the URL fetcher for attachments, fixing a security issue in WeasyPrint 61.0 and 61.1.
WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
High · CVSS 7.4