Upgrading weasyprint 68 to 69
Breaking68.1 → 69.0Breaking2Security1New6Fixed19Other3
SecurityFixes a CSS injection vulnerability when rendering untrusted HTML with presentational hints and restricted CSS properties.CVE-2026-49452 ↗
BreakingUpgrade verdict
2 breaking changes and a security fix.
In plain terms
- Python callers that set srgb=True must now set output_intent instead.
- The old --srgb switch is gone. Use --output-intent=srgb instead, or pick another output intent.
- A security hole could let malicious HTML sneak in CSS styles when presentational hints are enabled. Upgrade to stay safe.
Must act 3 items need code or config changes
What you must change
Breaking2
Replaces the srgb boolean in default options with an output_intent string entry in the Python API.
output_intentsrgbReplaces the --srgb command-line option with --output-intent=srgb; other values include device-cmyk or a @color-profile identifier.
--srgb--output-intentdevice-cmyk@color-profileSecurity1
Fixes a CSS injection vulnerability when rendering untrusted HTML with presentational hints and restricted CSS properties.
--presentational-hintsAPI changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- removed:
export FONT_UNITS - removed:
export FontUnitInMath - changed:
constructor ColorProfile(file_object, descriptors) → constructor ColorProfile(file_object, src, rendering_intent, components) - changed:
constructor ComputedStyle(parent_style, cascaded, element, pseudo_type, root_style, base_url, font_config) → constructor ComputedStyle(parent_style, cascaded, element, pseudo_type, root_style, base_url, font_config, initial_page_sizes) - changed:
function resolve_var(computed, token, parent_style, known_variables=…) → function resolve_var(computed, token, parent_style) - added:
export PHYSICAL_FUNCTIONS - added:
export RELATIVE_UNITS - added:
export RelativeLengthInMath
- added:
function image(style, name, image) - added:
function physical_inset(name, prefix, suffix, block, inline) - added:
function physical_radius(name, prefix, suffix, block, inline) - added:
function physical_size(name, prefix, suffix, block, inline) - added:
function register_logical(names, prefixes=…, suffixes=…) - added:
variable PHYSICAL_FUNCTIONS
- removed:
class FontUnitInMath(ValueError) - added:
class RelativeLengthInMath(ValueError)
- added:
variable RELATIVE_UNITS - added:
variable VIEWPORT_UNITS
- added:
function expand_logical_border(tokens, name, base_url) - added:
function expand_two_logical_sides(tokens, name, base_url)
- changed:
constructor Document(pages, metadata, url_fetcher, font_config, color_profiles) → constructor Document(pages, metadata, url_fetcher, font_config, color_profiles, output_intent)
- removed:
variable HTML_SPACE_SEPARATED_TOKENS_RE - removed:
variable HTML_WHITESPACE - added:
function map_to_dimension_property(string) - added:
function map_to_dimension_property_ignoring_zero(string) - added:
function map_to_pixel_length(string) - added:
function parse_dimension_value(string) - added:
function parse_integer(string) - added:
function parse_legacy_color(string) - added:
function parse_non_negative_integer(string) - added:
function parse_string(string) - added:
function parse_url(string) - added:
variable DIMENSION_RE - added:
variable INTEGER_RE - added:
variable SPACE_SEPARATED_TOKENS_RE - added:
variable WHITESPACE
- changed:
function block_level_width(box, containing_block) → function block_level_width(box, containing_block, with_min_max=…)
- changed:
function get_clearance(context, box, collapsed_margin=…) → function get_clearance(context, box, direction, collapsed_margin=…)
- removed:
class CallbackHandler(logging.Handler) - removed:
constructor CallbackHandler(callback) - removed:
function capture_logs(logger=…, level=…)
- added:
export ColorProfile
- added:
variable MIMETYPES
- changed:
function pdfa(pdf, metadata, document, page_streams, attachments, compress, version, variant) → function pdfa(pdf, document, page_streams, attachments, compress, version, variant)
- changed:
function pdfua(pdf, metadata, document, page_streams, attachments, compress, version) → function pdfua(pdf, document, page_streams, attachments, compress, version)
- changed:
function pdfx(pdf, metadata, document, page_streams, attachments, compress, version, variant) → function pdfx(pdf, document, page_streams, attachments, compress, version, variant)
- changed:
constructor Stream(fonts, page_rectangle, resources, images, tags, color_profiles, *args, **kwargs) → constructor Stream(fonts, page_rectangle, resources, images, tags, color_profiles, output_intent, *args, **kwargs) - changed:
method Stream.add_shading(shading_type, color_space, domain, coords, extend, function) → method Stream.add_shading(shading_type, domain, coords, extend, function, color_space=…)
- changed:
function add_tags(pdf, document, page_streams) → function add_tags(pdf, document, pdf_version, page_streams)
- added:
function angle(string)