Skip to content

Upgrading weasyprint 69 to 70

Review needed69.0 → 70.0Security3Deprecated1New7Changed7Fixed37Other2

Full comparisonBack to weasyprint
Review neededUpgrade verdict

1 deprecation and 3 security fixes.

In plain terms
  • A security hole could let untrusted images or filtered metadata and stylesheets cause harm. Upgrading is strongly recommended if you use those features.
  • EPS image files are no longer rendered, closing a security risk.
  • When a custom URL fetcher is provided, the original one is now always used, preventing bypass of its filtering.
  • Using fontTools to subset fonts now shows a deprecation warning.
Must act 4 items need code or config changes

What you must change

Security3
Fixes CVE-2026-55073 / GHSA-r543-q48m-4c9j; upgrade strongly recommended if embedding untrusted images or relying on the URL fetcher to filter metadata or stylesheets.
Medium · CVSS 6.2
70.0GitHub ReleaseSummarizedView source
Stops rendering EPS images.
70.0GitHub ReleaseSummarizedView source
Always uses the original URL fetcher when available.
70.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated1
Adds deprecation warnings when using fontTools for subsetting.
fontTools
70.0GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • removed: export default_url_fetcher
  • changed: function gather_anchors(box, anchors, links, bookmarks, forms, parent_matrix=…, parent_form=…) → function gather_anchors(box, anchors, links, bookmarks, forms, parent_matrix=…, parent_form=…, parent_link=…)
  • removed: export get_url_attribute
  • changed: class AnonymousStyle(dict) → class AnonymousStyle(Style)
  • changed: class ComputedStyle(dict) → class ComputedStyle(Style)
  • changed: class InitialStyle(dict) → class InitialStyle(Style)
  • changed: constructor ComputedStyle(parent_style, cascaded, element, pseudo_type, root_style, base_url, font_config, initial_page_sizes) → constructor ComputedStyle(parent_style, cascaded, pseudo_type, root_style, base_url, font_config, initial_page_sizes)
  • added: class Style(dict)
  • added: export get_length
  • added: field Style.is_root_element
  • added: field Style.parent_style
  • added: function string_to_css(string)
  • added: function url_to_css(string)
  • added: property Style.anonymous_style
  • added: variable PAGE_MARGIN_BOXES
  • removed: function anchor(style, name, values)
  • removed: function compute_attr(style, values)
  • removed: function link(style, name, values)
  • added: function box_shadow(style, name, values)
  • changed: method Pending.solve(tokens, wanted_key) → method Pending.solve(tokens, wanted_key, base_url)
  • changed: method Pending.validate(tokens, wanted_key) → method Pending.validate(tokens, wanted_key, base_url)
  • changed: method PendingExpander.validate(tokens, wanted_key) → method PendingExpander.validate(tokens, wanted_key, base_url)
  • removed: function link(token, base_url)
  • changed: method PendingProperty.validate(tokens, wanted_key) → method PendingProperty.validate(tokens, wanted_key, base_url)
  • added: function box_shadow(tokens)
  • changed: function draw_background(stream, bg, clip_box=…, bleed=…, marks=…) → function draw_background(stream, background, clip_box=…, bleed=…, marks=…)
  • added: export Dimension
  • added: export LinearGradient
  • added: export RadialGradient
  • added: function draw_box_shadows(stream, boxes, style, inset)
  • added: function draw_dotted_dashed_border(stream, box, style, width, color)
  • added: field Box.colspan
  • added: field Box.link
  • added: field Box.note
  • added: field Box.note_call
  • added: field Box.note_callback
  • added: field Box.rowspan
  • added: field Box.widget_annotation
  • added: method Box.extract_text(text_part)
  • added: method Box.is_note()
  • added: method Box.is_whitespace()
  • added: method Box.process_text_transform()
  • added: method Box.process_whitespace(following_collapsible_space=…)
  • added: method TextBox.is_whitespace()
  • added: method TextBox.process_text_transform()
  • added: method TextBox.process_whitespace(following_collapsible_space=…)
  • added: property Box.content_text
  • added: property ParentBox.content_text
  • added: property TextBox.content_text
  • removed: function box_text(box)
  • removed: function capitalize(text, lang_code)
  • removed: function extract_text(text_part, box)
  • removed: function is_whitespace(box, _has_non_whitespace=…)
  • removed: function lowercase(text, lang_code)
  • removed: function process_text_transform(box)
  • removed: function process_whitespace(box, following_collapsible_space=…)
  • removed: function uppercase(text, lang_code)
  • removed: variable ASCII_TO_WIDE
  • removed: variable LINE_FEED_RE
  • removed: variable SPACE_RE
  • removed: variable TAB_RE
  • changed: function blockify(box, layout) → function blockify(box, layout=…)
  • added: function capitalize(text, lang_code)
  • added: function full_width(text, lang_code)
  • added: function get_first_letter(text)
  • added: function lowercase(text, lang_code)
  • added: function transform(function, text, lang_code)
  • added: function uppercase(text, lang_code)
  • added: variable ASCII_TO_WIDE
  • added: variable LINE_FEED_RE
  • added: variable SPACE_RE
  • added: variable TAB_RE
  • removed: function parse_string(string)
  • removed: function strip_whitespace(string)
  • removed: variable HTML5_PH
  • removed: variable HTML5_PH_STYLESHEET
  • removed: variable HTML5_UA
  • removed: variable HTML5_UA_COUNTER_STYLE
  • removed: variable HTML5_UA_FORM
  • removed: variable HTML5_UA_FORM_STYLESHEET
  • removed: variable HTML5_UA_STYLESHEET
  • changed: function parse_url(string) → function parse_url(string, base_url, allow_relative=…)
  • added: function handle_a(element, box, get_image_from_uri, base_url)
  • added: variable PH
  • added: variable PH_STYLESHEET
  • added: variable TAB_OR_NEWLINE
  • added: variable UA
  • added: variable UA_COUNTER_STYLE
  • added: variable UA_FORM
  • added: variable UA_FORM_STYLESHEET
  • added: variable UA_STYLESHEET
  • added: export get_link
  • added: method LayoutContext.add_running_element(box)
  • added: method LayoutContext.remove_running_element(box)
  • added: function find_last_class_a_break_point_child(children)
  • removed: export draw_gradient_or_pattern
  • removed: export get_url_attribute
  • removed: static method SVG.get_paint(value)
  • changed: method Pattern.draw_node(node, font_size, fill_stroke=…) → method Pattern.draw_node(node, font_size, fill_stroke=…, context=…)
  • changed: method SVG.draw_node(node, font_size, fill_stroke=…) → method SVG.draw_node(node, font_size, fill_stroke=…, context=…)
  • changed: method SVG.fill_stroke(node, font_size, text=…) → method SVG.fill_stroke(fill, stroke, even_odd=…, text=…)
  • changed: method SVG.set_graphical_state(node, font_size, text=…) → method SVG.set_graphical_state(node, font_size, context=…)
  • added: export draw_gradient
  • added: export draw_pattern
  • added: method Node.get_paint(attribute, context=…)
  • added: method SVG.get_node_transform_matrix(node, font_size)
  • added: function transform_bounding_box(svg, node, font_size, bounding_box)
  • removed: function draw_gradient_or_pattern(svg, node, name, font_size, opacity, stroke)
  • added: variable harfbuzz_vector
  • removed: function default_url_fetcher(url, timeout=…, ssl_context=…, http_headers=…, allowed_protocols=…)
  • removed: function get_link_attribute(element, attr_name, base_url)
  • removed: function get_url_attribute(element, attr_name, base_url, allow_relative=…)
  • changed: function url_join(base_url, url, allow_relative, context, context_args) → function url_join(base_url, url, allow_relative, context)
  • added: function get_link(url, base_url)