Php Weasyprint Laravel Package

Security

• Fix potential SSRF and local file disclosure: option URLs are fetched server-side only when their scheme is allowed (http, https by default, configurable via the new $allowedSchemes constructor argument)
• Fix potential arbitrary file deletion at shutdown: removeTemporaryFiles() now only deletes files located inside the temporary folder
• Fix PHAR deserialization via the output filename (CVE-2023-28115 case-insensitive bypass): the output path is now validated against a scheme allow-list instead of a case-sensitive phar:// check

Security

• Fix potential shell-command injection through the WeasyPrint binary path: buildCommand() now verifies the binary is executable on the unescaped path and shell-escapes it before use
• Update symfony/process minimal version to mitigate CVE-2026-24739

Added

• Support WeasyPrint options (--info, --quiet, --verbose, --debug, --version, --no-http-redirects, --fail-on-http-errors)

Added

• Support WeasyPrint 68.0 new --attachment-relationship and --xmp-metadata options

Added

• Support WeasyPrint 67.0 new --allowed-protocols option
• Support Symfony 8.0
• More tests

Added

• Support PHP 8.5
• More tests

Added

• Support WeasyPrint 66.0 new --pdf-tags option

Added

• Add --timeout option to the WeasyPrint command-line call by default. This improves consistency with the internal process timeout already applied by Symfony Process. If you're running WeasyPrint inside a worker, queue, or other timeout-managed environment, you can disable it using $pdf->disableTimeout() or $pdf->setTimeout(null). (#15)
• Add disableTimeout() method to easily disable the new CLI timeout behavior

Security

• Update symfony/process minimal version to mitigate CVE-2024-51736

Added

• Support WeasyPrint 63.0 new --srgb option
• Add support for PHP 8.4

Changed

• Add support for Symfony 7.0 and PHP 8.3

Added

• Support WeasyPrint 60.0 new --timeout option

Added

• Support WeasyPrint 59.0b1 new options

Security

• Implement countermeasures for CVE-2023-28115

Added

• Support WeasyPrint 58 new option (--pdf-forms)

Changed

• Always pass through timeout when creating a process (#7)

Fixed

• Fix logging of errors

Fixed

• Fix handling of repeatable options (attachment and stylesheet)

Changed

• Bump symfony/process up to ^6.2

Removed

• Remove Image class
• Remove Version class
• Remove support for Symfony 4.4

Added

• Support WeasyPrint 56 new options

Deprecated

• Deprecate image generator
• Deprecate Version class

Changed

• Add support for PHP 8.2

Changed

• Bump symfony/process up to ^6.0 and psr/log up to ^3.0

Fixed

• Refactor tests to use onlyMethods()

Changed

• Unset --format option in Pdf class which is deprecated in WeasyPrint 53 and removed in WeasyPrint 54

Added

• First public release