Php Weasyprint Laravel Package

Security

• Fix potential SSRF and local file disclosure: option URLs are fetched server-side only when their scheme is allowed (http, https by default, configurable via the new $allowedSchemes constructor argument)
• Fix potential arbitrary file deletion at shutdown: removeTemporaryFiles() now only deletes files located inside the temporary folder
• Fix PHAR deserialization via the output filename (CVE-2023-28115 case-insensitive bypass): the output path is now validated against a scheme allow-list instead of a case-sensitive phar:// check

Security

• Fix potential shell-command injection through the WeasyPrint binary path: buildCommand() now verifies the binary is executable on the unescaped path and shell-escapes it before use
• Update symfony/process minimal version to mitigate CVE-2026-24739

Added

• Support WeasyPrint options (--info, --quiet, --verbose, --debug, --version, --no-http-redirects, --fail-on-http-errors)

Added

• Support WeasyPrint 68.0 new --attachment-relationship and --xmp-metadata options

Added

• Support WeasyPrint 67.0 new --allowed-protocols option
• Support Symfony 8.0
• More tests

Added

• Support PHP 8.5
• More tests

Added

• Support WeasyPrint 66.0 new --pdf-tags option

Added

• Add --timeout option to the WeasyPrint command-line call by default. This improves consistency with the internal process timeout already applied by Symfony Process. If you're running WeasyPrint inside a worker, queue, or other timeout-managed environment, you can disable it using $pdf->disableTimeout() or $pdf->setTimeout(null). (#15)
• Add disableTimeout() method to easily disable the new CLI timeout behavior

Security

• Update symfony/process minimal version to mitigate CVE-2024-51736

Added

• Support WeasyPrint 63.0 new srgb option
• Added support for PHP 8.4

Changed

• Added support for Symfony 7.0 and PHP 8.3

Added

• Support WeasyPrint 60.0 new option

Added

• Support WeasyPrint 59.0b1 new option

This is a security release: php-weasyprint is based on knplabs/knp-snappy, CVE-2023-28115 has been issued for it on 2023-03-17

Security

• Implement countermeasures for CVE-2023-28115

Added

• Support WeasyPrint 58 new option (--pdf-forms)

Changed

• Always pass through timeout when creating a process (#7)

Fixed

• Fix logging of errors

Fixed

• Fixed handling of repeatable options (attachment and stylesheet)

Changed

• Bump symfony/process up to ^6.2

Removed

• Remove Image class
• Remove Version class
• Remove support for Symfony 4.4

Added

• Support WeasyPrint 56 new options

Deprecated

• Deprecate image generator
• Deprecate Version class

What's Changed

• Bump php, supports 8.2 by @stephpy in https://github.com/pontedilana/php-weasyprint/pull/6

New Contributors

• @stephpy made their first contribution in https://github.com/pontedilana/php-weasyprint/pull/6

Full Changelog: https://github.com/pontedilana/php-weasyprint/compare/0.11.0...0.12.0

What's Changed

• Bump symfony/process up to ^6.0 and psr/log up to ^3.0 by @romainf in https://github.com/pontedilana/php-weasyprint/pull/3

New Contributors

• @romainf made their first contribution in https://github.com/pontedilana/php-weasyprint/pull/3

Full Changelog: https://github.com/pontedilana/php-weasyprint/compare/0.10.1...0.11.0

Fixed

• Refactor tests to use onlyMethods()

Removed --format option default value, this option was deprecated in WeasyPrint 53 and removed in WeasiPrint 54. If you still use WeasyPrint 52 or lower you can set this option back with ->setOption():

$weasyprint = new \Pontedilana\PhpWeasyPrint\Pdf('/usr/local/bin/weasyprint');
$weasyprint->setOption('format', 'pdf');

Changed

• Unset --format option in Pdf class which is deprecated in WeasyPrint 53 and removed in WeasyPrint 54

First public release