WeasyPrint

This is a security update (CVE-2026-49452).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the --presentational-hints option and render untrusted HTML with restricted CSS properties.

Read about this release on our blog.

Security

• Avoid CSS injection with HTML presentational hints.

Command-line API

• The --srgb option has been replaced by --output-intent=srgb. Other values are possible: device-cmyk for CMYK documents with no ICC profile, or the CSS identifier of a @color-profile rule.

Python API

• The output_intent string entry replaces the srgb boolean in default options.

Features

• #2357, #2700: Support logical properties
• #1194, #2702: Support viewport units
• #2686: Detect redirection loops early in URL fetcher
• #2735, #2737: Support SVG transform angle units
• #2636, #2720, #2773: Use HTML parsers for presentational hints
• #2631, #2778, #2785, #2788: Allow users to set PDF output intent

Bug fixes

• #2697, #2691: Avoid endless loops in grids
• #2709: Be less strict for gradient rasterization in tests
• #2683: Fix rendering of emojis in SVG
• #2688: Always describe font using absolute sizes
• #2676: Fix inheritance for svg/symbol tags referenced by use tags
• #2681: Add dc:description field to PDF/A metadata
• #2680: Force first grid row rendering on empty pages
• #2690: Compute units in gradients used in border background
• #2689: Cut flex elements with fixed height and overflowing children
• #2651, #2696: Fix tests on Debian
• #2698, #2699: Fix alignment of right-to-left elements with auto width and set min/max-width
• #2556: Apply presentational hints to svg tags
• #2706: Handle infinite border radii
• #2707, #2708, #2710: Get mimetypes from Python code instead of various third-party files
• #2717, #2580, #2740: Fix table break retry after padding overflow
• #2769: Add year in PDF/UA-2 metadata
• #2768: Allow SVG lists of numbers to be sp

Bug fixes

• #2662: Don’t crash when SVG clip paths are not in defs tags
• #2665: Fix position of box bounding box
• #2663: Fix transparency with Acrobat and Edge
• #2666: Don’t rely on random default font to define test page size
• #2670: Fix pattern detection of URL schemes
• #2671: Improve API compatibility between URLFetcherResponse and addinfourl
• #2672: Fix charset for old URL fetcher requests
• #2675, #2673: Fix calc for many properties

Contributors

• Guillaume Ayoub

Backers and sponsors

• Spacinov
• Syslifters
• Kobalt
• Simon Sapin
• Grip Angebotssoftware
• Manuel Barkhau
• Simonsoft
• KontextWork
• Menutech
• TrainingSparkle
• Healthchecks.io
• Method B
• FieldHub
• Hammerbacher
• Yanal-Yves Fargialla
• Morntag
• Piloterr
• Xavid
• Charlie S.
• Prothesis Dental Solutions
• Kai DeLorenzo

This is a security update (CVE-2025-68616).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the default_url_fetcher function in your custom URL fetcher, or if you use the allowed_protocols parameter of the default_url_fetcher function.

Read about this release on our blog.

Security

• Always use URL fetcher for HTTP redirects

Python API

• default_url_fetcher() is deprecated, use the new URLFetcher class instead, see URL Fetchers for more information about URL fetchers
• DocumentMetadata.generate_rdf_metadata is now a method that can be overridden instead of a parameter, see Factur-X / ZUGFeRD (Electronic Invoices) for examples to create e-invoices

Features

• #2609, #2603, #351: Refactor URL fetcher API
• #2632: Support legacy 0 value for angles
• #2627: Add font-face support to SVG
• #2646, #2255: Add font shorthand support for SVG text elements
• #2590, #1749: Honor language-specific rules for text-transform
• #2645, #2613: Improve SVG and SVG emojis rendering
• #2658, #2583: Add CLI for Factur-X / ZUGFeRD e-invoices

Bug fixes

• #2649: Refactor URL fetcher API
• #2643, #2628: Handle box-sizing: border-box in grid layout
• #2641, #1875: Process whitespace after checking all pending targets
• #2488, #2485: Preserve page groups during layout repagination
• #2642, #2631: Don’t use isolated transparency groups
• #2637: Fix repeating radial gradients rendering
• #2622: Fix validation of colors
• #2626: Share grid items rendering advancement between a box and its copies
• #2621: Correctly handle fallback values of attr()
• #2619: Fix SVG fonts
• #2629: Always define extra skip height that may be used after
• #2648: Fix numbers validation in font-feature-settings
• #2648: Fix keyword values for text-decoration-thickness
• #2661: Respect inline images when defining minimum table width

Documentation

• #2638: Update Python command for Windows installation steps

Contributors

• Guillaume Ayoub
• Jurriaan Pruis
• Mohamed Hamed
• Alexandra Usatenko
• Andrea Corna
• Aoishik Khan
• Joe

Backers and sponsors

• Spacinov
• Syslifters
• Kobalt
• Simon Sapin
• Grip Angebotssoftware
• Manuel Barkhau
• Simonsoft
• KontextWork
• Menutech

Read about this release on our blog.

Dependencies

• Python 3.10+ is now needed, Python 3.9 is not supported anymore
• tinycss2 1.5.0+ is now needed
• fontTools 4.59.2+ is now needed

Features

• #2560, #640, #844, #1091, #2517: Support CMYK colors, PDF/X, color profiles and light-dark() function
• #2558, #1175: Support ::first-line, with financial support from Karte Technology
• #2552: Support CSS layers, with financial support from Code & Co.
• #2564, #2599, #2397: Allow page breaks in grid rows, with financial support from Ocean Recap
• #2568, #357: Support calc() and other mathematical functions
• #2575, #2574: Support PDF/A-1a, PDF/A-2a and PDF/A-3a
• #2611, #2573: Support PDF/A-4e and PDF/A-4f
• #2523: Display tofu for missing glyphs
• #2581: Add option to disable protocols in URL resolution
• #2570: Support rch, cap, rcap, rex, ic and ric font-relative units
• #2547, #2140: Support "only" keyword in media queries

Bug fixes

• #2516, #1510: Fix rendering of first line of text with nested right float
• #2510, #1073, #2507: Avoid Pango crashes and font mismatches with @font-face rules referencing local fonts
• #2532, #2531: Use fonttools instancer instead of deprecated mutator API
• #2541: Fix syntax of functions
• #2543: Allow font-related units to access @font-face fonts
• #2525: Respect top margins and avoid overlapping footnotes for columns, with financial support from Code & Co.
• #2536: Remove Subtype key from font descriptor
• #2539: Fix min width for SVGs with intrinsic ratio but no intrinsic size
• #2537, #2533: Fix order of operators when drawing SVGs
• #2538: Don’t crash with nested unknown functions
• #2542: Don’t crash when lh and rlh are used for line height or font size
• #2540, #2528: Use locale encoding instead of filesystem encoding for font paths
• #2563, [\