Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 20, 2026

Bumps weasyprint from 67.0 to 68.0.

Release notes

Sourced from weasyprint's releases.

v68.0

This is a security update (CVE-2025-68616).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the default_url_fetcher function in your custom URL fetcher, or if you use the allowed_protocols parameter of the default_url_fetcher function.

Read about this release on our blog.

Security

  • Always use URL fetcher for HTTP redirects

Python API

  • default_url_fetcher() is deprecated, use the new URLFetcher class instead, see URL Fetchers for more information about URL fetchers
  • DocumentMetadata.generate_rdf_metadata is now a method that can be overridden instead of a parameter, see Factur-X / ZUGFeRD (Electronic Invoices) for examples to create e-invoices

Features

  • #2609, #2603, #351: Refactor URL fetcher API
  • #2632: Support legacy 0 value for angles
  • #2627: Add font-face support to SVG
  • #2646, #2255: Add font shorthand support for SVG text elements
  • #2590, #1749: Honor language-specific rules for text-transform
  • #2645, #2613: Improve SVG and SVG emojis rendering
  • #2658, #2583: Add CLI for Factur-X / ZUGFeRD e-invoices

Bug fixes

  • #2649: Refactor URL fetcher API
  • #2643, #2628: Handle box-sizing: border-box in grid layout
  • #2641, #1875: Process whitespace after checking all pending targets
  • #2488, #2485: Preserve page groups during layout repagination
  • #2642, #2631: Don’t use isolated transparency groups
  • #2637: Fix repeating radial gradients rendering
  • #2622: Fix validation of colors
  • #2626: Share grid items rendering advancement between a box and its copies
  • #2621: Correctly handle fallback values of attr()
  • #2619: Fix SVG fonts
  • #2629: Always define extra skip height that may be used after
  • #2648: Fix numbers validation in font-feature-settings
  • #2648: Fix keyword values for text-decoration-thickness
  • #2661: Respect inline images when defining minimum table width

Documentation

  • #2638: Update Python command for Windows installation steps

Contributors

  • Guillaume Ayoub

... (truncated)

Changelog

Sourced from weasyprint's changelog.

Version 68.0

Released on 2026-01-19.

This is a security update (CVE-2025-68616).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the default_url_fetcher function in your custom URL fetcher, or if you use the allowed_protocols parameter of the default_url_fetcher function.

Security:

  • Always use URL fetcher for HTTP redirects

Python API:

  • default_url_fetcher() is deprecated, use the new URLFetcher class instead, see :ref:URL Fetchers for more information about URL fetchers
  • DocumentMetadata.generate_rdf_metadata is now a method that can be overridden instead of a parameter, see :ref:Factur-X / ZUGFeRD (Electronic Invoices) for examples to create e-invoices

Features:

  • [#2609](https://github.com/Kozea/WeasyPrint/issues/2609) <https://github.com/Kozea/WeasyPrint/pull/2609>, [#2603](https://github.com/Kozea/WeasyPrint/issues/2603) <https://github.com/Kozea/WeasyPrint/issues/2603>, [#351](https://github.com/Kozea/WeasyPrint/issues/351) <https://github.com/Kozea/WeasyPrint/issues/351>_: Refactor URL fetcher API
  • [#2632](https://github.com/Kozea/WeasyPrint/issues/2632) <https://github.com/Kozea/WeasyPrint/pull/2632>_: Support legacy 0 value for angles
  • [#2627](https://github.com/Kozea/WeasyPrint/issues/2627) <https://github.com/Kozea/WeasyPrint/pull/2627>_: Add font-face support to SVG
  • [#2646](https://github.com/Kozea/WeasyPrint/issues/2646) <https://github.com/Kozea/WeasyPrint/pull/2646>, [#2255](https://github.com/Kozea/WeasyPrint/issues/2255) <https://github.com/Kozea/WeasyPrint/issues/2255>: Add font shorthand support for SVG text elements
  • [#2590](https://github.com/Kozea/WeasyPrint/issues/2590) <https://github.com/Kozea/WeasyPrint/pull/2590>, [#1749](https://github.com/Kozea/WeasyPrint/issues/1749) <https://github.com/Kozea/WeasyPrint/issues/1749>: Honor language-specific rules for text-transform
  • [#2645](https://github.com/Kozea/WeasyPrint/issues/2645) <https://github.com/Kozea/WeasyPrint/pull/2645>, [#2613](https://github.com/Kozea/WeasyPrint/issues/2613) <https://github.com/Kozea/WeasyPrint/issues/2613>: Improve SVG and SVG emojis rendering
  • [#2658](https://github.com/Kozea/WeasyPrint/issues/2658) <https://github.com/Kozea/WeasyPrint/pull/2658>, [#2583](https://github.com/Kozea/WeasyPrint/issues/2583) <https://github.com/Kozea/WeasyPrint/issues/2583>: Add CLI for Factur-X / ZUGFeRD e-invoices

Bug fixes:

  • [#2649](https://github.com/Kozea/WeasyPrint/issues/2649) <https://github.com/Kozea/WeasyPrint/issues/2649>_: Refactor URL fetcher API

... (truncated)

Commits
  • e9352be Version 68.0
  • b6a14f0 Merge remote-tracking branch 'security/filter-redirections'
  • 1140eba Update changelog for version 68.0
  • 52c02a6 Update changelog
  • de248a5 Merge pull request #2645 from Kozea/faster-svg-emojis
  • fb046b2 Merge pull request #2658 from Kozea/factur-x-cli
  • 8c899a9 Follow parent’s white-space value when breaking before replaced box
  • afe532b Fix default media type CLI value
  • 9546e6e Update changelog
  • 1d012f3 Fix keyword values for text-decoration-thickness
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jan 20, 2026
Bumps [weasyprint](https://github.com/Kozea/WeasyPrint) from 67.0 to 68.0.
- [Release notes](https://github.com/Kozea/WeasyPrint/releases)
- [Changelog](https://github.com/Kozea/WeasyPrint/blob/main/docs/changelog.rst)
- [Commits](Kozea/WeasyPrint@v67.0...v68.0)

---
updated-dependencies:
- dependency-name: weasyprint
  dependency-version: '68.0'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/pip/weasyprint-68.0 branch from e774526 to de5c361 Compare January 23, 2026 11:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant