🔐 Security
SSRF. <img src="http://169.254.169.254/latest/meta-data/"> returned
cloud instance credentpback, private,
link-local, multicast and reserved addresses are refused by default, on
every hop of a redirec by the address it
resolves to.
**Arbitrary file read.worked; local reads are
now confined to the document's own directory, symlinks and .. included.
**Command injection (Cnger goes through a
shell. It is public API and reachable from the CLI's -d argument.
Two ReDoS. An unclntent:"+ 40 backslashes) cost three minutes of CPU, multiplying by eight every four further characters;< cost 23 seconds per
attribute.
**Decompression bomb.*xpanded to 209 MB
resident. Fetched resources now have a 20 MiB limit, checked against
Content-Length, againd against what it
expands to.
Descriptor leak. Aa deleted-but-open inode
behind for the life of the thread.
🎉 New
The document language reaches the PDF catalog as /Lang, from
<html lang="es-CR"> ` — needed by screen
readers and PDF/UA, and never declared before.
Several tables of contoc name="figures" />plus-pdf-toc-name), each with its own typography. A second pdf:toc`
used to fail the whole
Leader fills between a TOC entry and its page number (-pdf-toc-leader:
dots, dashes, `lin
💪🏼 Performance
The CSS cascade no lery property. Dressing
an element cost O(elements × properties × rules) — 30–48% of a render. 800
elements against 800 r-loremipsum`: 408 ms →
224 ms. Output is unchanged.
An embedded font is once per document.
Across 40 real documents in one process, time inside TTFont went from
3.23s to 0s.
🐛 Bug fixes
A list item whose contps its marker —
<li><p>text</p></li>, which is what rich-text editors emit, silently lost
its bullet.
--start-viewer works on Linux; it had been running the macOS open
everywhere that was no
A TOC lays its page numbers out flush right, links each to its heading, and
indents each level; aneportLab's
Placeholder for table of contents into the document.
getSize no longer waa valid percentage.
What's Changed
- build and publish a wheel by @dimbleby in #796
- Fix typos by @kianmeng in #801
- Fix TypeError by @hsmett in #800
- Bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #798
- Improve pypdf overlay handling by @stefan6419846 in #817
- Support relative dimensions for frames by @sjoerdjob in #819
- Update watermarks.py by @alionLevkin in #812
- Ignore http status reason text by @jonbb in #803
- Retain metadata on applying watermark by @sjoerdjob in #816
- Several fixes to background processing by @sjoerdjob in #824
- Release 0.2.18: ReportLab 5, Python 3.10–3.14, and a browser conformance oracle for CSS by @luisza in #834
- Development by @luisza in #838
- Update github actions and typo fixed. by @luisza in #839
New Contributors
- @dimbleby made their first contribution in #796
- @kianmeng made their first contribution in #801
- @hsmett made their first contribution in #800
- @dependabot[bot] made their first contribution in #798
- @alionLevkin made their first contribution in #812
- @jonbb made their first contribution in #803
Full Changelog: v0.2.17...v0.2.19