fpdf2 - Debian Package Tracker

general

source: fpdf2 (main)
version: 2.8.9-1
maintainer: Debian Python Team (DMD)
uploaders: Elena Grandi (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 2.8.3-1+deb13u1
testing: 2.8.9-1
unstable: 2.8.9-1

versioned links

2.8.3-1+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.8.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python3-fpdf

action needed

Marked for autoremoval on 22 November due to debugpy, ipykernel, ipython, jupyter-server-terminals, python-django, python-et-xmlfile, python-hypothesis, python-readme-renderer, python-syrupy: #1151509, #1151723, #1126323, #1145330, #1145439, #1145458, #1146361, #1146434, #1149383, #1149388, #1149942, #1150176 high

Version 2.8.9-1 of fpdf2 is marked for autoremoval from testing on Sun 22 Nov 2026. It is affected by #1151509, #1151723. The removal of fpdf2 will also cause the removal of (transitive) reverse dependencies: gscan2pdf, ocrmypdf, scantpaper. It depends (transitively) on debugpy, ipykernel, ipython, jupyter-server-terminals, python-django, python-et-xmlfile, python-hypothesis, python-readme-renderer, python-syrupy, affected by #1126323, #1145330, #1145439, #1145458, #1146361, #1146434, #1149383, #1149388, #1149942, #1150176. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-10-23 Last update: 2026-11-04 10:32

A new upstream version is available: 2.9.0 high

A new upstream version 2.9.0 is available, you should consider packaging it.

Created: 2026-10-31 Last update: 2026-11-04 06:02

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 47aab555e56e9f7d407fddc622578302ead31c76
Author: Alexandre Detiste <tchet@debian.org>
Date:   Sat Oct 31 15:58:38 2026 +0100

    mark python3-pytest as <!nocheck>

commit 623266bd6f9e111217ffd6716399fa8babfb1f74
Author: Alexandre Detiste <tchet@debian.org>
Date:   Sat Oct 31 15:58:09 2026 +0100

    add debian/salsa-ci.yml

Created: 2026-10-31 Last update: 2026-10-31 16:33

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-114609: (needs triaging) fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.
CVE-2026-114610: (needs triaging) fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-10-23 Last update: 2026-10-25 22:00

news

[rss feed]

[2026-10-05] fpdf2 2.8.9-1 MIGRATED to testing (Debian testing watch)
[2026-10-02] Accepted fpdf2 2.8.9-1 (source) into unstable (Elena Grandi)
[2026-08-17] fpdf2 2.8.8-1 MIGRATED to testing (Debian testing watch)
[2026-08-12] Accepted fpdf2 2.8.8-1 (source) into unstable (Elena Grandi)
[2026-03-05] fpdf2 2.8.7-2 MIGRATED to testing (Debian testing watch)
[2026-03-03] Accepted fpdf2 2.8.7-2 (source) into unstable (Elena Grandi)
[2026-03-02] Accepted fpdf2 2.8.7-1 (source) into unstable (Elena Grandi)
[2025-12-07] Accepted fpdf2 2.8.3-1+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Elena Grandi)
[2025-10-26] fpdf2 2.8.4-2 MIGRATED to testing (Debian testing watch)
[2025-10-24] Accepted fpdf2 2.8.4-2 (source) into unstable (Elena Grandi)
[2025-08-23] fpdf2 2.8.4-1 MIGRATED to testing (Debian testing watch)
[2025-08-21] Accepted fpdf2 2.8.4-1 (source) into unstable (Elena Grandi)
[2025-05-16] fpdf2 2.8.3-1 MIGRATED to testing (Debian testing watch)
[2025-05-06] Accepted fpdf2 2.8.3-1 (source) into unstable (Elena Grandi)
[2025-01-12] fpdf2 2.8.2-2 MIGRATED to testing (Debian testing watch)
[2025-01-09] Accepted fpdf2 2.8.2-2 (source) into unstable (Elena Grandi)
[2024-12-23] Accepted fpdf2 2.8.2-1 (source) into unstable (Elena Grandi)
[2024-11-14] fpdf2 2.8.1-1 MIGRATED to testing (Debian testing watch)
[2024-11-12] Accepted fpdf2 2.8.1-1 (source) into unstable (Elena Grandi)
[2024-06-24] fpdf2 2.7.9-2 MIGRATED to testing (Debian testing watch)
[2024-06-19] Accepted fpdf2 2.7.9-2 (source) into unstable (Elena Grandi)
[2024-05-23] fpdf2 2.7.9-1 MIGRATED to testing (Debian testing watch)
[2024-05-21] Accepted fpdf2 2.7.9-1 (source) into unstable (Elena Grandi)
[2024-02-16] fpdf2 2.7.8-2 MIGRATED to testing (Debian testing watch)
[2024-02-14] Accepted fpdf2 2.7.8-2 (source) into unstable (Elena Grandi)
[2024-02-12] Accepted fpdf2 2.7.8-1 (source) into unstable (Elena Grandi)
[2024-02-12] fpdf2 2.7.7-2 MIGRATED to testing (Debian testing watch)
[2024-02-07] Accepted fpdf2 2.7.7-2 (source) into unstable (Elena Grandi)
[2024-02-06] Accepted fpdf2 2.7.7-1 (source all) into unstable (Debian FTP Masters) (signed by: Elena Grandi)

bugs [bug history graph]

all: 2
RC: 2
I&N: 0
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.8.8-1