php-dompdf - Debian Package Tracker

general

source: php-dompdf (main)
version: 3.1.4+dfsg-2
maintainer: Debian PHP PEAR Maintainers (archive) (DMD)
uploaders: William Desportes [DMD] [DM]
arch: all
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.6.2+dfsg-3.1
o-o-sec: 0.6.2+dfsg-3.1+deb11u1
oldstable: 2.0.3+dfsg-1+deb12u1
unstable: 3.1.4+dfsg-2

versioned links

0.6.2+dfsg-3.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.2+dfsg-3.1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.0.3+dfsg-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.4+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

php-dompdf

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:01:26
Last run: 2026-05-25T09:16:18.000Z
Previous status: unknown

testing: fail (log)
The tests ran in 0:00:18
Last run: 2025-02-23T15:58:03.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:00:21
Last run: 2025-08-11T06:47:13.000Z
Previous status: unknown

Created: 2025-02-23 Last update: 2026-08-05 00:03

A new upstream version is available: 3.1.6 high

A new upstream version 3.1.6 is available, you should consider packaging it.

Created: 2026-03-05 Last update: 2026-08-04 18:30

6 security issues in sid high

There are 6 open security issues in sid.

6 important issues:

CVE-2026-55554: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
CVE-2026-55555: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
CVE-2026-56722: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.
CVE-2026-59941: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.
CVE-2026-59942: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers. The vulnerability exists because the dimension validation happens early, but the resource allocation for calculating the object's bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. An unauthenticated remote attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. This issue has been fixed in version 3.16.
CVE-2026-59943: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.

Created: 2026-07-29 Last update: 2026-08-02 20:32

6 security issues in bullseye high

There are 6 open security issues in bullseye.

6 important issues:

CVE-2026-55554: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
CVE-2026-55555: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
CVE-2026-56722: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.
CVE-2026-59941: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.
CVE-2026-59942: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers. The vulnerability exists because the dimension validation happens early, but the resource allocation for calculating the object's bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. An unauthenticated remote attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. This issue has been fixed in version 3.16.
CVE-2026-59943: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.

Created: 2026-07-29 Last update: 2026-08-02 20:32

6 security issues in bookworm high

There are 6 open security issues in bookworm.

6 important issues:

CVE-2026-55554: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
CVE-2026-55555: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
CVE-2026-56722: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.
CVE-2026-59941: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.
CVE-2026-59942: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers. The vulnerability exists because the dimension validation happens early, but the resource allocation for calculating the object's bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. An unauthenticated remote attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. This issue has been fixed in version 3.16.
CVE-2026-59943: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.

Created: 2026-07-29 Last update: 2026-08-02 20:32

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2026-04-13 Last update: 2026-08-04 23:50

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-08-04 23:48

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 3.1.5+dfsg-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit a2d014bd9702baf5a426d9111dedad8d32de0f4b
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Mar 17 14:36:30 2026 +0100

    d/ch

commit d6a675125d930c95fdb1841812c834ec04d4ef8b
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Mar 17 14:35:45 2026 +0100

    Update patches

commit 369f6ce1c230136b3037b4bbd508fdbe3dedc2f6
Merge: ba84b6e 2cd2625
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Mar 17 14:33:20 2026 +0100

    Update upstream source from tag 'upstream/3.1.5+dfsg'
    
    Update to upstream version '3.1.5+dfsg'
    with Debian dir 149366d03b4d6e763b617cabf2ed045c37084659

commit 2cd262590fd6794998d3ba0bec28f944a96765eb
Merge: b7ff8c3 f11ead2
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Mar 17 14:33:18 2026 +0100

    New upstream version 3.1.5+dfsg

commit f11ead23a8a76d0ff9bbc6c7c8fd7e05ca328496
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Tue Mar 3 08:54:37 2026 -0500

    Update VERSION to 3.1.5

commit beb2c5c21d9c416e06f041a1cf1532f3f44ccc67
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Sat Feb 28 17:03:58 2026 -0500

    Manage SvgLib external reference option

commit a1a14e7438838393227edfdfac718c3d7ceb52dc
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Fri Jan 2 17:06:48 2026 -0500

    Add clip methods to Cpdf
    
    Introduced in SvgLib for Surface adapter compatibility.

commit 26b9a7d897867459d38849b629640125630820bd
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Fri Jan 2 17:04:55 2026 -0500

    Ensure Cpdf has a valid glyph index during font parsing

commit a6900ebd322d660ce4351673269f853f23acb08f
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Fri Jan 2 16:52:14 2026 -0500

    Fix incorrect variable reference in Cpdf

commit 6cba462e7475f39bc38aa3d2ccf103c39dc99e03
Author: Fl0Cri <florent@inetis.ch>
Date:   Wed Feb 4 20:32:12 2026 +0100

    Allow to change the value of anti_infinite_loop

commit 9eb782bb9562c5e5f7fe811f23db38d274d7ca8a
Author: Fl0Cri <florent@inetis.ch>
Date:   Wed Feb 4 20:19:04 2026 +0100

    Reset LineBox reflows counter between documents
    
    This counter was previously a static local variable, which made it impossible to reset. It could be problematic when generating multiple documents.
    This commit is a temporary workaround with minimal side-effects for this specific use case, before a proper fix can be implemented.

commit d524dba26e3093d3c1eb92ac4db1eda2937e0f0e
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Thu Jan 22 10:25:52 2026 -0500

    Fix issues in data URI conversion to blob URI
    
    fixes #3706

commit 77a7a1347d14eed275097b6e084433203857343c
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Fri Jan 2 17:37:59 2026 -0500

    Explicitly set containing block arguments from array
    
    fixes #3697

commit ba7e1b09b6e61ef4c75336661bf8d94ed6e5807d
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Fri Jan 2 17:11:44 2026 -0500

    Update FontMetrics code documentation

commit dc5d5e9a17a5238709afa0f49f53a3f130b0d689
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Fri Nov 28 09:47:11 2025 -0500

    Update FontMetrics on options change
    
    fixes #3688

commit a098928a5a17ffffbf4be755dc7dfc7c0e4c83fc
Author: Dominik Shaim Ulrich <czshaimagal@gmail.com>
Date:   Sat Dec 20 12:51:24 2025 +0100

    Update Options.php

commit 3beae50287712334e1abd115994c8a7feecef94c
Author: Brian Sweeney <brian@eclecticgeek.com>
Date:   Tue Nov 4 08:31:03 2025 -0500

    Reset version hash

https://salsa.debian.org/api/v4/projects/php-team%2Fpear%2Fphp-dompdf API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-03-17 Last update: 2026-07-27 07:03

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

testing migrations

excuses:
- Migrates after: php-dompdf-svg-lib
- Migration status for php-dompdf (- to 3.1.4+dfsg-2): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating php-dompdf would introduce bugs in testing: #1142987
- ∙ ∙ Build-Depends(-Arch): php-dompdf php-dompdf-svg-lib
- ∙ ∙ Depends: php-dompdf php-dompdf-svg-lib
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/php-dompdf.html
- ∙ ∙ Autopkgtest for php-dompdf/3.1.4+dfsg-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ Required age reduced by 3 days because of autopkgtest
- ∙ ∙ 209 days old (needed 2 days)
- Not considered

news

[rss feed]

[2026-02-28] Accepted php-dompdf 2.0.3+dfsg-1+deb12u1 (source all) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Abhijith PA)
[2026-01-07] Accepted php-dompdf 3.1.4+dfsg-2 (source) into unstable (William Desportes)
[2025-12-30] Accepted php-dompdf 3.1.4+dfsg-1 (source) into unstable (William Desportes)
[2025-12-30] Accepted php-dompdf 0.6.2+dfsg-3.1+deb11u1 (source all) into oldoldstable-security (Abhijith PA)
[2025-09-18] Accepted php-dompdf 3.1.0+dfsg-1 (source) into unstable (William Desportes)
[2025-02-19] php-dompdf REMOVED from testing (Debian testing watch)
[2025-01-19] php-dompdf 3.0.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-12-31] Accepted php-dompdf 3.0.2+dfsg-1 (source) into unstable (William Desportes)
[2024-12-25] php-dompdf REMOVED from testing (Debian testing watch)
[2024-12-14] php-dompdf 3.0.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-12-12] Accepted php-dompdf 3.0.1+dfsg-1 (source) into unstable (William Desportes)
[2024-08-06] php-dompdf 3.0.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-08-03] Accepted php-dompdf 3.0.0+dfsg-2 (source) into unstable (William Desportes)
[2024-08-03] Accepted php-dompdf 3.0.0+dfsg-1 (source) into unstable (William Desportes)
[2024-04-20] php-dompdf 2.0.7+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-04-17] Accepted php-dompdf 2.0.7+dfsg-1 (source) into unstable (William Desportes)
[2024-03-11] php-dompdf 2.0.4+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-03-07] Accepted php-dompdf 2.0.4+dfsg-2 (source) into unstable (David Prévot)
[2023-12-19] php-dompdf 2.0.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-12-16] Accepted php-dompdf 2.0.4+dfsg-1 (source) into unstable (William Desportes)
[2023-12-09] php-dompdf 2.0.3+dfsg-4 MIGRATED to testing (Debian testing watch)
[2023-12-06] Accepted php-dompdf 2.0.3+dfsg-4 (source) into unstable (William Desportes)
[2023-10-01] php-dompdf 2.0.3+dfsg-3 MIGRATED to testing (Debian testing watch)
[2023-09-29] Accepted php-dompdf 2.0.3+dfsg-3 (source) into unstable (William Desportes)
[2023-08-10] Accepted php-dompdf 0.6.2+dfsg-3+deb10u2 (source) into oldoldstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2023-07-13] Accepted php-dompdf 0.6.2+dfsg-3+deb10u1 (source) into oldoldstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2023-07-10] php-dompdf 2.0.3+dfsg-2 MIGRATED to testing (Debian testing watch)
[2023-07-06] Accepted php-dompdf 2.0.3+dfsg-2 (source) into unstable (William Desportes)
[2023-02-11] php-dompdf 2.0.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-02-09] php-dompdf 2.0.2+dfsg-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 2
RC: 1
I&N: 0
M&W: 1
F&P: 0
patch: 1

links

homepage
lintian
buildd: logs
popcon
browse source code
other distros
security tracker
debian patches
debci