plan to migrate away from wkhtmltopdf

[DanielRuf]

Hi there. I was made aware by a person (who wants to move from WooCommerce to Sylius and build a SaaS-solution out of it) asking, why wkhtmltopdf is needed.

I told the person, that this should normally not be the case in modern and secure software.

In summarization I told them:

• wkhtmltopdf is basically unmaintained for years (https://github.com/wkhtmltopdf/wkhtmltopdf, "This repository has been archived by the owner on Jan 2, 2023. It is now read-only.")
• the latest release was 4 years ago (https://github.com/wkhtmltopdf/wkhtmltopdf/releases)
• it contains a critical unpatched SSRF vulnerability with a CVSS score 9.8 / 10 (https://nvd.nist.gov/vuln/detail/CVE-2022-35583)
• the upcoming Cyber Resilience Act requires that digital products (including software) shall not contain known vulnerabilities when released on the market (the SBOM documents would reveal that too)
• PCI DSS certification may be at risk (https://security.stackexchange.com/a/140942)
• (and a few more points regarding thirdparty software, that are often overlooked)

[oallain]

Hello,

I have a plan to use https://gotenberg.dev/ but we need to wait some weeks.