wkhtmltopdf archived with unpatched CVE, developers urged to migrate now

·1 views

The wkhtmltopdf HTML-to-PDF tool was officially archived on January 2, 2023, leaving it without maintainers, updates, or security patches. An unpatched vulnerability, CVE-2022-35583, involving server-side request forgery via rendered content, will never be fixed in the project. The tool also suffers from degrading package support, with major Linux distributions dropping it and official builds not covering current Debian, Ubuntu, or arm64 environments. Developers are advised to audit which wkhtmltopdf flags they actually use before choosing a replacement, as no alternative perfectly replicates its behavior. Migration options range from open-source engines like WeasyPrint and Chromium-based Puppeteer to hosted APIs such as DocRaptor and PDFShift, each with distinct trade-offs around CSS support, JavaScript rendering, and infrastructure ownership.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Dev shares lessons on automation, ambiguity, and Agile from months of hands-on work

A software developer has shared monthly reflections covering three areas: build automation, handling ambiguity, and working within Agile frameworks. Over several months, they built a suite of Jenkins pipelines covering testing, deployment, security scans, and multi-architecture builds, which they say has freed up significant development hours. On ambiguity, the developer argues that clarifying requirements before writing any code — or entering any AI prompt — leads to less noise and better outcomes. They outlined a personal workflow of reviewing tickets, identifying questions, consulting stakeholders, and updating documentation before making any changes. Regarding Agile, the developer raises concerns about story point estimation, questioning how a single point value can fairly represent effort across team members with varying levels of experience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Warns Over-Reliance on Claude Code Is Eroding Core Engineering Skills

A software developer has shared why he scaled back his use of Claude Code, arguing that heavy reliance on AI coding tools is causing engineers to outsource thinking rather than just routine tasks. He observed colleagues stopping independent debugging and skipping fundamentals like async behavior, trusting AI outputs without the intuition to spot errors. The author contends that recent industry layoffs exposed those who built no portable skills because AI had done most of their problem-solving for them. He draws a distinction between using AI as a productivity booster and becoming entirely dependent on it, warning the latter reduces an engineer's real value. His advice is to use tools like Claude as an assistant after attempting problems independently, preserving the reasoning, architecture, and communication skills that AI cannot replace.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Tests Osintgram on Freestyle VM to Debug HikerAPI Authentication Issues

A developer moved the open-source Instagram OSINT tool Osintgram from Termux on Android into a Freestyle virtual machine running Linux to better diagnose HikerAPI integration problems. By inspecting the project's source code, particularly the hikercli.py file, rather than only the installed Python package, the developer gained clearer insight into how the API token was being configured. Testing the HikerAPI endpoint independently from Osintgram helped separate application configuration issues from account-level problems. The debugging process revealed two distinct stages: an initial unauthorized response, followed by an account-credit error once authentication was corrected. The experiment concluded that a more capable environment alone does not resolve integration issues, and that methodical source-code inspection and isolated API testing are essential troubleshooting steps.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Native macOS App to Manage SSH Configs and Tunnels

A developer frustrated with repeatedly typing complex SSH tunnel commands built SSH Config Manager, a native macOS app that simplifies managing ~/.ssh/config files and saving tunnel presets. The tool was created after shell function aliases proved unreliable across multiple machines running different operating systems and shells. Rather than adopting a VPN, the developer chose to build around SSH, citing familiarity, universal server support, and simpler failure diagnosis. The app includes an embedded keyword catalog with 95 entries to help users avoid misconfigured directives that standard text editors would silently ignore. Originally built for personal use, the app was later published to the Mac App Store after proving genuinely useful in daily workflows.

0 comments Read more at DEV Community