[GHSA-jf6q-chmf-3h3v] Add weasyprint 70.0 url_fetcher fix commit

[SebTardif]

Add the published WeasyPrint 70.0 url_fetcher fix commit on the existing reviewed advisory GHSA-jf6q-chmf-3h3v.

Problem

The global record already has fixed: 70.0 and the v70.0 release tag. A release tag is not a substitute for the security commit. v70.0 also contains unrelated work (including an EPS-image change tracked on a different repo advisory). Readers need the commit that threads the document url_fetcher through write_pdf().

Change

One file: advisories/github-reviewed/2026/09/GHSA-jf6q-chmf-3h3v/GHSA-jf6q-chmf-3h3v.json

• Add a WEB reference to 289e278439b0 (Always use original URL fetcher when available; touches weasyprint/document.py and weasyprint/pdf/__init__.py, the two sites named in the advisory).
• Do not add the EPS commit 39cd37ce16 (repo advisory GHSA-r543-q48m-4c9j, not this GHSA).
• Do not add the version-bump commit 4d3b7b6449.
• Do not change the affected range. fixed: 70.0 is already correct.

Validation

• python3 -m json.tool on the edited file succeeds.
• Commit files match the two write_pdf() channels described in the advisory.
• Same reference shape as merged #9192 and #9193.

Related

• Repo advisory: GHSA-jf6q-chmf-3h3v
• CVE-2026-55073
• Recent sibling: #9376

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.