[AUH] freetype: upgrading to 2.15.0 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *freetype* to *2.15.0* has Succeeded.

Next steps:
    - apply the patch: git am 0001-freetype-upgrade-2.14.3-2.15.0.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From 6f4ef4c01c8976cf2e00e58c1cf365865117dee8 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Tue, 13 Oct 2026 06:27:35 +0000
Subject: [PATCH] freetype: upgrade 2.14.3 -> 2.15.0

Tag sources with `VER-2-15-0'.
Whitespace.
[truetype] Avoid overflow in VARC axis values.
Reported as
  https://issues.oss-fuzz.com/issues/570754474

  (tt_face_load_varc_glyph): Use `NEG_LONG` when rounding negative axis
  values, since the conversion can wrap to `INT32_MIN` and negating that
  value overflows on platforms with 32-bit longs.

Assisted-by: OpenAI Codex

`numBlends` comes from the charstring and is attacker-controlled.  Check for
overflow before multiplying: a wrapped `numOperands` would bypass the stack
underflow check below and the loop that follows would then run up to 2^32
iterations (CPU exhaustion).

[autofit] Limit default GSUB coverage to reachable glyphs.

A lookup can be registered under several scripts while substituting inputs
from only one of them.  Collecting every output assigns those glyphs to the
first processed script, regardless of the inputs' styles.  In Google Sans
this assigns the Latin rvrn alternates to Cyrillic; missing Cyrillic blue
zones then disable their hinting and darkening.

The full Meson test suite passes with linked, dynamic, and disabled
HarfBuzz.  The regression fails before the fix.  Google Sans alternates
retain Latin styles and stem darkening after the fix.

Assisted-by: OpenAI Codex
Fixes issue #1441.
[truetype] Make tiny exception from v40 rules.
[colr] Correctly handle B/W bitmaps in 'COLR' while blending.
[sfnt] Fix standalone compilation of `ttcmap.c`.

The single-object build inherited this include from `sfdriver.c`
and `sfobjs.c`, masking the missing direct dependency.

Assisted-by: OpenAI Codex <noreply@openai.com>
2026-10-04  Tomer Fichman  <@tomer>
Provide tests for issue #1469.
[truetype] Update the VARC variation-store binary format.

Spec:
Offset-base erratum:

Tests: full Meson regression suite (3 passed).
Assisted-by: OpenAI Codex
[truetype] Compare VARC condition values before rounding.

Condition format 2 tests whether default plus interpolated delta is
positive.  Rounding the delta to an integer first loses small positive
fractions and incorrectly hides components.

  (tt_varc_get_item_deltas, tt_varc_eval_condition):  Allow the
  MultiItemVariationStore evaluator to initialize condition accumulators
  from their defaults and return the unrounded sign.  Compare in the
  existing 64-bit representation, including the emulated path, so large
  int32 deltas need not fit in a signed 16.16 `FT_Long`.

  Use ULABS for unsigned magnitudes in emulated multiplication, avoiding
  MSVC's warning about unsigned unary negation (see
  https://gitlab.freedesktop.org/freetype/freetype/-
  /merge_requests/458#note_3692404).

  Cast to `FT_UInt32` after obtaining the magnitude; no additional
  absolute-value helper is needed.

  (tt_varc_apply_axis_deltas, tt_varc_apply_transform_deltas): Updated.

All three Meson targets and the forced-emulated VARC tests pass.  All 40
cross-library diagnostic cases and 115 native/emulated arithmetic
comparisons agree.  MSVC itself was not available locally.

Assisted-by: OpenAI Codex <codex@openai.com>
[truetype] Repair VARC arithmetic without native 64-bit integers.

  Restrict the fast signed product to its safe range, preserve carries when
  adding negative products, and combine both accumulator words when
  converting fractional deltas.  Explicitly sign-extend the result.

The full Meson suite passes.  An isolated build forcing the emulated VARC
path compiles without an initializer bypass; 115 native/emulated condition
and scaled/unscaled transform comparisons agree, including large signed
deltas, cancellation, and carries.

Assisted-by: OpenAI Codex <codex@openai.com>
[truetype] Treat null VARC conditions as true.

The OpenType condition rules define an offset of zero as the true
condition.  Recognize that value both in the top-level ConditionList and
in nested AND, OR, and NOT conditions.

Add a VARC regression font covering all four cases.
Assisted-by: OpenAI Codex <codex@openai.com>
docs/CHANGES: Updated.
[cff] Load VARC-only glyphs beyond the CharStrings INDEX.

OFF permits trailing glyphs to be provided entirely by VARC.  Preserve the
SFNT glyph count for CFF2 fonts with VARC, and dispatch those glyphs to VARC
before checking the CFF2 fallback CharString range.

Add a short-CharStrings fixture and verify its glyph count and outline.  All
three Meson tests pass.

Assisted-by: OpenAI Codex <noreply@openai.com>
[truetype] Apply VARC axis resets without explicit axis values.

Tests: all three Meson targets pass. Generated reset, explicit-axis, and
inheritance comparisons agree with HarfBuzz and FontTools.

Assisted-by: OpenAI Codex <noreply@openai.com>
[base] Preserve off-curve cubic pairs when reversing outlines.
Assisted-by: OpenAI Codex <noreply@openai.com>
[truetype] Support cubic outlines in 'GLYF' table.

Preserve the cubic flag while loading extended simple glyphs, including
on-curve points whose state can be changed by TrueType instructions.

Teach outline decomposition, stroking, and rasterization to ha

[Changelog truncated as it exceeds 5000 characters;
the full changelog can be found in an attachment to the AUH email]
---
 .../freetype/{freetype_2.14.3.bb => freetype_2.15.0.bb}         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-graphics/freetype/{freetype_2.14.3.bb => freetype_2.15.0.bb} (94%)