diff mbox series

[meta-python,44/61] python3-svglib: Upgrade 2.0.2 -> 2.3.2

Message ID 20261027092028.782979-44-leon.anavi@konsulko.com
State Under Review
Headers show
Series [meta-python,01/61] python3-asgiref: Upgrade 3.12.1 -> 3.13.0 | expand

Commit Message

Leon Anavi Oct. 27, 2026, 9:20 a.m. UTC 
Upgrade to release 2.3.2:

Security:

- A long run of digits in the arguments of a path arc command (A or
  a) could make parsing take exponential time, so a tiny SVG could
  block a process for minutes or longer (CWE-1333, CWE-400,
  GHSA-249c-7rgc-f52h). Arc arguments are now read one token at a
  time, without regex backtracking. Parsing of a malformed arc
  stops at the first argument that does not fit.

Fixed:

- Accept explicit plus signs on arc rotation and endpoints, and
  tab, carriage return and line feed separators in transform
  arguments, as allowed by SVG.
- svg2rlg() no longer unpacks a .svgz file to a sibling .svg file,
  which overwrote an existing file of that name and then deleted
  it. The compressed data is now read as a stream.
- A <use> that refers to itself, or to a cycle of elements that
  each <use> the next one, no longer crashes with RecursionError.
  The offending <use> is skipped and an error is logged, as already
  done for cyclic references between external files.

Extend RDEPENDS with the runtime dependency python3-reportlab.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
---
 ...thon3-svglib_2.0.2.bb => python3-svglib_2.3.2.bb} | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)
 rename meta-python/recipes-devtools/python/{python3-svglib_2.0.2.bb => python3-svglib_2.3.2.bb} (64%)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-svglib_2.0.2.bb b/meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb
similarity index 64%
rename from meta-python/recipes-devtools/python/python3-svglib_2.0.2.bb
rename to meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb
index 2144ae52dd..9403e7d49e 100644
--- a/meta-python/recipes-devtools/python/python3-svglib_2.0.2.bb
+++ b/meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb
@@ -8,11 +8,17 @@  LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b52f2d57d10c4f7ee67a7eb9615d5d24"
 
 CVE_PRODUCT = "svglib"
 
-SRC_URI[sha256sum] = "455e473dbe7066eea55c39de8194a6a3b646b6c37a255700257fd32115ddb218"
+SRC_URI[sha256sum] = "625b62cf440ab57f5def42d5be47a0d6b73c02711ef86ab1545650a98ac1ad5f"
 
 inherit pypi python_hatchling
 
 BBCLASSEXTEND = "native nativesdk"
 
-RDEPENDS:${PN} = "python3-pillow python3-html python3-cssselect2 python3-webencodings \
-    python3-lxml"
+RDEPENDS:${PN} = " \
+    python3-pillow \
+    python3-html \
+    python3-cssselect2 \
+    python3-webencodings \
+    python3-lxml \
+    python3-reportlab \
+"