Commit 90b1e65
authored
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
Bump fonttools from 4.49.0 to 4.60.2 (#507)
Bumps [fonttools](https://github.com/fonttools/fonttools) from 4.49.0 to
4.60.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fonttools/fonttools/releases">fonttools's
releases</a>.</em></p>
<blockquote>
<h2>4.60.2</h2>
<ul>
<li><strong>Backport release</strong> Same as 4.61.0 but without
"Drop support for EOL Python 3.9" change to allow downstream
projects still on Python 3.9 to avail of the security fix for
CVE-2025-66034 (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3994">#3994</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3999">#3999</a>).</li>
</ul>
<h2>4.60.1</h2>
<ul>
<li>[ufoLib] Reverted accidental method name change in
<code>UFOReader.getKerningGroupConversionRenameMaps</code>
that broke compatibility with downstream projects like defcon (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3948">#3948</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3947">#3947</a>,
<a
href="https://redirect.github.com/robotools/defcon/issues/478">robotools/defcon#478</a>).</li>
<li>[ufoLib] Added test coverage for
<code>getKerningGroupConversionRenameMaps</code> method (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3950">#3950</a>).</li>
<li>[subset] Don't try to subset BASE table; pass it through by default
instead (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3949">#3949</a>).</li>
<li>[subset] Remove empty BaseRecord entries in MarkBasePos lookups (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3897">#3897</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3892">#3892</a>).</li>
<li>[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3946">#3946</a>).</li>
<li>[subset] Remove duplicate features when subsetting (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3945">#3945</a>).</li>
<li>[Docs] Added documentation for the visitor module (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3944">#3944</a>).</li>
</ul>
<h2>4.60.0</h2>
<ul>
<li>
<p>[pointPen] Allow <code>reverseFlipped</code> parameter of
<code>DecomposingPointPen</code> to take a <code>ReverseFlipped</code>
enum value to control whether/how to reverse contour direction of
flipped components, in addition to the existing True/False. This allows
to set <code>ReverseFlipped.ON_CURVE_FIRST</code> to ensure that the
decomposed outline starts with an on-curve point before being reversed,
for better consistency with other segment-oriented contour
transformations. The change is backward compatible, and the default
behavior hasn't changed (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3934">#3934</a>).</p>
</li>
<li>
<p>[filterPen] Added <code>ContourFilterPointPen</code>, base pen for
buffered contour operations, and <code>OnCurveStartPointPen</code>
filter to ensure contours start with an on-curve point (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3934">#3934</a>).</p>
</li>
<li>
<p>[cu2qu] Fixed difference in cython vs pure-python complex division by
real number (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3930">#3930</a>).</p>
</li>
<li>
<p>[varLib.avar] Refactored and added some new sub-modules and scripts
(<a
href="https://redirect.github.com/fonttools/fonttools/issues/3926">#3926</a>).</p>
<ul>
<li><code>varLib.avar.build</code> module to build avar (and a missing
fvar) binaries into a possibly empty TTFont,</li>
<li><code>varLib.avar.unbuild</code> module to print a .designspace
snippet that would generate the same avar binary,</li>
<li><code>varLib.avar.map</code> module to take TTFont and do the
mapping, in user/normalized space,</li>
<li><code>varLib.avar.plan</code> module moved from
<code>varLib.avarPlanner</code>.</li>
</ul>
<p>The bare <code>fonttools varLib.avar</code> script is deprecated, in
favour of <code>fonttools varLib.avar.build</code> (or
<code>unbuild</code>).</p>
</li>
<li>
<p>[interpolatable] Clarify <code>linear_sum_assignment</code> backend
options and minimal dependency usage (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3927">#3927</a>).</p>
</li>
<li>
<p>[post] Speed up <code>build_psNameMapping</code> (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3923">#3923</a>).</p>
</li>
<li>
<p>[ufoLib] Added typing annotations to fontTools.ufoLib (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3875">#3875</a>).</p>
</li>
</ul>
<h2>4.59.2</h2>
<ul>
<li>[varLib] Clear <code>USE_MY_METRICS</code> component flags when
inconsistent across masters (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3912">#3912</a>).</li>
<li>[varLib.instancer] Avoid negative advance width/height values when
instatiating HVAR/VVAR, (unlikely in well-behaved fonts) (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3918">#3918</a>).</li>
<li>[subset] Fix shaping behaviour when pruning empty mark sets (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3915">#3915</a>,
<a
href="https://redirect.github.com/harfbuzz/harfbuzz/issues/5499">harfbuzz/harfbuzz#5499</a>).</li>
<li>[cu2qu] Fixed <code>dot()</code> product of perpendicular vectors
not always returning exactly 0.0 in all Python implementations (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3911">#3911</a>)</li>
<li>[varLib.instancer] Implemented fully-instantiating
<code>avar2</code> fonts (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3909">#3909</a>).</li>
<li>[feaLib] Allow float values in <code>VariableScalar</code>'s axis
locations (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3906">#3906</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3907">#3907</a>).</li>
<li>[cu2qu] Handle special case in <code>calc_intersect</code> for
degenerate cubic curves where 3 to 4 control points are equal (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3904">#3904</a>).</li>
</ul>
<h2>4.59.1</h2>
<ul>
<li>[featureVars] Update OS/2.usMaxContext if possible after
addFeatureVariationsRaw (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3894">#3894</a>).</li>
<li>[vhmtx] raise TTLibError('not enough data...') when hmtx/vmtx are
truncated (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3843">#3843</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3901">#3901</a>).</li>
<li>[feaLib] Combine duplicate features that have the same set of
lookups regardless of the order in which those lookups are added to the
feature (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3895">#3895</a>).</li>
<li>[varLib] Deprecate <code>varLib.mutator</code> in favor of
<code>varLib.instancer</code>. The latter provides equivalent full
(static font) instancing in addition to partial VF instancing.<br />
CLI users should replace <code>fonttools varLib.mutator</code> with
<code>fonttools varLib.instancer</code>. API users should migrate to
<code>fontTools.varLib.instancer.instantiateVariableFont</code> (<a
href="https://redirect.github.com/fonttools/fonttools/issues/2680">#2680</a>).</li>
</ul>
<h2>4.59.0</h2>
<ul>
<li>Removed hard-dependency on pyfilesystem2 (<code>fs</code> package)
from <code>fonttools[ufo]</code> extra. This is replaced by the
<code>fontTools.misc.filesystem</code> package, a stdlib-only, drop-in
replacement for the subset of the pyfilesystem2's API used by
<code>fontTools.ufoLib</code>. The latter should continue to work with
the upstream <code>fs</code> (we even test with/without). However,
clients who wish to continue using <code>fs</code> can do so by
depending on it directly instead of via the <code>fonttools[ufo]</code>
extra (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3885">#3885</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3620">#3620</a>).</li>
<li>[xmlWriter] Replace illegal XML characters (e.g. control or
non-characters) with "?" when dumping to ttx (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3868">#3868</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/71">#71</a>).</li>
<li>[varLib.hvar] Fixed vertical metrics fields copy/pasta error (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3884">#3884</a>).</li>
<li>Micro optimizations in ttLib and sstruct modules (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3878">#3878</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3879">#3879</a>).</li>
<li>[unicodedata] Add Garay script to RTL_SCRIPTS (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3882">#3882</a>).</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/fonttools/fonttools/blob/main/NEWS.rst">fonttools's
changelog</a>.</em></p>
<blockquote>
<h2>4.60.2 (released 2025-12-09)</h2>
<ul>
<li><strong>Backport release</strong> Same as 4.61.0 but without
"Drop support for EOL Python 3.9" change to allow
downstream projects still on Python 3.9 to avail of the security fix for
CVE-2025-66034 (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3994">#3994</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3999">#3999</a>).</li>
</ul>
<h2>4.61.0 (released 2025-11-28)</h2>
<ul>
<li>[varLib.main]: <strong>SECURITY</strong> Only use
basename(vf.filename) to prevent path traversal attacks when
running <code>fonttools varLib</code> command, or code which invokes
<code>fonttools.varLib.main()</code>.
Fixes CVE-2025-66034, see:
<a
href="https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv">https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv</a>.</li>
<li>[feaLib] Sort BaseLangSysRecords by tag (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3986">#3986</a>).</li>
<li>Drop support for EOL Python 3.9 (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3982">#3982</a>).</li>
<li>[instancer] Support --remove-overlaps for fonts with CFF2 table (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3975">#3975</a>).</li>
<li>[CFF2ToCFF] Add --remove-overlaps option (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3976">#3976</a>).</li>
<li>[feaLib] Raise an error for rsub with NULL target (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3979">#3979</a>).</li>
<li>[bezierTools] Fix logic bug in curveCurveIntersections (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3963">#3963</a>).</li>
<li>[feaLib] Error when condition sets have the same name (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3958">#3958</a>).</li>
<li>[cu2qu.ufo] skip processing empty glyphs to support sparse kerning
masters (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3956">#3956</a>).</li>
<li>[unicodedata] Update to Unicode 17. Require <code>unicodedata2 >=
17.0.0</code> when installed with 'unicode' extra.</li>
</ul>
<h2>4.60.1 (released 2025-09-29)</h2>
<ul>
<li>[ufoLib] Reverted accidental method name change in
<code>UFOReader.getKerningGroupConversionRenameMaps</code>
that broke compatibility with downstream projects like defcon (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3948">#3948</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3947">#3947</a>,
<a
href="https://redirect.github.com/robotools/defcon/issues/478">robotools/defcon#478</a>).</li>
<li>[ufoLib] Added test coverage for
<code>getKerningGroupConversionRenameMaps</code> method (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3950">#3950</a>).</li>
<li>[subset] Don't try to subset BASE table; pass it through by default
instead (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3949">#3949</a>).</li>
<li>[subset] Remove empty BaseRecord entries in MarkBasePos lookups (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3897">#3897</a>,
<a
href="https://redirect.github.com/fonttools/fonttools/issues/3892">#3892</a>).</li>
<li>[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3946">#3946</a>).</li>
<li>[subset] Remove duplicate features when subsetting (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3945">#3945</a>).</li>
<li>[Docs] Added documentation for the visitor module (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3944">#3944</a>).</li>
</ul>
<h2>4.60.0 (released 2025-09-17)</h2>
<ul>
<li>[pointPen] Allow <code>reverseFlipped</code> parameter of
<code>DecomposingPointPen</code> to take a <code>ReverseFlipped</code>
enum value to control whether/how to reverse contour direction of
flipped components, in addition to
the existing True/False. This allows to set
<code>ReverseFlipped.ON_CURVE_FIRST</code> to ensure that
the decomposed outline starts with an on-curve point before being
reversed, for better consistency
with other segment-oriented contour transformations. The change is
backward compatible, and the
default behavior hasn't changed (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3934">#3934</a>).</li>
<li>[filterPen] Added <code>ContourFilterPointPen</code>, base pen for
buffered contour operations, and
<code>OnCurveStartPointPen</code> filter to ensure contours start with
an on-curve point (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3934">#3934</a>).</li>
<li>[cu2qu] Fixed difference in cython vs pure-python complex division
by real number (<a
href="https://redirect.github.com/fonttools/fonttools/issues/3930">#3930</a>).</li>
<li>[varLib.avar] Refactored and added some new sub-modules and scripts
(<a
href="https://redirect.github.com/fonttools/fonttools/issues/3926">#3926</a>).
<ul>
<li><code>varLib.avar.build</code> module to build avar (and a missing
fvar) binaries into a possibly empty TTFont,</li>
<li><code>varLib.avar.unbuild</code> module to print a .designspace
snippet that would generate the same avar binary,</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fonttools/fonttools/commit/78ba5e8bb4ccf65ef8077d81bc48450ccacf1728"><code>78ba5e8</code></a>
Release 4.60.2</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/c3f9979dbf278baf82beba675dda40c94f78c48e"><code>c3f9979</code></a>
macos-13 runner is no more, use macos-15-intel</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/8016403e0ad4b7de00c0b48d30afa4de9d7a29e4"><code>8016403</code></a>
Revert "Merge pull request <a
href="https://redirect.github.com/fonttools/fonttools/issues/3982">#3982</a>
from fonttools/drop-py39"</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/e691e3bef9fc4e8096e4023ccacbc327d2569905"><code>e691e3b</code></a>
Release 4.61.0</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/c2d540f4ada946ea1ef97f898e0daa9601bc1019"><code>c2d540f</code></a>
Update NEWS.rst</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/3859753a0511efc568d4d71c4933219c11b6207b"><code>3859753</code></a>
Update NEWS.rst</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/26eb070a55c731d9828dddf5cb022e0d79e9af45"><code>26eb070</code></a>
black</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/5ff73af3265e0b5207c3a2870c9f0ccc8ee19d0f"><code>5ff73af</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32"><code>a696d5b</code></a>
varLib: only use the basename(vf.filename)</li>
<li><a
href="https://github.com/fonttools/fonttools/commit/b00bc459efac4d9d52a1eafa2cdd2c7ff503ced7"><code>b00bc45</code></a>
varLib_test: test path traversal in variable-font filename</li>
<li>Additional commits viewable in <a
href="https://github.com/fonttools/fonttools/compare/4.49.0...4.60.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/robusta-dev/krr/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent 81eab92 commit 90b1e65
1 file changed
+1
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
11 | 11 | | |
12 | 12 | | |
13 | 13 | | |
14 | | - | |
| 14 | + | |
15 | 15 | | |
16 | 16 | | |
17 | 17 | | |
| |||
0 commit comments