CVS commit: pkgsrc/graphics/py-svglib

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sat Oct 24 09:03:40 UTC 2026

Modified Files:
        pkgsrc/graphics/py-svglib: Makefile distinfo

Log Message:
py-svglib: updated to 2.3.2

2.3.2 (2026-10-23)

Security

- A long run of digits in the arguments of a path arc command (`A` or `a`)
  could make parsing take exponential time, so a tiny SVG could block a
  process for minutes or longer (CWE-1333, CWE-400, GHSA-249c-7rgc-f52h).
  Arc arguments are now read one token at a time, without regex backtracking.
  Parsing of a malformed arc stops at the first argument that does not fit.

Fixed

- Accept explicit plus signs on arc rotation and endpoints, and tab, carriage
  return and line feed separators in transform arguments, as allowed by SVG
- `svg2rlg()` no longer unpacks a `.svgz` file to a sibling `.svg` file, which
  overwrote an existing file of that name and then deleted it. The compressed
  data is now read as a stream
- A `<use>` that refers to itself, or to a cycle of elements that each `<use>`
  the next one, no longer crashes with `RecursionError`. The offending `<use>`
  is skipped and an error is logged, as already done for cyclic references
  between external files

2.3.1 (2026-10-22)

Security

- Rendering an SVG could be made to take exponential time and memory through
  nested `<use>` elements, where each level references a group containing many
  `<use>` elements of the previous level (CWE-400, GHSA-555j-qj3j-c8jv).
  `renderUse()` now stops after `MAX_USE_EXPANSIONS` (10,000) expansions per
  document, logs one error and skips the remaining `<use>` elements. The budget
  is shared with the renderers of external SVG files, so referencing many
  external files does not reset it.


To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 pkgsrc/graphics/py-svglib/Makefile
cvs rdiff -u -r1.4 -r1.5 pkgsrc/graphics/py-svglib/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/py-svglib/Makefile
diff -u pkgsrc/graphics/py-svglib/Makefile:1.6 pkgsrc/graphics/py-svglib/Makefile:1.7
--- pkgsrc/graphics/py-svglib/Makefile:1.6      Fri Oct 16 19:43:59 2026
+++ pkgsrc/graphics/py-svglib/Makefile  Sat Oct 24 09:03:40 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.6 2026/10/16 19:43:59 adam Exp $
+# $NetBSD: Makefile,v 1.7 2026/10/24 09:03:40 adam Exp $
 
-DISTNAME=      svglib-2.2.0
+DISTNAME=      svglib-2.3.2
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    graphics python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=s/svglib/}
@@ -10,7 +10,7 @@ HOMEPAGE=     https://github.com/deeplook/sv
 COMMENT=       Pure-Python library for reading and converting SVG
 LICENSE=       gnu-lgpl-v3
 
-TOOL_DEPENDS+= ${PYPKGPREFIX}-hatchling>0:../../devel/py-hatchling
+TOOL_DEPENDS+= ${PYPKGPREFIX}-hatchling>=0:../../devel/py-hatchling
 DEPENDS+=      ${PYPKGPREFIX}-Pillow>=9.0.0:../../graphics/py-Pillow
 DEPENDS+=      ${PYPKGPREFIX}-cssselect2>=0.2.0:../../textproc/py-cssselect2
 DEPENDS+=      ${PYPKGPREFIX}-lxml>=6.0.0:../../textproc/py-lxml

Index: pkgsrc/graphics/py-svglib/distinfo
diff -u pkgsrc/graphics/py-svglib/distinfo:1.4 pkgsrc/graphics/py-svglib/distinfo:1.5
--- pkgsrc/graphics/py-svglib/distinfo:1.4      Thu Aug 20 05:40:44 2026
+++ pkgsrc/graphics/py-svglib/distinfo  Sat Oct 24 09:03:40 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.4 2026/08/20 05:40:44 adam Exp $
+$NetBSD: distinfo,v 1.5 2026/10/24 09:03:40 adam Exp $
 
-BLAKE2s (svglib-2.2.0.tar.gz) = 7d982f30c746e4bd4cf40ad338eb2a6bd07a58dc90255d6d3437589427aae121
-SHA512 (svglib-2.2.0.tar.gz) = b5c3927e25e7d21700b159acfa1ae34a211682d4eebf153886691eef353f30c51e63f1fd7d6103c542f7ffa8e8e5ea9d9bdb99caeb59003534ab550c1935ff1b
-Size (svglib-2.2.0.tar.gz) = 1373629 bytes
+BLAKE2s (svglib-2.3.2.tar.gz) = c7f4474ee258f76187888d2254e5fd4328b07ffb9d9b287a15c8aed581a77962
+SHA512 (svglib-2.3.2.tar.gz) = 114ab498304d44ce913c8d8a50c68720b0a5c4b00980c34df9197b2166291bb4831a51ff799f4b566656c03479d5f8b4b29b1822ea80f4154f2cb81ff3df3cac
+Size (svglib-2.3.2.tar.gz) = 1381814 bytes