From 7a1d210f6ddf3769b6081ec8298f98b4eafc6160 Mon Sep 17 00:00:00 2001 From: Leon Anavi Date: Tue, 27 Oct 2026 11:20:11 +0200 Subject: [PATCH] python3-svglib: Upgrade 2.0.2 -> 2.3.2 Upgrade to release 2.3.2: Security: - A long run of digits in the arguments of a path arc command (A or a) could make parsing take exponential time, so a tiny SVG could block a process for minutes or longer (CWE-1333, CWE-400, GHSA-249c-7rgc-f52h). Arc arguments are now read one token at a time, without regex backtracking. Parsing of a malformed arc stops at the first argument that does not fit. Fixed: - Accept explicit plus signs on arc rotation and endpoints, and tab, carriage return and line feed separators in transform arguments, as allowed by SVG. - svg2rlg() no longer unpacks a .svgz file to a sibling .svg file, which overwrote an existing file of that name and then deleted it. The compressed data is now read as a stream. - A that refers to itself, or to a cycle of elements that each the next one, no longer crashes with RecursionError. The offending is skipped and an error is logged, as already done for cyclic references between external files. Extend RDEPENDS with the runtime dependency python3-reportlab. Signed-off-by: Leon Anavi Signed-off-by: Khem Raj --- ...thon3-svglib_2.0.2.bb => python3-svglib_2.3.2.bb} | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) rename meta-python/recipes-devtools/python/{python3-svglib_2.0.2.bb => python3-svglib_2.3.2.bb} (64%) diff --git a/meta-python/recipes-devtools/python/python3-svglib_2.0.2.bb b/meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb similarity index 64% rename from meta-python/recipes-devtools/python/python3-svglib_2.0.2.bb rename to meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb index 2144ae52dd..9403e7d49e 100644 --- a/meta-python/recipes-devtools/python/python3-svglib_2.0.2.bb +++ b/meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb @@ -8,11 +8,17 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b52f2d57d10c4f7ee67a7eb9615d5d24" CVE_PRODUCT = "svglib" -SRC_URI[sha256sum] = "455e473dbe7066eea55c39de8194a6a3b646b6c37a255700257fd32115ddb218" +SRC_URI[sha256sum] = "625b62cf440ab57f5def42d5be47a0d6b73c02711ef86ab1545650a98ac1ad5f" inherit pypi python_hatchling BBCLASSEXTEND = "native nativesdk" -RDEPENDS:${PN} = "python3-pillow python3-html python3-cssselect2 python3-webencodings \ - python3-lxml" +RDEPENDS:${PN} = " \ + python3-pillow \ + python3-html \ + python3-cssselect2 \ + python3-webencodings \ + python3-lxml \ + python3-reportlab \ +"