From bab1ebbba3fcdd61e57a39cfa67dc1be48f63a95 Mon Sep 17 00:00:00 2001 From: Leon Anavi Date: Thu, 5 Nov 2026 13:55:23 +0200 Subject: [PATCH] python3-svglib: Upgrade 2.3.2 -> 2.3.3 Upgrade to release 2.3.3: Security: - The limit on expansions added in 2.3.1 counted expansions, not their size. Each expansion copies and renders the whole element it refers to, so a few kilobytes of nested groups with a large group at the bottom could still take minutes and gigabytes to render (CWE-400, GHSA-xpfm-fw4h-qxwv, an incomplete fix of GHSA-555j-qj3j-c8jv). The elements copied by all expansions of a document, external SVGs included, are now limited too (MAX_USE_CLONED_ELEMENTS, 20,000); once it is spent the remaining elements are skipped and an error is logged. Thanks to Adrian Korwel for the report. Signed-off-by: Leon Anavi Signed-off-by: Khem Raj --- .../python/{python3-svglib_2.3.2.bb => python3-svglib_2.3.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-svglib_2.3.2.bb => python3-svglib_2.3.3.bb} (87%) diff --git a/meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb b/meta-python/recipes-devtools/python/python3-svglib_2.3.3.bb similarity index 87% rename from meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb rename to meta-python/recipes-devtools/python/python3-svglib_2.3.3.bb index 9403e7d49e..9f47ffe581 100644 --- a/meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb +++ b/meta-python/recipes-devtools/python/python3-svglib_2.3.3.bb @@ -8,7 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b52f2d57d10c4f7ee67a7eb9615d5d24" CVE_PRODUCT = "svglib" -SRC_URI[sha256sum] = "625b62cf440ab57f5def42d5be47a0d6b73c02711ef86ab1545650a98ac1ad5f" +SRC_URI[sha256sum] = "1aef52f3dc651416119b55716e673995d2c9f90c86a07df0b2bcf6de26c7e0ff" inherit pypi python_hatchling