python3-svglib: Upgrade 2.3.2 -> 2.3.3

Upgrade to release 2.3.3:

Security:

- The limit on <use> expansions added in 2.3.1 counted expansions,
  not their size. Each expansion copies and renders the whole
  element it refers to, so a few kilobytes of nested <use> groups
  with a large group at the bottom could still take minutes and
  gigabytes to render (CWE-400, GHSA-xpfm-fw4h-qxwv, an incomplete
  fix of GHSA-555j-qj3j-c8jv). The elements copied by all
  expansions of a document, external SVGs included, are now limited
  too (MAX_USE_CLONED_ELEMENTS, 20,000); once it is spent the
  remaining <use> elements are skipped and an error is logged.
  Thanks to Adrian Korwel for the report.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Leon Anavi authored and Khem Raj committed 2026-11-06 00:15:42 -08:00
1 parent 6178510d46
commit bab1ebbba3
1 file changed
+1 -1
@@ -0,0 +1,24 @@
SUMMARY = "A pure-Python library for reading and converting SVG."
DESCRIPTION = "Svglib is a Python library for reading SVG files and \
converting them (to a reasonable degree) to other formats using the \
ReportLab Open Source toolkit."
LICENSE = "LGPL-3.0-or-later"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b52f2d57d10c4f7ee67a7eb9615d5d24"
CVE_PRODUCT = "svglib"
SRC_URI[sha256sum] = "1aef52f3dc651416119b55716e673995d2c9f90c86a07df0b2bcf6de26c7e0ff"
inherit pypi python_hatchling
BBCLASSEXTEND = "native nativesdk"
RDEPENDS:${PN} = " \
python3-pillow \
python3-html \
python3-cssselect2 \
python3-webencodings \
python3-lxml \
python3-reportlab \
"