Bump the pip group across 3 directories with 3 updates by dependabot[bot] · Pull Request #11 · Lucky-abdo/PortDesk

dependabot · 2026-06-22T16:15:56Z

Bumps the pip group with 3 updates in the /under devoplment directory: cryptography, pillow and fonttools.
Bumps the pip group with 3 updates in the /under devoplment/Docker directory: cryptography, pillow and fonttools.
Bumps the pip group with 3 updates in the /under devoplment/New folder directory: cryptography, pillow and fonttools.

Updates cryptography from 42.0.8 to 48.0.1

Changelog

Sourced from cryptography's changelog.

48.0.1 - 2026-06-09
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.
.. _v48-0-0:
48.0.0 - 2026-05-04
BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

Added support for :doc:/hazmat/primitives/asymmetric/mlkem and :doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

47.0.0 - 2026-04-24
* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table> 

... (truncated)

Commits

de987ce 48.0.1 version bump and changelog (#14996)
8e03e30 bump for 48.0.0 release (#14796)
295e0d2 Add AGENTS.md with CLAUDE.md symlink (#14794)
104a2de Bump BoringSSL, OpenSSL, AWS-LC in CI (#14793)
67ec1e5 call check_length early on AesSiv::encrypt (#14792)
b2da57a changelog for mldsa/mlkem for openssl (#14791)
3cf44ad ML-KEM OpenSSL support (#14781)
2e31639 ML-DSA OpenSSL support (#14773)
5affe5a fix rust nightly clippy (#14790)
2e73ca4 bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (#1...
Additional commits viewable in compare view

Updates pillow from 10.4.0 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]

Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]

Update Python versions #9515 [@radarhere]

Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]

Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]

Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]

Merge PFM documentation into PPM #9434 [@radarhere]

Update macOS tested Pillow versions #9431 [@radarhere]

Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]

Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]

Update libpng to 1.6.56 #9499 [@radarhere]

Update freetype to 2.14.3 #9485 [@radarhere]

Updated libavif to 1.4.1 #9479 [@radarhere]

Updated harfbuzz to 13.2.1 #9461 [@radarhere]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Update harfbuzz to 13.0.1 #9453 [@radarhere]

Update libavif to 1.4.0 #9460 [@radarhere]

Update freetype to 2.14.2 #9449 [@radarhere]

Update actions/download-artifact action to v8 #9451 [@renovate[bot]]

Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]

Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]

Enable colour in CI logs #9486 [@hugovk]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Simplify TGA test code #9477 [@radarhere]

Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]

Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]

Add check-case-conflict hook #9446 [@radarhere]

Specify platform when pulling docker image #9440 [@radarhere]

GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]

Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]

Check all allocs in the Arrow tree #9488 [@wiredfool]

Reject non-numeric elements inside list coords #9526 [@hugovk]

Move variable declaration inside define #9525 [@radarhere]

... (truncated)

Changelog

Sourced from pillow's changelog.

Changelog (Pillow)

11.1.0 and newer

See GitHub Releases:

https://github.com/python-pillow/Pillow/releases

11.0.0 (2024-10-15)

Update licence to MIT-CMU #8460 [hugovk]

Conditionally define ImageCms type hint to avoid requiring core #8197 [radarhere]

Support writing LONG8 offsets in AppendingTiffWriter #8417 [radarhere]

Use ImageFile.MAXBLOCK when saving TIFF images #8461 [radarhere]

Do not close provided file handles with libtiff when saving #8458 [radarhere]

Support ImageFilter.BuiltinFilter for I;16* images #8438 [radarhere]

Use ImagingCore.ptr instead of ImagingCore.id #8341 [homm, radarhere, hugovk]

Updated EPS mode when opening images without transparency #8281 [Yay295, radarhere]

Use transparency when combining P frames from APNGs #8443 [radarhere]

Support all resampling filters when resizing I;16* images #8422 [radarhere]

Free memory on early return #8413 [radarhere]

Cast int before potentially exceeding INT_MAX #8402 [radarhere]

... (truncated)

Commits

3c41c09 12.2.0 version bump
cdaa29e Check calloc return value (#9527)
585b2f5 Check calloc return value
ecf011e Check all allocs in the Arrow tree (#9488)
cf6de8c Reject non-numeric elements inside list coords (#9526)
ffdcede Update 12.2.0 release notes (#9522)
7929d77 Added security release notes (#149)
c4f7aa5 Added security release notes
22cdb5f Move variable declaration inside define (#9525)
fc15b3b Resize tall images vertically first (#9524)
Additional commits viewable in compare view

Updates fonttools from 4.53.0 to 4.60.2

Release notes

Sourced from fonttools's releases.

4.60.2

Backport release Same as 4.61.0 but without "Drop support for EOL Python 3.9" change to allow downstream projects still on Python 3.9 to avail of the security fix for CVE-2025-66034 (#3994, #3999).

4.60.1

[ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).

[ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).

[subset] Don't try to subset BASE table; pass it through by default instead (#3949).

[subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).

[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).

[subset] Remove duplicate features when subsetting (#3945).

[Docs] Added documentation for the visitor module (#3944).

4.60.0

[pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

[filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

[cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

[varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,

varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,

varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,

varLib.avar.plan module moved from varLib.avarPlanner.

The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).

[interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).

[post] Speed up build_psNameMapping (#3923).

[ufoLib] Added typing annotations to fontTools.ufoLib (#3875).

4.59.2

[varLib] Clear USE_MY_METRICS component flags when inconsistent across masters (#3912).

[varLib.instancer] Avoid negative advance width/height values when instatiating HVAR/VVAR, (unlikely in well-behaved fonts) (#3918).

[subset] Fix shaping behaviour when pruning empty mark sets (#3915, harfbuzz/harfbuzz#5499).

[cu2qu] Fixed dot() product of perpendicular vectors not always returning exactly 0.0 in all Python implementations (#3911)

[varLib.instancer] Implemented fully-instantiating avar2 fonts (#3909).

[feaLib] Allow float values in VariableScalar's axis locations (#3906, #3907).

[cu2qu] Handle special case in calc_intersect for degenerate cubic curves where 3 to 4 control points are equal (#3904).

4.59.1

[featureVars] Update OS/2.usMaxContext if possible after addFeatureVariationsRaw (#3894).

[vhmtx] raise TTLibError('not enough data...') when hmtx/vmtx are truncated (#3843, #3901).

[feaLib] Combine duplicate features that have the same set of lookups regardless of the order in which those lookups are added to the feature (#3895).

[varLib] Deprecate varLib.mutator in favor of varLib.instancer. The latter provides equivalent full (static font) instancing in addition to partial VF instancing.
CLI users should replace fonttools varLib.mutator with fonttools varLib.instancer. API users should migrate to fontTools.varLib.instancer.instantiateVariableFont (#2680).

4.59.0

Removed hard-dependency on pyfilesystem2 (fs package) from fonttools[ufo] extra. This is replaced by the fontTools.misc.filesystem package, a stdlib-only, drop-in replacement for the subset of the pyfilesystem2's API used by fontTools.ufoLib. The latter should continue to work with the upstream fs (we even test with/without). However, clients who wish to continue using fs can do so by depending on it directly instead of via the fonttools[ufo] extra (#3885, #3620).

[xmlWriter] Replace illegal XML characters (e.g. control or non-characters) with "?" when dumping to ttx (#3868, #71).

[varLib.hvar] Fixed vertical metrics fields copy/pasta error (#3884).

Micro optimizations in ttLib and sstruct modules (#3878, #3879).

[unicodedata] Add Garay script to RTL_SCRIPTS (#3882).

... (truncated)

Changelog

Sourced from fonttools's changelog.

4.60.2 (released 2025-12-09)

Backport release Same as 4.61.0 but without "Drop support for EOL Python 3.9" change to allow downstream projects still on Python 3.9 to avail of the security fix for CVE-2025-66034 (#3994, #3999).

4.61.0 (released 2025-11-28)

[varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.

[feaLib] Sort BaseLangSysRecords by tag (#3986).

Drop support for EOL Python 3.9 (#3982).

[instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).

[CFF2ToCFF] Add --remove-overlaps option (#3976).

[feaLib] Raise an error for rsub with NULL target (#3979).

[bezierTools] Fix logic bug in curveCurveIntersections (#3963).

[feaLib] Error when condition sets have the same name (#3958).

[cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).

[unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1 (released 2025-09-29)

[ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).

[ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).

[subset] Don't try to subset BASE table; pass it through by default instead (#3949).

[subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).

[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).

[subset] Remove duplicate features when subsetting (#3945).

[Docs] Added documentation for the visitor module (#3944).

4.60.0 (released 2025-09-17)

[pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

[filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

[cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

[varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,

varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,

... (truncated)

Commits

78ba5e8 Release 4.60.2
c3f9979 macos-13 runner is no more, use macos-15-intel
8016403 Revert "Merge pull request #3982 from fonttools/drop-py39"
e691e3b Release 4.61.0
c2d540f Update NEWS.rst
3859753 Update NEWS.rst
26eb070 black
5ff73af Merge commit from fork
a696d5b varLib: only use the basename(vf.filename)
b00bc45 varLib_test: test path traversal in variable-font filename
Additional commits viewable in compare view

Updates cryptography from 42.0.8 to 48.0.1

Changelog

Sourced from cryptography's changelog.

48.0.1 - 2026-06-09
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.
.. _v48-0-0:
48.0.0 - 2026-05-04
BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

Added support for :doc:/hazmat/primitives/asymmetric/mlkem and :doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

47.0.0 - 2026-04-24
* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table> 

... (truncated)

Commits

de987ce 48.0.1 version bump and changelog (#14996)
8e03e30 bump for 48.0.0 release (#14796)
295e0d2 Add AGENTS.md with CLAUDE.md symlink (#14794)
104a2de Bump BoringSSL, OpenSSL, AWS-LC in CI (#14793)
67ec1e5 call check_length early on AesSiv::encrypt (#14792)
b2da57a changelog for mldsa/mlkem for openssl (#14791)
3cf44ad ML-KEM OpenSSL support (#14781)
2e31639 ML-DSA OpenSSL support (#14773)
5affe5a fix rust nightly clippy (#14790)
2e73ca4 bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (#1...
Additional commits viewable in compare view

Updates pillow from 10.4.0 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]

Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]

Update Python versions #9515 [@radarhere]

Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]

Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]

Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]

Merge PFM documentation into PPM #9434 [@radarhere]

Update macOS tested Pillow versions #9431 [@radarhere]

Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]

Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]

Update libpng to 1.6.56 #9499 [@radarhere]

Update freetype to 2.14.3 #9485 [@radarhere]

Updated libavif to 1.4.1 #9479 [@radarhere]

Updated harfbuzz to 13.2.1 #9461 [@radarhere]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Update harfbuzz to 13.0.1 #9453 [@radarhere]

Update libavif to 1.4.0 #9460 [@radarhere]

Update freetype to 2.14.2 #9449 [@radarhere]

Update actions/download-artifact action to v8 #9451 [@renovate[bot]]

Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]

Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]

Enable colour in CI logs #9486 [@hugovk]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Simplify TGA test code #9477 [@radarhere]

Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]

Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]

Add check-case-conflict hook #9446 [@radarhere]

Specify platform when pulling docker image #9440 [@radarhere]

GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]

Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]

Check all allocs in the Arrow tree #9488 [@wiredfool]

Reject non-numeric elements inside list coords #9526 [@hugovk]

Move variable declaration inside define #9525 [@radarhere]

... (truncated)

Changelog

Sourced from pillow's changelog.

Changelog (Pillow)

11.1.0 and newer

See GitHub Releases:

https://github.com/python-pillow/Pillow/releases

11.0.0 (2024-10-15)

Update licence to MIT-CMU #8460 [hugovk]

Conditionally define ImageCms type hint to avoid requiring core #8197 [radarhere]

Support writing LONG8 offsets in AppendingTiffWriter #8417 [radarhere]

Use ImageFile.MAXBLOCK when saving TIFF images #8461 [radarhere]

Do not close provided file handles with libtiff when saving #8458 [radarhere]

Support ImageFilter.BuiltinFilter for I;16* images #8438 [radarhere]

Use ImagingCore.ptr instead of ImagingCore.id #8341 [homm, radarhere, hugovk]

Updated EPS mode when opening images without transparency #8281 [Yay295, radarhere]

Use transparency when combining P frames from APNGs #8443 [radarhere]

Support all resampling filters when resizing I;16* images #8422 [radarhere]

Free memory on early return #8413 [radarhere]

Cast int before potentially exceeding INT_MAX #8402 [radarhere]

... (truncated)

Commits

3c41c09 12.2.0 version bump
cdaa29e Check calloc return value (#9527)
585b2f5 Check calloc return value
ecf011e Check all allocs in the Arrow tree (#9488)
cf6de8c Reject non-numeric elements inside list coords (#9526)
ffdcede Update 12.2.0 release notes (#9522)
7929d77 Added security release notes (#149)
c4f7aa5 Added security release notes
22cdb5f Move variable declaration inside define (#9525)
fc15b3b Resize tall images vertically first (#9524)
Additional commits viewable in compare view

Updates fonttools from 4.53.0 to 4.60.2

Release notes

Sourced from fonttools's releases.

4.60.2

Backport release Same as 4.61.0 but without "Drop support for EOL Python 3.9" change to allow downstream projects still on Python 3.9 to avail of the security fix for CVE-2025-66034 (#3994, #3999).

4.60.1

[ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).

[ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).

[subset] Don't try to subset BASE table; pass it through by default instead (#3949).

[subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).

[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).

[subset] Remove duplicate features when subsetting (#3945).

[Docs] Added documentation for the visitor module (#3944).

4.60.0

[pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

[filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

[cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

[varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,

varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,

varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,

varLib.avar.plan module moved from varLib.avarPlanner.

The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).

[interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).

[post] Speed up build_psNameMapping (#3923).

[ufoLib] Added typing annotations to fontTools.ufoLib (#3875).

4.59.2

[varLib] Clear USE_MY_METRICS component flags when inconsistent across masters (#3912).

[varLib.instancer] Avoid negative advance width/height values when instatiating HVAR/VVAR, (unlikely in well-behaved fonts) (#3918).

[subset] Fix shaping behaviour when pruning empty mark sets (#3915, harfbuzz/harfbuzz#5499).

[cu2qu] Fixed dot() product of perpendicular vectors not always returning exactly 0.0 in all Python implementations (#3911)

[varLib.instancer] Implemented fully-instantiating avar2 fonts (#3909).

[feaLib] Allow float values in VariableScalar's axis locations (#3906, #3907).

[cu2qu] Handle special case in calc_intersect for degenerate cubic curves where 3 to 4 control points are equal (#3904).

4.59.1

[featureVars] Update OS/2.usMaxContext if possible after addFeatureVariationsRaw (#3894).

[vhmtx] raise TTLibError('not enough data...') when hmtx/vmtx are truncated (#3843, #3901).

[feaLib] Combine duplicate features that have the same set of lookups regardless of the order in which those lookups are added to the feature (#3895).

[varLib] Deprecate varLib.mutator in favor of varLib.instancer. The latter provides equivalent full (static font) instancing in addition to partial VF instancing.
CLI users should replace fonttools varLib.mutator with fonttools varLib.instancer. API users should migrate to fontTools.varLib.instancer.instantiateVariableFont (#2680).

4.59.0

Removed hard-dependency on pyfilesystem2 (fs package) from fonttools[ufo] extra. This is replaced by the fontTools.misc.filesystem package, a stdlib-only, drop-in replacement for the subset of the pyfilesystem2's API used by fontTools.ufoLib. The latter should continue to work with the upstream fs (we even test with/without). However, clients who wish to continue using fs can do so by depending on it directly instead of via the fonttools[ufo] extra (#3885, #3620).

[xmlWriter] Replace illegal XML characters (e.g. control or non-characters) with "?" when dumping to ttx (#3868, #71).

[varLib.hvar] Fixed vertical metrics fields copy/pasta error (#3884).

Micro optimizations in ttLib and sstruct modules (#3878, #3879).

[unicodedata] Add Garay script to RTL_SCRIPTS (#3882).

... (truncated)

Changelog

Sourced from fonttools's changelog.

4.60.2 (released 2025-12-09)

Backport release Same as 4.61.0 but without "Drop support for EOL Python 3.9" change to allow downstream projects still on Python 3.9 to avail of the security fix for CVE-2025-66034 (#3994, #3999).

4.61.0 (released 2025-11-28)

[varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.

[feaLib] Sort BaseLangSysRecords by tag (#3986).

Drop support for EOL Python 3.9 (#3982).

[instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).

[CFF2ToCFF] Add --remove-overlaps option (#3976).

[feaLib] Raise an error for rsub with NULL target (#3979).

[bezierTools] Fix logic bug in curveCurveIntersections (#3963).

[feaLib] Error when condition sets have the same name (#3958).

[cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).

[unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1 (released 2025-09-29)

[ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).

[ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).

[subset] Don't try to subset BASE table; pass it through by default instead (#3949).

[subset] Remove empty BaseRecord entries in MarkBasePos ...
Description has been truncated

Bumps the pip group with 3 updates in the /under devoplment directory: [cryptography](https://github.com/pyca/cryptography), [pillow](https://github.com/python-pillow/Pillow) and [fonttools](https://github.com/fonttools/fonttools). Bumps the pip group with 3 updates in the /under devoplment/Docker directory: [cryptography](https://github.com/pyca/cryptography), [pillow](https://github.com/python-pillow/Pillow) and [fonttools](https://github.com/fonttools/fonttools). Bumps the pip group with 3 updates in the /under devoplment/New folder directory: [cryptography](https://github.com/pyca/cryptography), [pillow](https://github.com/python-pillow/Pillow) and [fonttools](https://github.com/fonttools/fonttools). Updates `cryptography` from 42.0.8 to 48.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@42.0.8...48.0.1) Updates `pillow` from 10.4.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@10.4.0...12.2.0) Updates `fonttools` from 4.53.0 to 4.60.2 - [Release notes](https://github.com/fonttools/fonttools/releases) - [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst) - [Commits](fonttools/fonttools@4.53.0...4.60.2) Updates `cryptography` from 42.0.8 to 48.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@42.0.8...48.0.1) Updates `pillow` from 10.4.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@10.4.0...12.2.0) Updates `fonttools` from 4.53.0 to 4.60.2 - [Release notes](https://github.com/fonttools/fonttools/releases) - [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst) - [Commits](fonttools/fonttools@4.53.0...4.60.2) Updates `cryptography` from 42.0.8 to 48.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@42.0.8...48.0.1) Updates `pillow` from 10.4.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@10.4.0...12.2.0) Updates `fonttools` from 4.53.0 to 4.60.2 - [Release notes](https://github.com/fonttools/fonttools/releases) - [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst) - [Commits](fonttools/fonttools@4.53.0...4.60.2) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: fonttools dependency-version: 4.60.2 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: fonttools dependency-version: 4.60.2 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: fonttools dependency-version: 4.60.2 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 22, 2026

Navigation Menu

Repository navigation

Bump the pip group across 3 directories with 3 updates - #11

Bump the pip group across 3 directories with 3 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-1e56bd0c21

dependabot Bot commented on behalf of github Jun 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 22, 2026

12.2.0

Documentation

Dependencies

Testing

Other changes

Changelog (Pillow)

11.1.0 and newer

11.0.0 (2024-10-15)

4.60.2

4.60.1

4.60.0

4.59.2

4.59.1

4.59.0

4.60.2 (released 2025-12-09)

4.61.0 (released 2025-11-28)

4.60.1 (released 2025-09-29)

4.60.0 (released 2025-09-17)

12.2.0

Documentation

Dependencies

Testing

Other changes

Changelog (Pillow)

11.1.0 and newer

11.0.0 (2024-10-15)

4.60.2

4.60.1

4.60.0

4.59.2

4.59.1

4.59.0

4.60.2 (released 2025-12-09)

4.61.0 (released 2025-11-28)

4.60.1 (released 2025-09-29)

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants