Skip to content

build(deps): bump the python-deps group with 2 updates - #35

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-deps-ec1ccfbfef
Open

build(deps): bump the python-deps group with 2 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-deps-ec1ccfbfef

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-deps group with 2 updates: ruff and fonttools.

Updates ruff from 0.16.5 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

Commits

Updates fonttools from 4.63.0 to 4.64.0

Release notes

Sourced from fonttools's releases.

4.64.0

  • [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
  • [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
  • [subset] Keep East Asian spacing palt by default (#4094).
  • [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
  • [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
  • [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
  • [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
  • [ttLib] Add support for TrueType Collection version 2 (#4100).
  • [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
  • [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
  • [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
  • [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
  • [misc.roundTools] Add types and documentation (#4123).
  • [varLib.instancer] Instance the BASE table (#4137).
  • [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
  • [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
  • [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
  • [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
  • [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
  • [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
  • [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
  • [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
  • [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
  • [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
  • [cmap] Don't drop subtables in unsupported formats when compiling or dumping a font read from binary (#4136).
  • [ttLib] Implement splitSinglePos so GPOS lookup type 1 offset overflows can be recovered by splitting the subtable (#4091, #4108).
  • [cmap] Round-trip empty Macintosh format 2 subtables (#3663, #4117).
  • [glyf] Raise TTLibError instead of RecursionError when recalcBounds() hits a composite-component reference cycle (#3899, #4116).
  • [svgLib] Fix crash parsing an SVG path with consecutive closepath commands (Z Z) (#4122).
  • [ttLib] Fix DefaultTable type annotations (#4126).
  • [ttLib] Add support for the EBSC (Embedded Bitmap Scaling) table (#4113).
  • [svgLib] Suppress spurious close segments caused by floating-point drift in relative path commands (#3860, #4127).
  • [qu2cu] Fix TypeError in the Cython-compiled build when Qu2CuPen passes tuple splines (#4160).
  • [mort] Add semantic decompilation, TTX, and compilation support for rearrangement, contextual-substitution, ligature, and insertion subtables (#4158, #4159, #4161).
  • [svgLib] Start a new subpath at the just-closed subpath's initial point when a drawto command follows a closepath, per SVG spec (#4154, #4155).
  • [misc.filesystem] SECURITY Reject paths that resolve outside the filesystem root: a malicious UFO could read arbitrary files via .. components in contents.plist, and a crafted .ufoz could create files outside its temporary mirror (#4124).
  • [ttLib] SECURITY Sanitise glyph names used as filenames in EBDT/CBDT ttx -z extfile export, preventing arbitrary file writes from untrusted fonts (#4128).
  • [misc.etree] SECURITY Don't resolve external XML entities in XMLParser when lxml is used, preventing XXE file disclosure on lxml < 5.0 (#4145).
  • [subset] Fully prune VARC auxiliary data: collect and remap variation indices referenced by condition tables when subsetting the MultiVarStore, and drop the AxisIndicesList, ConditionList, and MultiVarStore when they end up empty (#4162).
Changelog

Sourced from fonttools's changelog.

4.64.0 (released 2026-08-31)

  • [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
  • [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
  • [subset] Keep East Asian spacing palt by default (#4094).
  • [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
  • [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
  • [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
  • [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
  • [ttLib] Add support for TrueType Collection version 2 (#4100).
  • [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
  • [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
  • [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
  • [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
  • [misc.roundTools] Add types and documentation (#4123).
  • [varLib.instancer] Instance the BASE table (#4137).
  • [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
  • [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
  • [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
  • [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
  • [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
  • [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
  • [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
  • [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
  • [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
  • [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
  • [cmap] Don't drop subtables in unsupported formats when compiling or dumping a

... (truncated)

Commits
  • 37dfa71 Release 4.64.0
  • 5cab496 Update NEWS.rst [skip ci]
  • 6f1429b [subset] Fully prune VARC auxiliary data (#4162)
  • 93fc470 Merge pull request #4145 from insaf021/etree-no-external-entities
  • 1ce6993 [misc.etree] only override resolve_entities on lxml < 5.0
  • 9c10287 Merge pull request #4128 from insaf021/ebdt-extfile-basename
  • 53e2b0b [E_B_D_T_] don't let sanitised glyph names collide
  • 3bbd268 Merge pull request #4124 from insaf021/osfs-path-containment
  • 6840516 [misc.filesystem] simplify containment check, pin symlink strictness
  • 8f4b4ee [misc.filesystem] don't publish a half-built zip directory mirror
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the python-deps group with 2 updates
90e862e 
Bumps the python-deps group with 2 updates: [ruff](https://github.com/astral-sh/ruff) and [fonttools](https://github.com/fonttools/fonttools).


Updates `ruff` from 0.16.5 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.5...0.16.6)

Updates `fonttools` from 4.63.0 to 4.64.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.63.0...4.64.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: fonttools
  dependency-version: 4.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 12, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcohost33-maker marcohost33-maker Awaiting requested review from marcohost33-maker marcohost33-maker is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants