Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package librsvg for openSUSE:Factory checked in at 2026-10-30 18:09:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/librsvg (Old) and /work/SRC/openSUSE:Factory/.librsvg.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "librsvg" Fri Oct 30 18:09:10 2026 rev:160 rq:1392418 version:2.63.4 Changes: -------- --- /work/SRC/openSUSE:Factory/librsvg/librsvg.changes 2026-09-24 22:55:55.950380511 +0200 +++ /work/SRC/openSUSE:Factory/.librsvg.new.1255/librsvg.changes 2026-10-30 18:12:26.683630069 +0100 @@ -1,0 +2,94 @@ +Sat Oct 24 17:20:23 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 2.63.4: + * Handle EXIF orientation in images, and handle the image-orientation + property. Note that the only values supported for this property are + 'from-image' (the default) and 'none'. Note that this will change the + rendering of SVG documents which assume the images with EXIF orientation + data are not auto-oriented correctly. In this case, please add the + following attribute to the corresponding image elemnts: + style="image-orientation: none;" + +------------------------------------------------------------------- +Sat Oct 17 10:09:25 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 2.63.3: + * Librsvg-rebind crate version 0.3.0: + * Let the image-rs crate enforce its default limit of 512 MB for allocated + memory for each decoded image. The `--unlimited` flag in rsvg-convert (or + the corresponding flags in the C and Rust APIs) now control whether the + limits are enforced or not. + * Fix panic when a feConvolveMatrix declaration has an invalid size. + * When fuzzing, don't decode raster images from data: URIs to avoid sinking + fuzz time in the image-rs crate. +- Update version dependencies according to meson.build. + +------------------------------------------------------------------- +Wed Sep 23 16:13:13 CEST 2026 - Bjørn Lie <[email protected]> + +- Update to version 2.63.2 (RUSTSEC-2026-0305 / CVE-2026-96889): + + librsvg crate version 2.63.2 + + librsvg-rebind crate version 0.3.0 + + Fix use-after-free when there are duplicate XML entities in + nested Xinclude documents. +- Changes from version 2.63.1: + + This version is to be considered non-working; the chacha20 + 0.10.1 crate was yanked from crates.io. + +------------------------------------------------------------------- +Wed Sep 23 16:13:12 CEST 2026 - Bjørn Lie <[email protected]> + +- Update to version 2.63.0: + + librsvg crate version 2.63.0 + + librsvg-rebind crate version 0.3.0 + + Limit the depth of files that reference other files, via XML + XInclude, inter-document references, and CSS includes. The Rust + API has a new + ImplementationLimit::MaximumFileNestingDepthExceeded error + variant to surface this to the loading functions. + + Fix blurry embeded SVG images by rasterizing them at device + resolution. + + Remove loading limits from image-rs. This means that raster + images, when embedded in SVG documents, have no limits for + their size or memory consumption. The idea, for now, is that + security-sensitive applications that use librsvg should do + their own sandboxing if they want to impose memory limits. + + Raise the maximum nesting depth of layers for glibc systems. + The maximum on glibc is now 500 nested layers; the maximum for + musl systems remains at 50 layers. This is due to the amount of + stack space required, since musl has a reduced default stack + compared to glibc. Please see the comments in that bug if you + would like to help with the musl situation. +- Disable bug1100_fuzz_layer_nesting_depth test and enable + svg1_1_text_text_03_b_svg test again. + +------------------------------------------------------------------- +Wed Sep 23 16:13:11 CEST 2026 - Bjørn Lie <[email protected]> + +- Update to version 2.62.91: + + librsvg crate version 2.63.0-beta.1 + + librsvg-rebind crate version 0.3.0 + + Update test suite for change in how Pango renders + underline/overline. + + Update Rust dependencies. + + Update C dependencies in the CI. +- No longer disable librsvg --test reference. + +------------------------------------------------------------------- +Wed Sep 23 16:13:10 CEST 2026 - Bjørn Lie <[email protected]> + +- Update to version 2.62.90: + + librsvg crate version 2.63.0-beta.0 + + Limit the depth of files that reference other files, via XML + XInclude, inter-document references, and CSS includes. The Rust + API has a new + ImplementationLimit::MaximumFileNestingDepthExceeded error + variant to surface this to the loading functions. + + Fix blurry embeded SVG images by rasterizing them at device + resolution. + + Fix build when gobject-introspection is enabled but gdk-pixbuf + is disabled. + + Document the crate's feature flags. + + Update the Rust dependencies. + +------------------------------------------------------------------- @@ -3053,0 +3148 @@ + Old: ---- librsvg-2.62.4.tar.xz New: ---- librsvg-2.63.4.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ librsvg.spec ++++++ --- /var/tmp/diff_new_pack.BxZjKu/_old 2026-10-30 18:12:30.512790365 +0100 +++ /var/tmp/diff_new_pack.BxZjKu/_new 2026-10-30 18:12:30.517790574 +0100 @@ -20,7 +20,7 @@ %define librsvg_sover 2 Name: librsvg -Version: 2.62.4 +Version: 2.63.4 Release: 0 Summary: A Library for Rendering SVG Data License: LGPL-2.1-or-later AND MIT @@ -38,20 +38,20 @@ BuildRequires: python3-docutils BuildRequires: vala BuildRequires: pkgconfig(cairo) >= 1.18.0 -BuildRequires: pkgconfig(cairo-png) >= 1.2.0 -BuildRequires: pkgconfig(dav1d) +BuildRequires: pkgconfig(cairo-png) >= 1.18.0 +BuildRequires: pkgconfig(dav1d) >= 1.3.0 BuildRequires: pkgconfig(fontconfig) BuildRequires: pkgconfig(freetype2) >= 20.0.14 BuildRequires: pkgconfig(gdk-pixbuf-2.0) >= 2.20 BuildRequires: pkgconfig(gi-docgen) -BuildRequires: pkgconfig(gio-2.0) >= 2.24.0 +BuildRequires: pkgconfig(gio-2.0) >= 2.50.0 BuildRequires: pkgconfig(gio-unix-2.0) BuildRequires: pkgconfig(glib-2.0) >= 2.50.0 -BuildRequires: pkgconfig(gmodule-2.0) +BuildRequires: pkgconfig(gmodule-2.0) >= 2.50.0 BuildRequires: pkgconfig(gthread-2.0) >= 2.12.0 BuildRequires: pkgconfig(libxml-2.0) >= 2.9.0 -BuildRequires: pkgconfig(pangocairo) >= 1.46.0 -BuildRequires: pkgconfig(pangoft2) >= 1.46.0 +BuildRequires: pkgconfig(pangocairo) >= 1.50.0 +BuildRequires: pkgconfig(pangoft2) >= 1.50.0 # Avoid cycle: we do not require the adwaita-icon-theme to be present. libgtk-3.0 requires this for end users #!BuildIgnore: adwaita-icon-theme @@ -129,7 +129,7 @@ export LANG=C %ifnarch %{ix86} %{arm} %{cargo_test} -- \ - --skip svg1_1_text_text_03_b_svg + --skip bug1100_fuzz_layer_nesting_depth %endif %files -n librsvg-2-%{librsvg_sover} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.BxZjKu/_old 2026-10-30 18:12:30.657796435 +0100 +++ /var/tmp/diff_new_pack.BxZjKu/_new 2026-10-30 18:12:30.664796728 +0100 @@ -1,7 +1,7 @@ -mtime: 1790060009 -commit: 2760c63b7564b68873421ff4f1b5d60a5dd9c27edabeb6e4c3dcca9511631676 +mtime: 1792862705 +commit: 43361a50fbec88d946b492b72f8a21abb418a1008b7a2757e6a00a35834dbdb1 url: https://src.opensuse.org/GNOME/librsvg -revision: 2760c63b7564b68873421ff4f1b5d60a5dd9c27edabeb6e4c3dcca9511631676 +revision: 43361a50fbec88d946b492b72f8a21abb418a1008b7a2757e6a00a35834dbdb1 trackingbranch: factory projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj ++++++ _service ++++++ --- /var/tmp/diff_new_pack.BxZjKu/_old 2026-10-30 18:12:30.721799114 +0100 +++ /var/tmp/diff_new_pack.BxZjKu/_new 2026-10-30 18:12:30.726799324 +0100 @@ -3,7 +3,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://gitlab.gnome.org/GNOME/librsvg.git</param> <param name="scm">git</param> - <param name="revision">2.62.4</param> + <param name="revision">2.63.4</param> <param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param> <param name="versionrewrite-pattern">(.*)\+0</param> <param name="versionrewrite-replacement">\1</param> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-24 19:25:05.000000000 +0200 @@ -0,0 +1,5 @@ +*.obscpio +*.osc +_build.* +.pbuild +osc-collab.* ++++++ librsvg-2.62.4.tar.xz -> librsvg-2.63.4.tar.xz ++++++ /work/SRC/openSUSE:Factory/librsvg/librsvg-2.62.4.tar.xz /work/SRC/openSUSE:Factory/.librsvg.new.1255/librsvg-2.63.4.tar.xz differ: char 15, line 1 ++++++ librsvg.obsinfo ++++++ --- /var/tmp/diff_new_pack.BxZjKu/_old 2026-10-30 18:12:31.228820339 +0100 +++ /var/tmp/diff_new_pack.BxZjKu/_new 2026-10-30 18:12:31.236820674 +0100 @@ -1,5 +1,5 @@ name: librsvg -version: 2.62.4 -mtime: 1790043444 -commit: 6ae003b048b3fefc5df770b71719d3bd2635e86c +version: 2.63.4 +mtime: 1792791060 +commit: 0c074d0a25adefd65843067306f9bc1fb609f68f ++++++ vendor.tar.xz ++++++ /work/SRC/openSUSE:Factory/librsvg/vendor.tar.xz /work/SRC/openSUSE:Factory/.librsvg.new.1255/vendor.tar.xz differ: char 15, line 1
