Update dependency fonttools to v4.68.0 by renovate[bot] · Pull Request #688 · joseguzman1337/offensive-security

renovate · 2026-08-31T15:57:50Z

This PR contains the following updates:

Package	Change	Age	Confidence
fonttools	`==4.63.0` → `==4.68.0`

Release Notes

fonttools/fonttools (fonttools)

`v4.68.0`

Compare Source

[feaLib] Escape " and \ when writing names back out with asFea() in FeatureNameStatement, STATNameStatement and CVParametersNameStatement (#4321).
[scaleUpem] Also scale the MATH lengths that are not MathValueRecords (DelimitedSubFormulaMinHeight, DisplayOperatorMinHeight, MinConnectorOverlap, etc.) (#4327).
[cffLib] Inherit the initial CFF2 vsindex from the Private DICT when decompiling, specializing and instancing charstrings, and fix programToCommands miscounting operands when several blend operators precede the first stem or moveto (#4337, #4339).
[instancer] Round CFF2 outlines and stem hints on absolute positions rather than per relative operand, and keep CFF2 Private DICT blend values at full precision until they are written back (#4338, #4341).
[cffLib] Preserve CFF2 Private DICT arrays that use more than one blend group (#4346).
[feaLib] Raise FeatureLibError instead of looping forever on an unclosed OS/2, BASE or STAT table block (#4347).
[designspaceLib] When a variable font overrides some public.fontInfo keys, merge them with the root-level font info instead of replacing it (#4336, #4340).
[instancer] Raise an error for FeatureVariations conditions of a format other than the supported axis-range one, instead of silently dropping them (#4348).
[filesystem] Don't overwrite an unrelated sibling .zip when writing a .ufoz or other non-.zip archive (#4342).
[glyf] Fix exponential running time on composite glyphs that reuse the same component at several nesting levels; getCoordinates now raises TTLibError past 65535 composite points (#4325).
[ttLib] Add support for the beyond-64k tables of the final ISO Open Font Format 5th edition: uppercase companion tables (GLYF, GVAR, HMTX, GSUB/GPOS extended layout, FeatureVariations 1.1, TTC 1.1/2.1, DMAP), a ttLib.beyond64k module and CLI, and support in FontBuilder, merge, subset, instancer, qu2cu, removeOverlaps and scaleUpem (#4097, #2678).
[VARC] Keep addVarComponent() locations sparse, passing RESET_UNSPECIFIED_AXES via a new keyword-only resetUnspecifiedAxes pen argument (#4349).
[woff] Require brotli >= 1.2.1 and brotlicffi >= 1.2.1.0, which fix GHSA-9v8h-qqgm-4m35 (#4365, #4370).
Build Windows ARM64 wheels (#4366).
[instancer] Fix AttributeError: ElidedFallbackNameID when updating font names of a font with a version 1.0 STAT table; fall back to the subfamily name (#2933, #4371).

`v4.67.0`

Compare Source

[varLib] Support decreasing design-space axis mappings, via a new keyword-only allow_decreasing argument to models.normalizeValue (#3970, #4217, #4243).
[designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes on an <axis-subset> are taken from the parent axis, as the spec says (#4205).
[designspaceLib] Fix DesignSpaceDocument.normalize() for mapped axes: axis bounds and rule conditions are now normalized from their original values (#4218).
[designspaceLib] splitInterpolable and splitVariableFonts now warn when a source or instance is dropped because it lies outside the document's own axes, instead of silently discarding it (#4244).
[varLib.instancer] Add support for instancing variable COLRv1 fonts (#2699, #4279).
[varLib.instancer] Apply VVAR vertical-origin deltas to VORG, and use OpenType rounding for instanced advances and vertical origins (#4221).
[varLib.instancer] Keep a universal FeatureVariations record when pinning removes its last condition but other axes remain (#4247).
[varLib.instancer] Preserve ppem Device corrections in GDEF, BASE, GPOS and JSTF instead of asserting on them (#4290).
[varLib.instancer] Allow requesting an axis's original range on VARC fonts (#4280).
[varLib.instancer, subset] Fold, remove or remap MATH VariationIndex devices when instancing, subsetting the GDEF store or optimizing it (#4288).
[varLib] Raise ValueError: Missing required table fvar from varLib.mutator and the instancer CLI on a static font, instead of a bare KeyError (#3751, #4300).
[featureVars] When adding rvrn, also shift lookup indices inside existing FeatureVariations (#4233). Handle null ConditionSet and FeatureTableSubstitution offsets when building, subsetting and instancing (#4234, #4235). Keep FeatureTableSubstitution records sorted after merging new ones into an existing record (#4248).
[ttLib] Fix FeatureParams (size, ssXX, cvXX) in FeatureVariations alternate feature tables, which failed to compile and round-trip (#3623, #4278).
[ttLib] Fully decode lazily loaded ligatures, SinglePos and PairPos arrays during recursive decompilation, so reorderGlyphs() on a lazy font no longer corrupts or asserts on them (#4231, #4232).
[VARC] Update the variation-store binary format to follow harfbuzz/boring-expansion-spec#175: SparseVarRegionList.RegionCount is uint32, sparse axes use Offset32 and MultiVarData items are stored in an INDEX. VARC fonts built with earlier fontTools versions must be rebuilt (#4219).
[VARC] Several fixes: derive component conditions from conditionIndex (#4237), set the implicit scaleY when importing XML (#4238), report the font's current coordinates for components that reset unspecified axes (#4239), and keep inherited coordinates when drawing CFF2 VARC components (#4236).
[varLib] buildMultiVarData accepts flattened per-region vector tuples (#4245).
[otConverters] Bounds-check CFF2 INDEX count and offSize on read, raising TTLibError instead of allocating huge lazy lists (#4220).
[ttLib] Handle empty packed deltas when OPTIMIZE_FONT_SPEED is set (#4241).
[scaleUpem] Scale per-glyph VORG origins (#4222); fix VARC scaling for static fonts and condition variations (#4223); don't mutate the shared default CFF FontMatrix (#4251, #4252).
[cmap] Fix format 2 compilation when all codes are single-byte (#1524, #4211) or all single-byte codes map to .notdef (#4215). Formats 2 and 4 now reject glyph IDs above 65535 instead of wrapping them (#4226). Split format 14 default UVS ranges longer than 256 codepoints (#4229). Empty format 12 and 13 subtables round-trip (#4246).
[glyf] Use unsigned instruction lengths, so programs of 32768-65535 bytes compile and decompile correctly (#4227). Keep instructions in zero-contour glyphs (#4228).
[pens] Fix cubic off-curve detection in TTGlyphPointPen across contour starts (#4224). Glyph.drawPoints() now raises NotImplementedError for an all-off-curve cubic contour, which the point pen protocol cannot express (#3191, #4225). RoundingPen passes the all-off-curve None sentinel through (#4311, #4312).
[CFF2] Preserve operands when a blend has zero regions (#4240).
[cffLib] Read CFF font names as Latin-1, matching how they are written (#4253). Deleting a CFF dict attribute now actually removes it (#2725, #4264).
[CFF2ToCFF] Fix conversion of fonts with local subroutines (#4258). A CFF2 table with a single FontDict is now converted to a name-keyed CFF font that keeps its glyph names (#3890, #4265).
[subset] Handle a null GDEF variation store (#4230).
[merge] Support merging fonts that both have a MATH table (#3823, #4257).
[feaLib] Reject the same mark class used twice in one anchor list (#3628, #4255). Don't crash on value records whose devices are all NULL (#2396, #4261). Pad a short OS/2 Vendor with spaces (#4259).
[feaLib] Raise FeatureLibError with a location, instead of a bare Python error, for: a BASE script list without a matching tag list (#4263), a UnicodeRange bit outside 0-127 (#4266), a name string that cannot be decoded (#4267), a STAT axis location with no or too many values (#4268), and a non-ASCII OS/2 Vendor (#4269).
[name] Fix the BCP 47 tags of some Mac and Windows language IDs, e.g. es was mapped to Mac Estonian (#3733, #4256). getDebugName prefers the Windows English name over the Mac one (#3969, #4273).
[post] Don't crash on a format 2.0 table with numGlyphs set to 0 (#3060, #4274).
[VDMX] Recompute numRecs and numRatios when compiling (#4293).
[Silf] Fix compiling a Silf table that was decompiled from binary (#4294).
[woff2] Preserve minorVersion when copying flavor data (#4249, #4250).
[ttGlyphSet] Compute glyph width lazily for glyf variable fonts without HVAR, so .width is correct before drawing (#3964, #4260).
[varLib.interpolatable] Respect designspace source layers (#3951, #4275); fix --json output with SciPy (#3870, #4276).
[misc.psLib] Fix tokenizing of escaped parentheses in PostScript strings (#4207).
[svgLib] Raise ValueError instead of IndexError on a truncated path command (#4254).
[misc.transform] Preserve the direction of the remaining axis when decomposing a transform whose first column is zero (#4242).
[misc.textTools] Tag.__ne__ returns NotImplemented for unsupported types (#4305, #4306).
[misc.dictTools] hashdict rejects in-place union (|=) (#4313, #4314).
[misc.xmlReader] Close owned input streams when parsing fails (#4298).
[misc.filesystem] WriteZipFS.close() can be called more than once (#4309, #4310).
[EBDT] Keep EBDT/CBDT glyph metrics after probing a missing attribute (#3806, #4216).

`v4.66.1`

Compare Source

[designspaceLib] When splitting a DesignSpace v5 document with makeNames=True (as varLib.build_many does), family and style names set explicitly on an instance now take precedence over the ones computed from the STAT labels, in all languages, and a PostScript name is no longer made up from the labels for an instance that has its own style name (#3131, #4206, #4208).
[cmap] Decompiling a format 4 subtable whose idRangeOffset points outside glyphIndexArray now raises TTLibError. A negative index used to silently map the code point to the wrong glyph, and one past the end raised a bare AssertionError (#4209).
[cmap] Fix compiling a format 2 subtable when the lowest glyph ID in a lead-byte row is 32768 or higher, which failed with struct.error (#4210).

`v4.66.0`

Compare Source

Drop support for EOL Python 3.10; fontTools now requires Python 3.11 or later. fontTools.misc.enumTools now only re-exports enum.StrEnum and is deprecated. Explicitly test and declare support for Python 3.15 (#4183, #4196).
[unicodedata] Update the bundled script, script extension, block and bidi-mirroring tables to Unicode 18.0.0, and require unicodedata2 18.0.0 when it is used (#4192, #4197).
[feaLib] Support language statements listing multiple language tags, e.g. language AZE CRT;, as Glyphs does and as proposed for the spec (adobe-type-tools/feature_file_workshops#8): the following rules and lookup references are registered under every listed language. dflt cannot be combined with other tags. LanguageStatement.language is still the first tag; all of them are in the new languages attribute (#4201, #4202).
[feaLib] Fix lookups being dropped when a script/language pair is repeated within a feature block: the repeated statement replaced the language system's lookups with a fresh copy of the default ones (#4189).
[feaLib] Raise FeatureLibError instead of UnboundLocalError when a STAT table block lacks ElidedFallbackName or ElidedFallbackNameID (#3834, #4179).
[cffLib] Always recompile the CFF2 VarStore when saving. Previously the bytes compiled by an earlier save were reused, so a CFF2 variable font that was saved and then modified in place, e.g. by the instancer, was written with a stale VarStore next to its updated charstrings (#4199).
[ttLib] Support static VARC fonts that omit fvar while retaining gvar or CFF2 variation data for component-internal axes: hidden axes are addressed by index and gvar can compile, decompile and round-trip through TTX without fvar, reading the axis count from a new axisCount element (#4187, #4188).
[ttLib] Fix drawing VARC components whose condition is negated (format 5), which raised AttributeError (#4191).
[instancer] Fix VARC axis references left stale when removing an unrelated axis, reject pinning or restricting axes referenced by VARC components, and stop culling avar2 ranges for component-internal variations, which can reach outside the font-level ranges (#4190, #4193).
[bezierTools] Preserve exact endpoints in splitQuadraticAtT and splitCubicAtTC as well, like splitCubicAtT since 4.55.4 (#3742, #4194).
[bezierTools] Fix ZeroDivisionError in lineLineIntersections for collinear vertical lines; they are now treated as parallel like horizontal ones (#3515, #4181).
[subset] pyftsubset now preserves the input font's flavor (WOFF, WOFF2) when --flavor is omitted, instead of writing uncompressed sfnt data under the same extension; pass --flavor=none to force uncompressed output (#3630, #4182).
[merge] Report incompatible unitsPerEm values by name, with the input values, instead of a bare assertion (#2844, #4184).
[designspaceLib] Fix the type annotation and documentation of DesignSpaceDocument.default, which holds a SourceDescriptor, not a source name (#2994, #4186).
[ttLib.sfnt] Raise TTLibError instead of AssertionError for inconsistent WOFF table, metadata and private-data lengths, so the checks also hold under python -O (#4178).
[misc.etree] Disable entity resolution altogether on lxml >= 5.0 as well: lxml's resolve_entities="internal" still fetched external parameter entities before lxml 6.1.3, so a crafted DTD could read local files into parsed XML content (#4195).
[cmap] Bound the expansion of format 4 segments and format 12/13 groups when decompiling, like HarfBuzz does: groups are clamped to U+10FFFF, inverted or overlapping groups are skipped with a warning, and groups mapped to the missing glyph are not expanded. A crafted font could previously exhaust memory with a single group ending at 0xFFFFFFFF (#4204).
[varLib.avar] Escape axis names and tags when varLib.avar.unbuild emits its designspace snippet, so a crafted font cannot inject markup (#4203).

`v4.65.0`

Compare Source

[glyf] Add __iter__, items and values methods to the glyf table to make it more dict-like (#4156).
[feaLib] Escape the anonymous block tag when scanning for its terminator, so tags containing regex metacharacters are matched literally (#4167).
[varLib] Strip directory components from <variable-font name="..."/> when deriving the output filename in the varLib command line, so a designspace cannot write outside the output directory (#4168).
[feaLib] Fix tracking of the current script and language across redundant script statements. Rules following a script statement that names the first declared language system no longer end up under the DFLT script, and a script statement naming the already-current script still narrows the language systems and terminates the current lookup while leaving the lookupflag alone, matching makeotf (#1824, #2522, #4169).
[varLib.interpolatable] Escape glyph names in the HTML report (#4172).
[otlLib] Fix overflow handling when building contextual lookups: offset overflows now raise OTLOffsetOverflowError instead of AttributeError so another contextual format can be tried (regression from #3439). When all formats overflow, split the ruleset in halves until it fits (#4171).

`v4.64.0`

Compare Source

[feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
[ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
[subset] Keep East Asian spacing palt by default (#4094).
[subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
[ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
[glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
[ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
[ttLib] Add support for TrueType Collection version 2 (#4100).
[ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
[ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
[ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
[ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
[misc.roundTools] Add types and documentation (#4123).
[varLib.instancer] Instance the BASE table (#4137).
[varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
[varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
[sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
[misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
[varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
[feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
[cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
[designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
[designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
[colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
[cmap] Don't drop subtables in unsupported formats when compiling or dumping a font read from binary (#4136).
[ttLib] Implement splitSinglePos so GPOS lookup type 1 offset overflows can be recovered by splitting the subtable (#4091, #4108).
[cmap] Round-trip empty Macintosh format 2 subtables (#3663, #4117).
[glyf] Raise TTLibError instead of RecursionError when recalcBounds() hits a composite-component reference cycle (#3899, #4116).
[svgLib] Fix crash parsing an SVG path with consecutive closepath commands (Z Z) (#4122).
[ttLib] Fix DefaultTable type annotations (#4126).
[ttLib] Add support for the EBSC (Embedded Bitmap Scaling) table (#4113).
[svgLib] Suppress spurious close segments caused by floating-point drift in relative path commands (#3860, #4127).
[qu2cu] Fix TypeError in the Cython-compiled build when Qu2CuPen passes tuple splines (#4160).
[mort] Add semantic decompilation, TTX, and compilation support for rearrangement, contextual-substitution, ligature, and insertion subtables (#4158, #4159, #4161).
[svgLib] Start a new subpath at the just-closed subpath's initial point when a drawto command follows a closepath, per SVG spec (#4154, #4155).
[misc.filesystem] SECURITY Reject paths that resolve outside the filesystem root: a malicious UFO could read arbitrary files via .. components in contents.plist, and a crafted .ufoz could create files outside its temporary mirror (#4124).
[ttLib] SECURITY Sanitise glyph names used as filenames in EBDT/CBDT ttx -z extfile export, preventing arbitrary file writes from untrusted fonts (#4128).
[misc.etree] SECURITY Don't resolve external XML entities in XMLParser when lxml is used, preventing XXE file disclosure on lxml < 5.0 (#4145).
[subset] Fully prune VARC auxiliary data: collect and remap variation indices referenced by condition tables when subsetting the MultiVarStore, and drop the AxisIndicesList, ConditionList, and MultiVarStore when they end up empty (#4162).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

difflens · 2026-08-31T15:57:58Z

View changes in DiffLens

difflens · 2026-08-31T20:39:09Z

View changes in DiffLens

difflens · 2026-09-01T00:36:13Z

View changes in DiffLens

difflens · 2026-09-01T11:43:37Z

View changes in DiffLens

difflens · 2026-09-01T17:50:30Z

View changes in DiffLens

difflens · 2026-09-03T01:41:38Z

View changes in DiffLens

coderabbitai · 2026-09-10T18:11:38Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 59c1bd95-4e9c-42b0-bcae-a991038086c0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

difflens · 2026-09-10T18:11:41Z

View changes in DiffLens

difflens · 2026-09-10T18:11:42Z

View changes in DiffLens

difflens · 2026-09-11T00:48:34Z

View changes in DiffLens

difflens · 2026-09-15T12:05:23Z

View changes in DiffLens

difflens · 2026-09-15T21:24:16Z

View changes in DiffLens

difflens · 2026-09-18T06:09:25Z

View changes in DiffLens

difflens · 2026-09-24T05:02:30Z

View changes in DiffLens

difflens · 2026-09-24T05:02:31Z

View changes in DiffLens

difflens · 2026-09-25T02:16:54Z

View changes in DiffLens

difflens · 2026-09-29T20:35:08Z

View changes in DiffLens

difflens · 2026-09-29T20:35:10Z

View changes in DiffLens

difflens · 2026-10-14T18:38:25Z

View changes in DiffLens

difflens · 2026-10-14T18:38:30Z

View changes in DiffLens

difflens · 2026-10-27T23:33:53Z

View changes in DiffLens

difflens · 2026-10-27T23:33:55Z

View changes in DiffLens

guardrails · 2026-10-27T23:34:17Z

⚠️ We detected 5 security issues in this pull request:

Vulnerable Libraries (5)

Severity	Details
N/A	pkg:pypi/pillow@12.3.0 (t) upgrade to: 13.0.0
N/A	pkg:pypi/pillow@12.3.0 (t) upgrade to: 13.0.0
N/A	pkg:pypi/pillow@12.3.0 (t) upgrade to: 13.0.0
N/A	pkg:pypi/pillow@12.3.0 (t) upgrade to: 13.0.0
N/A	pkg:pypi/pillow@12.3.0 (t) upgrade to: 13.0.0

More info on how to fix Vulnerable Libraries in Python.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

secure-code-warrior-for-github · 2026-10-27T23:34:22Z

Micro-Learning Topic: Vulnerable library (Detected by phrase)

Matched on "Vulnerable Libraries"

What is this? (2min video)

Use of vulnerable components will introduce weaknesses into the application. Components with published vulnerabilities will allow easy exploitation as resources will often be available to automate the process.

Try a challenge in Secure Code Warrior

difflens · 2026-11-03T01:09:47Z

View changes in DiffLens

difflens · 2026-11-03T06:10:04Z

View changes in DiffLens

renovate Bot requested a review from joseguzman1337 as a code owner August 31, 2026 15:57

renovate Bot changed the title ~~chore(deps): update dependency fonttools to v4.64.0~~ chore(deps): update dependency fonttools to v4.65.0 Sep 10, 2026

renovate Bot force-pushed the renovate/fonttools-4.x branch from d04ceb6 to 817dcdb Compare September 10, 2026 18:11

renovate Bot changed the title ~~chore(deps): update dependency fonttools to v4.65.0~~ Update dependency fonttools to v4.65.0 Sep 18, 2026

renovate Bot force-pushed the renovate/fonttools-4.x branch from 817dcdb to 512f385 Compare September 24, 2026 05:02

renovate Bot changed the title ~~Update dependency fonttools to v4.65.0~~ Update dependency fonttools to v4.66.0 Sep 24, 2026

renovate Bot force-pushed the renovate/fonttools-4.x branch from 512f385 to 93d9c20 Compare September 25, 2026 02:16

renovate Bot force-pushed the renovate/fonttools-4.x branch from 93d9c20 to 2c6f462 Compare September 29, 2026 20:34

renovate Bot changed the title ~~Update dependency fonttools to v4.66.0~~ Update dependency fonttools to v4.66.1 Sep 29, 2026

renovate Bot changed the title ~~Update dependency fonttools to v4.66.1~~ Update dependency fonttools to v4.67.0 Oct 14, 2026

renovate Bot force-pushed the renovate/fonttools-4.x branch from 2c6f462 to 8a5555d Compare October 14, 2026 18:38

Update dependency fonttools to v4.68.0

f057e70

renovate Bot force-pushed the renovate/fonttools-4.x branch from 8a5555d to f057e70 Compare October 27, 2026 23:33

renovate Bot changed the title ~~Update dependency fonttools to v4.67.0~~ Update dependency fonttools to v4.68.0 Oct 27, 2026

Conversation

renovate Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.68.0

v4.67.0

v4.66.1

v4.66.0

v4.65.0

v4.64.0

Configuration

Uh oh!

difflens Bot commented Aug 31, 2026

Uh oh!

difflens Bot commented Aug 31, 2026

Uh oh!

difflens Bot commented Sep 1, 2026

Uh oh!

difflens Bot commented Sep 1, 2026

Uh oh!

difflens Bot commented Sep 1, 2026

Uh oh!

difflens Bot commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

difflens Bot commented Sep 10, 2026

Uh oh!

difflens Bot commented Sep 10, 2026

Uh oh!

difflens Bot commented Sep 11, 2026

Uh oh!

difflens Bot commented Sep 15, 2026

Uh oh!

difflens Bot commented Sep 15, 2026

Uh oh!

difflens Bot commented Sep 18, 2026

Uh oh!

difflens Bot commented Sep 24, 2026

Uh oh!

difflens Bot commented Sep 24, 2026

Uh oh!

difflens Bot commented Sep 25, 2026

Uh oh!

difflens Bot commented Sep 29, 2026

Uh oh!

difflens Bot commented Sep 29, 2026

Uh oh!

difflens Bot commented Oct 14, 2026

Uh oh!

difflens Bot commented Oct 14, 2026

Uh oh!

difflens Bot commented Oct 27, 2026

Uh oh!

difflens Bot commented Oct 27, 2026

Uh oh!

guardrails Bot commented Oct 27, 2026

Uh oh!

secure-code-warrior-for-github Bot commented Oct 27, 2026

Micro-Learning Topic: Vulnerable library (Detected by phrase)

Matched on "Vulnerable Libraries"

Try a challenge in Secure Code Warrior

Uh oh!

difflens Bot commented Nov 3, 2026

Uh oh!

difflens Bot commented Nov 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 31, 2026 •

edited

Loading

`v4.68.0`

`v4.67.0`

`v4.66.1`

`v4.66.0`

`v4.65.0`

`v4.64.0`

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading