[fonttools/fonttools] 9b8aec: [misc.filesystem] contain OSFS paths within the fi...
1 view
Skip to first unread message
Cosimo Lupo
Aug 28, 2026, 11:44:18 AMAug 28
to fontto...@googlegroups.com
Branch: refs/heads/main
Home: https://github.com/fonttools/fonttools
Commit: 9b8aec5550a7ac3b2ae1f1b9789bbc8fb5f04504
https://github.com/fonttools/fonttools/commit/9b8aec5550a7ac3b2ae1f1b9789bbc8fb5f04504
Author: Mahammad Insaf <In...@digiscrypt.com>
Date: 2026-07-11 (Sat, 11 Jul 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
A Tests/misc/filesystem_test.py
Log Message:
-----------
[misc.filesystem] contain OSFS paths within the filesystem root
OSFS._abs resolved root/rel_path without checking the result stayed inside root, so an untrusted UFO contents.plist entry or .ufoz member of the form ../../x escaped it. Reject paths that resolve outside root, as pyfilesystem2's OSFS does; SubFS and TempFS delegate here so the guard covers zip UFOs too.
Commit: 8f4b4ee265df94c23a3d431d19798be8c8ea34c9
https://github.com/fonttools/fonttools/commit/8f4b4ee265df94c23a3d431d19798be8c8ea34c9
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-28 (Fri, 28 Aug 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_path.py
M Lib/fontTools/misc/filesystem/_zipfs.py
M Tests/misc/filesystem_test.py
Log Message:
-----------
[misc.filesystem] don't publish a half-built zip directory mirror
ReadZipFS._directory cached the TempFS before populating it, so an archive
that failed partway through left a half-built mirror behind, and the next
call answered from a silently truncated view of the zip instead of failing
again. Populate a local TempFS and assign it only once complete: besides
escaping member names, an archive naming the same member as both a file and
a directory makes makedirs raise, and pathlib rejects some names only on
some platforms. Reject escaping names before that anyway, so the error names
the zip entry rather than a path the caller never passed.
Commit: 68405164e6a0a99c2ebc11545b674ded51675400
https://github.com/fonttools/fonttools/commit/68405164e6a0a99c2ebc11545b674ded51675400
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-28 (Fri, 28 Aug 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
M Tests/misc/filesystem_test.py
Log Message:
-----------
[misc.filesystem] simplify containment check, pin symlink strictness
Use is_relative_to for the containment check (python_requires is already
>=3.10) and reword the error, which claimed back-references for the symlink
case. Symlinks resolving out of the root stay rejected -- stricter than
pyfilesystem2, which normalizes textually and follows them out -- now with a
test pinning that.
Commit: 3bbd2683368c16b254e6f800edab97cf8add6b76
https://github.com/fonttools/fonttools/commit/3bbd2683368c16b254e6f800edab97cf8add6b76
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-28 (Fri, 28 Aug 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
M Lib/fontTools/misc/filesystem/_path.py
M Lib/fontTools/misc/filesystem/_zipfs.py
A Tests/misc/filesystem_test.py
Log Message:
-----------
Merge pull request #4124 from insaf021/osfs-path-containment
[misc.filesystem] contain OSFS paths within the filesystem root
Compare: https://github.com/fonttools/fonttools/compare/85c8ef99bf57...3bbd2683368c
To unsubscribe from these emails, change your notification settings at https://github.com/fonttools/fonttools/settings/notifications
Home: https://github.com/fonttools/fonttools
Commit: 9b8aec5550a7ac3b2ae1f1b9789bbc8fb5f04504
https://github.com/fonttools/fonttools/commit/9b8aec5550a7ac3b2ae1f1b9789bbc8fb5f04504
Author: Mahammad Insaf <In...@digiscrypt.com>
Date: 2026-07-11 (Sat, 11 Jul 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
A Tests/misc/filesystem_test.py
Log Message:
-----------
[misc.filesystem] contain OSFS paths within the filesystem root
OSFS._abs resolved root/rel_path without checking the result stayed inside root, so an untrusted UFO contents.plist entry or .ufoz member of the form ../../x escaped it. Reject paths that resolve outside root, as pyfilesystem2's OSFS does; SubFS and TempFS delegate here so the guard covers zip UFOs too.
Commit: 8f4b4ee265df94c23a3d431d19798be8c8ea34c9
https://github.com/fonttools/fonttools/commit/8f4b4ee265df94c23a3d431d19798be8c8ea34c9
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-28 (Fri, 28 Aug 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_path.py
M Lib/fontTools/misc/filesystem/_zipfs.py
M Tests/misc/filesystem_test.py
Log Message:
-----------
[misc.filesystem] don't publish a half-built zip directory mirror
ReadZipFS._directory cached the TempFS before populating it, so an archive
that failed partway through left a half-built mirror behind, and the next
call answered from a silently truncated view of the zip instead of failing
again. Populate a local TempFS and assign it only once complete: besides
escaping member names, an archive naming the same member as both a file and
a directory makes makedirs raise, and pathlib rejects some names only on
some platforms. Reject escaping names before that anyway, so the error names
the zip entry rather than a path the caller never passed.
Commit: 68405164e6a0a99c2ebc11545b674ded51675400
https://github.com/fonttools/fonttools/commit/68405164e6a0a99c2ebc11545b674ded51675400
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-28 (Fri, 28 Aug 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
M Tests/misc/filesystem_test.py
Log Message:
-----------
[misc.filesystem] simplify containment check, pin symlink strictness
Use is_relative_to for the containment check (python_requires is already
>=3.10) and reword the error, which claimed back-references for the symlink
case. Symlinks resolving out of the root stay rejected -- stricter than
pyfilesystem2, which normalizes textually and follows them out -- now with a
test pinning that.
Commit: 3bbd2683368c16b254e6f800edab97cf8add6b76
https://github.com/fonttools/fonttools/commit/3bbd2683368c16b254e6f800edab97cf8add6b76
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-28 (Fri, 28 Aug 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
M Lib/fontTools/misc/filesystem/_path.py
M Lib/fontTools/misc/filesystem/_zipfs.py
A Tests/misc/filesystem_test.py
Log Message:
-----------
Merge pull request #4124 from insaf021/osfs-path-containment
[misc.filesystem] contain OSFS paths within the filesystem root
Compare: https://github.com/fonttools/fonttools/compare/85c8ef99bf57...3bbd2683368c
To unsubscribe from these emails, change your notification settings at https://github.com/fonttools/fonttools/settings/notifications
Jens Kutilek
Sep 2, 2026, 5:23:50 AMSep 2
to fontto...@googlegroups.com
Branch: refs/heads/glyf-dictlike
https://github.com/fonttools/fonttools/commit/21983b8d840a1b923042b18c85c28d3c7220efa1
Author: Mahammad Insaf <In...@digiscrypt.com>
Date: 2026-07-14 (Tue, 14 Jul 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/E_B_D_T_.py
A Tests/ttLib/tables/E_B_D_T_test.py
Log Message:
-----------
sanitise glyph name in EBDT/CBDT extfile export
Commit: 580900846f4e97cef2d5c110ca13dc49940e068a
https://github.com/fonttools/fonttools/commit/580900846f4e97cef2d5c110ca13dc49940e068a
Author: Mahammad Insaf <In...@digiscrypt.com>
Date: 2026-08-03 (Mon, 03 Aug 2026)
Changed paths:
M Lib/fontTools/designspaceLib/__init__.py
M Lib/fontTools/misc/etree.py
M Lib/fontTools/svgLib/path/__init__.py
M Tests/designspaceLib/designspace_test.py
M Tests/misc/etree_test.py
M Tests/misc/plistlib_test.py
M Tests/svgLib/path/path_test.py
Log Message:
-----------
default resolve_entities to False in misc.etree XMLParser
Commit: c431b87b1491cc363ef2fd0172d027b01afa06ad
https://github.com/fonttools/fonttools/commit/c431b87b1491cc363ef2fd0172d027b01afa06ad
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Tests/svgLib/path/parser_test.py
Log Message:
-----------
[svgLib.path] add tests for implicit moveto after closepath
Per SVG 1.1 sec 8.3.3, a drawto command immediately following a closepath
starts a new subpath at the initial point of the just-closed subpath. The
parser currently drops that implicit moveTo, never emits the terminating
endPath for the new subpath, and raises TypeError when the command after
Z is S/s or T/t. These tests fail until the fix in the next commit.
Refs https://github.com/fonttools/fonttools/issues/4154
Commit: 13f952ca459479ff9ceeb5a76cc0f326d4d842df
https://github.com/fonttools/fonttools/commit/13f952ca459479ff9ceeb5a76cc0f326d4d842df
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Lib/fontTools/svgLib/path/parser.py
M Tests/svgLib/path/parser_test.py
Log Message:
-----------
[svgLib.path] implement implicit moveto after closepath
Fixes https://github.com/fonttools/fonttools/issues/4154
start_pos doubled as both the current subpath's initial point and the
subpath-open flag: Z set it to None, so a drawto command following a
closepath continued drawing without opening a new subpath, and the final
endPath was suppressed too. Split the two roles: start_pos now retains
the initial point across a closepath and a new subpath_open flag tracks
whether closePath/endPath is still owed. Any drawto command (not M/Z)
arriving with no open subpath now emits the implicit moveTo at the
just-closed subpath's initial point, per SVG 1.1 sec 8.3.3.
Z also sets command to None (implicit numbers after Z stay invalid), so
last_command is None for the command right after a closepath; the S/T
reflection checks now use tuple membership instead of substring matching
so they don't raise TypeError and correctly fall back to the current
point (the previous command Z is not a C/S or Q/T).
A redundant Z (Z Z) still emits a single closePath and no spurious
moveTo, preserving #4122.
Commit: 27370d69f5ef0141dbcb45afe752f2c3075e3044
https://github.com/fonttools/fonttools/commit/27370d69f5ef0141dbcb45afe752f2c3075e3044
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Tests/svgLib/path/parser_test.py
Log Message:
-----------
[svgLib.path] add tests rejecting paths that do not start with a moveto
A path data segment must begin with a moveto command per the SVG spec;
a user agent renders nothing when the first command is anything else.
The parser instead silently emitted a leading drawto with no moveTo
before it -- invalid pen output. These tests require ValueError before
any pen call for every leading command other than M/m (Z and bare
coordinates included), keep empty/whitespace paths as no-ops, and pin
that current_pos affects an initial relative moveto but does not
legalize a leading drawto. They fail until the fix in the next commit.
Commit: 099c8e0f8bad43650ccf17a041a2c3f3a5828991
https://github.com/fonttools/fonttools/commit/099c8e0f8bad43650ccf17a041a2c3f3a5828991
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Lib/fontTools/svgLib/path/parser.py
Log Message:
-----------
[svgLib.path] reject paths that do not start with a moveto
A path data segment must begin with a moveto command per the SVG spec;
a user agent renders nothing when the first command is anything else.
The parser instead silently emitted a leading drawto with no moveTo
before it, producing invalid pen output (TTGlyphPen raises PenError on
it). Check the first token after tokenization and raise ValueError
before any pen call. A path starting with bare coordinates now gets
this error instead of the 'Unallowed implicit command' one; empty and
whitespace-only paths remain a no-op.
Commit: ee6fa57916e1163f5ac04587e86ef5ae6a259282
https://github.com/fonttools/fonttools/commit/ee6fa57916e1163f5ac04587e86ef5ae6a259282
Author: Behdad Esfahbod <beh...@behdad.org>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Lib/fontTools/ttLib/tables/otData.py
M Lib/fontTools/ttLib/tables/otTables.py
M NEWS.rst
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
[mort] Support all metamorphosis subtable types
Commit: e84c83c7a42f2d1e5d608aef0349665a4337037d
https://github.com/fonttools/fonttools/commit/e84c83c7a42f2d1e5d608aef0349665a4337037d
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
Add mort round-trip regressions
Cover unassigned state-table classes and legacy ligature rebase data.
The fixtures fail before the preservation changes.
Commit: 69ea6b495ac7d605050a9d824d6e40b6ce8bce79
https://github.com/fonttools/fonttools/commit/69ea6b495ac7d605050a9d824d6e40b6ce8bce79
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
Preserve mort state-table round trips
Keep legacy ligature component rebase information in the model and TTX so zero offsets retain their original interpretation.
Infer the number of state-table classes from serialized transitions as well as glyph assignments.
Commit: 6870f871547644f9cfae46f3eca395e6b8fc9fd3
https://github.com/fonttools/fonttools/commit/6870f871547644f9cfae46f3eca395e6b8fc9fd3
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/qu2cu/qu2cu.py
M Tests/qu2cu/qu2cu_test.py
Log Message:
-----------
[qu2cu] Accept tuple splines when compiled
Cython treats the inner List annotation as a runtime type check, while Qu2CuPen supplies tuple splines. Widen the annotation to Sequence and cover that input.
Commit: 984a5cf614f4b05f0cdd57fc5b5628fd81518805
https://github.com/fonttools/fonttools/commit/984a5cf614f4b05f0cdd57fc5b5628fd81518805
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/qu2cu/qu2cu.py
M Tests/qu2cu/qu2cu_test.py
Log Message:
-----------
Merge pull request #4160 from fonttools/fix-cython-qu2cu-lists
[qu2cu] Accept tuple splines when compiled
Commit: a659d9936c633a82d8786ba4f69637a9d93df633
https://github.com/fonttools/fonttools/commit/a659d9936c633a82d8786ba4f69637a9d93df633
Author: Behdad Esfahbod <beh...@behdad.org>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
Merge pull request #4159 from fonttools/fix-mort-roundtrips
[mort] Preserve legacy state-table round trips
Commit: 12edc9e091f67515d02917dcf178961b5916d999
https://github.com/fonttools/fonttools/commit/12edc9e091f67515d02917dcf178961b5916d999
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
[mort] Decode trimmed contextual substitution windows (#4161)
The classic contextual format resolves a substitution by adding the entry's
word offset (possibly negative) to the glyph ID, so each offset exposes a
per-glyph window rather than a whole lookup table, and real fonts (e.g.
macOS's CharcoalCY, GenevaCY, HelveticaCY) trim those windows to the glyphs
an entry can apply to. Decode only the words that fall inside the
substitution table instead of reading a full per-glyph array and rejecting
offsets that precede it. The window is clamped to the subtable, slightly
stricter than HarfBuzz's blob-wide upper bound.
Commit: e7e00f1b16aef6ede850206df3c100ccde27b2d3
https://github.com/fonttools/fonttools/commit/e7e00f1b16aef6ede850206df3c100ccde27b2d3
Author: Behdad Esfahbod <beh...@behdad.org>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Lib/fontTools/ttLib/tables/otData.py
M Lib/fontTools/ttLib/tables/otTables.py
M NEWS.rst
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
Merge pull request #4158 from fonttools/mort-state-tables
[mort] Support all metamorphosis subtable types
Commit: 85c8ef99bf5735ecb12ba9717b67cfbe4bc5e4f4
https://github.com/fonttools/fonttools/commit/85c8ef99bf5735ecb12ba9717b67cfbe4bc5e4f4
M Lib/fontTools/svgLib/path/parser.py
M Tests/svgLib/path/parser_test.py
Log Message:
-----------
Merge pull request #4155 from fonttools/svglib-4154-implicit-moveto
[svgLib.path] Implement implicit moveto after closepath
Commit: 53e2b0b0a4af362038571d5353d8f85b2328cbdf
https://github.com/fonttools/fonttools/commit/53e2b0b0a4af362038571d5353d8f85b2328cbdf
M Lib/fontTools/ttLib/tables/E_B_D_T_.py
M Tests/ttLib/tables/E_B_D_T_test.py
Log Message:
-----------
[E_B_D_T_] don't let sanitised glyph names collide
Dropping the directory part of a glyph name keeps the export inside the
bitmaps folder, but maps distinct names onto one file: "a/b" and "b" both
wrote strike0/b.bin, the second silently overwriting the first, and both
extfileimagedata entries then pointed at the same image. Before, such a name
raised FileNotFoundError, so this traded a crash for silent corruption.
Escape such names URL-style instead, with a leading '%' so an escaped name
can never collide with a plain one -- avoiding separators is not enough when
a real glyph can be named like another name's escaped form. Normal glyph
names contain no separator and no '%' and are kept as-is, so existing
exports keep their filenames.
Commit: 9c10287dbb5db9f1e07d8b3c667c0c75f1f6a6a4
https://github.com/fonttools/fonttools/commit/9c10287dbb5db9f1e07d8b3c667c0c75f1f6a6a4
M Lib/fontTools/ttLib/tables/E_B_D_T_.py
A Tests/ttLib/tables/E_B_D_T_test.py
Log Message:
-----------
Merge pull request #4128 from insaf021/ebdt-extfile-basename
sanitise glyph name in EBDT/CBDT extfile export
Commit: 1ce6993204547a96ac846d8fe7b0f46c27602e32
https://github.com/fonttools/fonttools/commit/1ce6993204547a96ac846d8fe7b0f46c27602e32
M Lib/fontTools/misc/etree.py
M Tests/designspaceLib/designspace_test.py
M Tests/misc/etree_test.py
M Tests/misc/plistlib_test.py
M Tests/svgLib/path/path_test.py
Log Message:
-----------
[misc.etree] only override resolve_entities on lxml < 5.0
The XMLParser subclass forced resolve_entities=False on every lxml version.
That refuses external entities as intended, but lxml 5.0 made "internal" the
default, which already refuses external entities without the subclass.
Overriding it there is needless, so only subclass on lxml < 5.0, where False
is the one setting that refuses external entities.
Also narrow the external-entity tests, whose bare 'except Exception: return'
let them pass even against unpatched code, to catch only ParseError.
Commit: 93fc4708c714327bc0391edbf2040ea258cdd11d
https://github.com/fonttools/fonttools/commit/93fc4708c714327bc0391edbf2040ea258cdd11d
M Lib/fontTools/designspaceLib/__init__.py
M Lib/fontTools/misc/etree.py
M Lib/fontTools/svgLib/path/__init__.py
M Tests/designspaceLib/designspace_test.py
M Tests/misc/etree_test.py
M Tests/misc/plistlib_test.py
M Tests/svgLib/path/path_test.py
Log Message:
-----------
Merge pull request #4145 from insaf021/etree-no-external-entities
[misc.etree] don't resolve external entities in XMLParser
Commit: 6f1429b480cea5de0c55cd5a776ac49ccdb901a3
https://github.com/fonttools/fonttools/commit/6f1429b480cea5de0c55cd5a776ac49ccdb901a3
Author: Behdad Esfahbod <beh...@behdad.org>
M Lib/fontTools/varLib/multiVarStore.py
M Tests/subset/subset_test.py
Log Message:
-----------
[subset] Fully prune VARC auxiliary data (#4162)
Commit: 5cab49636d84d633e297f08844e3569b492f78e2
https://github.com/fonttools/fonttools/commit/5cab49636d84d633e297f08844e3569b492f78e2
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M NEWS.rst
Log Message:
-----------
Update NEWS.rst [skip ci]
Commit: 37dfa71418c88e0e69213e103607a6ee1c2f5ba4
https://github.com/fonttools/fonttools/commit/37dfa71418c88e0e69213e103607a6ee1c2f5ba4
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Lib/fontTools/__init__.py
M NEWS.rst
M setup.cfg
M setup.py
Log Message:
-----------
Release 4.64.0
Commit: 65840bb48f92e12b61125224db6a520fada4ab92
https://github.com/fonttools/fonttools/commit/65840bb48f92e12b61125224db6a520fada4ab92
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Lib/fontTools/__init__.py
M setup.cfg
M setup.py
Log Message:
-----------
Bump version: 4.64.0 → 4.64.1.dev0
Commit: 80b4363795553453f861bf5b0a423ced633ca88e
https://github.com/fonttools/fonttools/commit/80b4363795553453f861bf5b0a423ced633ca88e
Author: Jens Kutilek <web...@kutilek.de>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Lib/fontTools/__init__.py
M Lib/fontTools/designspaceLib/__init__.py
M Lib/fontTools/misc/etree.py
M Lib/fontTools/subset/__init__.py
M Lib/fontTools/svgLib/path/__init__.py
M Lib/fontTools/svgLib/path/parser.py
M Lib/fontTools/ttLib/tables/E_B_D_T_.py
M Lib/fontTools/ttLib/tables/otConverters.py
M Lib/fontTools/ttLib/tables/otData.py
M Lib/fontTools/ttLib/tables/otTables.py
M Lib/fontTools/varLib/multiVarStore.py
M NEWS.rst
M Tests/designspaceLib/designspace_test.py
M Tests/misc/etree_test.py
A Tests/misc/filesystem_test.py
M Tests/misc/plistlib_test.py
M Tests/qu2cu/qu2cu_test.py
M Tests/subset/subset_test.py
M Tests/svgLib/path/parser_test.py
M Tests/svgLib/path/path_test.py
A Tests/ttLib/tables/E_B_D_T_test.py
M Tests/ttLib/tables/_m_o_r_t_test.py
M setup.cfg
M setup.py
Log Message:
-----------
Merge branch 'main' into glyf-dictlike
Commit: 2c99c225319d092bdeb0ea5ce5772b58d66f0e64
https://github.com/fonttools/fonttools/commit/2c99c225319d092bdeb0ea5ce5772b58d66f0e64
Author: Jens Kutilek <web...@kutilek.de>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/_g_l_y_f.py
Log Message:
-----------
Implement value, items with collection.abc.ValuesView, ItemsView
Commit: 87a396057016763f6d503b41c1330deb18886d4c
https://github.com/fonttools/fonttools/commit/87a396057016763f6d503b41c1330deb18886d4c
Author: Jens Kutilek <web...@kutilek.de>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Tests/ttLib/tables/_g_l_y_f_test.py
Log Message:
-----------
Add tests for lazily loaded fonts
Compare: https://github.com/fonttools/fonttools/compare/c3d224b9351f...87a396057016
Home: https://github.com/fonttools/fonttools
Commit: 9b8aec5550a7ac3b2ae1f1b9789bbc8fb5f04504
https://github.com/fonttools/fonttools/commit/9b8aec5550a7ac3b2ae1f1b9789bbc8fb5f04504
Author: Mahammad Insaf <In...@digiscrypt.com>
Date: 2026-07-11 (Sat, 11 Jul 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
A Tests/misc/filesystem_test.py
Log Message:
-----------
[misc.filesystem] contain OSFS paths within the filesystem root
OSFS._abs resolved root/rel_path without checking the result stayed inside root, so an untrusted UFO contents.plist entry or .ufoz member of the form ../../x escaped it. Reject paths that resolve outside root, as pyfilesystem2's OSFS does; SubFS and TempFS delegate here so the guard covers zip UFOs too.
Commit: 21983b8d840a1b923042b18c85c28d3c7220efa1
Commit: 9b8aec5550a7ac3b2ae1f1b9789bbc8fb5f04504
https://github.com/fonttools/fonttools/commit/9b8aec5550a7ac3b2ae1f1b9789bbc8fb5f04504
Author: Mahammad Insaf <In...@digiscrypt.com>
Date: 2026-07-11 (Sat, 11 Jul 2026)
Changed paths:
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
A Tests/misc/filesystem_test.py
Log Message:
-----------
[misc.filesystem] contain OSFS paths within the filesystem root
OSFS._abs resolved root/rel_path without checking the result stayed inside root, so an untrusted UFO contents.plist entry or .ufoz member of the form ../../x escaped it. Reject paths that resolve outside root, as pyfilesystem2's OSFS does; SubFS and TempFS delegate here so the guard covers zip UFOs too.
https://github.com/fonttools/fonttools/commit/21983b8d840a1b923042b18c85c28d3c7220efa1
Author: Mahammad Insaf <In...@digiscrypt.com>
Date: 2026-07-14 (Tue, 14 Jul 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/E_B_D_T_.py
A Tests/ttLib/tables/E_B_D_T_test.py
Log Message:
-----------
sanitise glyph name in EBDT/CBDT extfile export
Commit: 580900846f4e97cef2d5c110ca13dc49940e068a
https://github.com/fonttools/fonttools/commit/580900846f4e97cef2d5c110ca13dc49940e068a
Author: Mahammad Insaf <In...@digiscrypt.com>
Date: 2026-08-03 (Mon, 03 Aug 2026)
Changed paths:
M Lib/fontTools/designspaceLib/__init__.py
M Lib/fontTools/misc/etree.py
M Lib/fontTools/svgLib/path/__init__.py
M Tests/designspaceLib/designspace_test.py
M Tests/misc/etree_test.py
M Tests/misc/plistlib_test.py
M Tests/svgLib/path/path_test.py
Log Message:
-----------
default resolve_entities to False in misc.etree XMLParser
Commit: c431b87b1491cc363ef2fd0172d027b01afa06ad
https://github.com/fonttools/fonttools/commit/c431b87b1491cc363ef2fd0172d027b01afa06ad
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Tests/svgLib/path/parser_test.py
Log Message:
-----------
[svgLib.path] add tests for implicit moveto after closepath
Per SVG 1.1 sec 8.3.3, a drawto command immediately following a closepath
starts a new subpath at the initial point of the just-closed subpath. The
parser currently drops that implicit moveTo, never emits the terminating
endPath for the new subpath, and raises TypeError when the command after
Z is S/s or T/t. These tests fail until the fix in the next commit.
Refs https://github.com/fonttools/fonttools/issues/4154
Commit: 13f952ca459479ff9ceeb5a76cc0f326d4d842df
https://github.com/fonttools/fonttools/commit/13f952ca459479ff9ceeb5a76cc0f326d4d842df
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Lib/fontTools/svgLib/path/parser.py
M Tests/svgLib/path/parser_test.py
Log Message:
-----------
[svgLib.path] implement implicit moveto after closepath
Fixes https://github.com/fonttools/fonttools/issues/4154
start_pos doubled as both the current subpath's initial point and the
subpath-open flag: Z set it to None, so a drawto command following a
closepath continued drawing without opening a new subpath, and the final
endPath was suppressed too. Split the two roles: start_pos now retains
the initial point across a closepath and a new subpath_open flag tracks
whether closePath/endPath is still owed. Any drawto command (not M/Z)
arriving with no open subpath now emits the implicit moveTo at the
just-closed subpath's initial point, per SVG 1.1 sec 8.3.3.
Z also sets command to None (implicit numbers after Z stay invalid), so
last_command is None for the command right after a closepath; the S/T
reflection checks now use tuple membership instead of substring matching
so they don't raise TypeError and correctly fall back to the current
point (the previous command Z is not a C/S or Q/T).
A redundant Z (Z Z) still emits a single closePath and no spurious
moveTo, preserving #4122.
Commit: 27370d69f5ef0141dbcb45afe752f2c3075e3044
https://github.com/fonttools/fonttools/commit/27370d69f5ef0141dbcb45afe752f2c3075e3044
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Tests/svgLib/path/parser_test.py
Log Message:
-----------
[svgLib.path] add tests rejecting paths that do not start with a moveto
A path data segment must begin with a moveto command per the SVG spec;
a user agent renders nothing when the first command is anything else.
The parser instead silently emitted a leading drawto with no moveTo
before it -- invalid pen output. These tests require ValueError before
any pen call for every leading command other than M/m (Z and bare
coordinates included), keep empty/whitespace paths as no-ops, and pin
that current_pos affects an initial relative moveto but does not
legalize a leading drawto. They fail until the fix in the next commit.
Commit: 099c8e0f8bad43650ccf17a041a2c3f3a5828991
https://github.com/fonttools/fonttools/commit/099c8e0f8bad43650ccf17a041a2c3f3a5828991
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Lib/fontTools/svgLib/path/parser.py
Log Message:
-----------
[svgLib.path] reject paths that do not start with a moveto
A path data segment must begin with a moveto command per the SVG spec;
a user agent renders nothing when the first command is anything else.
The parser instead silently emitted a leading drawto with no moveTo
before it, producing invalid pen output (TTGlyphPen raises PenError on
it). Check the first token after tokenization and raise ValueError
before any pen call. A path starting with bare coordinates now gets
this error instead of the 'Unallowed implicit command' one; empty and
whitespace-only paths remain a no-op.
Commit: ee6fa57916e1163f5ac04587e86ef5ae6a259282
https://github.com/fonttools/fonttools/commit/ee6fa57916e1163f5ac04587e86ef5ae6a259282
Author: Behdad Esfahbod <beh...@behdad.org>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Lib/fontTools/ttLib/tables/otData.py
M Lib/fontTools/ttLib/tables/otTables.py
M NEWS.rst
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
[mort] Support all metamorphosis subtable types
Commit: e84c83c7a42f2d1e5d608aef0349665a4337037d
https://github.com/fonttools/fonttools/commit/e84c83c7a42f2d1e5d608aef0349665a4337037d
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
Add mort round-trip regressions
Cover unassigned state-table classes and legacy ligature rebase data.
The fixtures fail before the preservation changes.
Commit: 69ea6b495ac7d605050a9d824d6e40b6ce8bce79
https://github.com/fonttools/fonttools/commit/69ea6b495ac7d605050a9d824d6e40b6ce8bce79
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
Preserve mort state-table round trips
Keep legacy ligature component rebase information in the model and TTX so zero offsets retain their original interpretation.
Infer the number of state-table classes from serialized transitions as well as glyph assignments.
Commit: 6870f871547644f9cfae46f3eca395e6b8fc9fd3
https://github.com/fonttools/fonttools/commit/6870f871547644f9cfae46f3eca395e6b8fc9fd3
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/qu2cu/qu2cu.py
M Tests/qu2cu/qu2cu_test.py
Log Message:
-----------
[qu2cu] Accept tuple splines when compiled
Cython treats the inner List annotation as a runtime type check, while Qu2CuPen supplies tuple splines. Widen the annotation to Sequence and cover that input.
Commit: 984a5cf614f4b05f0cdd57fc5b5628fd81518805
https://github.com/fonttools/fonttools/commit/984a5cf614f4b05f0cdd57fc5b5628fd81518805
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/qu2cu/qu2cu.py
M Tests/qu2cu/qu2cu_test.py
Log Message:
-----------
Merge pull request #4160 from fonttools/fix-cython-qu2cu-lists
[qu2cu] Accept tuple splines when compiled
Commit: a659d9936c633a82d8786ba4f69637a9d93df633
https://github.com/fonttools/fonttools/commit/a659d9936c633a82d8786ba4f69637a9d93df633
Author: Behdad Esfahbod <beh...@behdad.org>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
Merge pull request #4159 from fonttools/fix-mort-roundtrips
[mort] Preserve legacy state-table round trips
Commit: 12edc9e091f67515d02917dcf178961b5916d999
https://github.com/fonttools/fonttools/commit/12edc9e091f67515d02917dcf178961b5916d999
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
[mort] Decode trimmed contextual substitution windows (#4161)
The classic contextual format resolves a substitution by adding the entry's
word offset (possibly negative) to the glyph ID, so each offset exposes a
per-glyph window rather than a whole lookup table, and real fonts (e.g.
macOS's CharcoalCY, GenevaCY, HelveticaCY) trim those windows to the glyphs
an entry can apply to. Decode only the words that fall inside the
substitution table instead of reading a full per-glyph array and rejecting
offsets that precede it. The window is clamped to the subtable, slightly
stricter than HarfBuzz's blob-wide upper bound.
Commit: e7e00f1b16aef6ede850206df3c100ccde27b2d3
https://github.com/fonttools/fonttools/commit/e7e00f1b16aef6ede850206df3c100ccde27b2d3
Author: Behdad Esfahbod <beh...@behdad.org>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/otConverters.py
M Lib/fontTools/ttLib/tables/otData.py
M Lib/fontTools/ttLib/tables/otTables.py
M NEWS.rst
M Tests/ttLib/tables/_m_o_r_t_test.py
Log Message:
-----------
Merge pull request #4158 from fonttools/mort-state-tables
[mort] Support all metamorphosis subtable types
Commit: 85c8ef99bf5735ecb12ba9717b67cfbe4bc5e4f4
https://github.com/fonttools/fonttools/commit/85c8ef99bf5735ecb12ba9717b67cfbe4bc5e4f4
M Lib/fontTools/svgLib/path/parser.py
M Tests/svgLib/path/parser_test.py
Log Message:
-----------
Merge pull request #4155 from fonttools/svglib-4154-implicit-moveto
[svgLib.path] Implement implicit moveto after closepath
https://github.com/fonttools/fonttools/commit/53e2b0b0a4af362038571d5353d8f85b2328cbdf
M Lib/fontTools/ttLib/tables/E_B_D_T_.py
M Tests/ttLib/tables/E_B_D_T_test.py
Log Message:
-----------
[E_B_D_T_] don't let sanitised glyph names collide
Dropping the directory part of a glyph name keeps the export inside the
bitmaps folder, but maps distinct names onto one file: "a/b" and "b" both
wrote strike0/b.bin, the second silently overwriting the first, and both
extfileimagedata entries then pointed at the same image. Before, such a name
raised FileNotFoundError, so this traded a crash for silent corruption.
Escape such names URL-style instead, with a leading '%' so an escaped name
can never collide with a plain one -- avoiding separators is not enough when
a real glyph can be named like another name's escaped form. Normal glyph
names contain no separator and no '%' and are kept as-is, so existing
exports keep their filenames.
Commit: 9c10287dbb5db9f1e07d8b3c667c0c75f1f6a6a4
https://github.com/fonttools/fonttools/commit/9c10287dbb5db9f1e07d8b3c667c0c75f1f6a6a4
M Lib/fontTools/ttLib/tables/E_B_D_T_.py
A Tests/ttLib/tables/E_B_D_T_test.py
Log Message:
-----------
Merge pull request #4128 from insaf021/ebdt-extfile-basename
sanitise glyph name in EBDT/CBDT extfile export
Commit: 1ce6993204547a96ac846d8fe7b0f46c27602e32
https://github.com/fonttools/fonttools/commit/1ce6993204547a96ac846d8fe7b0f46c27602e32
M Lib/fontTools/misc/etree.py
M Tests/designspaceLib/designspace_test.py
M Tests/misc/etree_test.py
M Tests/misc/plistlib_test.py
M Tests/svgLib/path/path_test.py
Log Message:
-----------
[misc.etree] only override resolve_entities on lxml < 5.0
The XMLParser subclass forced resolve_entities=False on every lxml version.
That refuses external entities as intended, but lxml 5.0 made "internal" the
default, which already refuses external entities without the subclass.
Overriding it there is needless, so only subclass on lxml < 5.0, where False
is the one setting that refuses external entities.
Also narrow the external-entity tests, whose bare 'except Exception: return'
let them pass even against unpatched code, to catch only ParseError.
Commit: 93fc4708c714327bc0391edbf2040ea258cdd11d
https://github.com/fonttools/fonttools/commit/93fc4708c714327bc0391edbf2040ea258cdd11d
M Lib/fontTools/designspaceLib/__init__.py
M Lib/fontTools/misc/etree.py
M Lib/fontTools/svgLib/path/__init__.py
M Tests/designspaceLib/designspace_test.py
M Tests/misc/etree_test.py
M Tests/misc/plistlib_test.py
M Tests/svgLib/path/path_test.py
Log Message:
-----------
Merge pull request #4145 from insaf021/etree-no-external-entities
[misc.etree] don't resolve external entities in XMLParser
Commit: 6f1429b480cea5de0c55cd5a776ac49ccdb901a3
https://github.com/fonttools/fonttools/commit/6f1429b480cea5de0c55cd5a776ac49ccdb901a3
Author: Behdad Esfahbod <beh...@behdad.org>
Date: 2026-08-28 (Fri, 28 Aug 2026)
Changed paths:
M Lib/fontTools/subset/__init__.py
Changed paths:
M Lib/fontTools/varLib/multiVarStore.py
M Tests/subset/subset_test.py
Log Message:
-----------
[subset] Fully prune VARC auxiliary data (#4162)
Commit: 5cab49636d84d633e297f08844e3569b492f78e2
https://github.com/fonttools/fonttools/commit/5cab49636d84d633e297f08844e3569b492f78e2
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M NEWS.rst
Log Message:
-----------
Update NEWS.rst [skip ci]
Commit: 37dfa71418c88e0e69213e103607a6ee1c2f5ba4
https://github.com/fonttools/fonttools/commit/37dfa71418c88e0e69213e103607a6ee1c2f5ba4
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Lib/fontTools/__init__.py
M NEWS.rst
M setup.cfg
M setup.py
Log Message:
-----------
Release 4.64.0
Commit: 65840bb48f92e12b61125224db6a520fada4ab92
https://github.com/fonttools/fonttools/commit/65840bb48f92e12b61125224db6a520fada4ab92
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Lib/fontTools/__init__.py
M setup.cfg
M setup.py
Log Message:
-----------
Bump version: 4.64.0 → 4.64.1.dev0
Commit: 80b4363795553453f861bf5b0a423ced633ca88e
https://github.com/fonttools/fonttools/commit/80b4363795553453f861bf5b0a423ced633ca88e
Author: Jens Kutilek <web...@kutilek.de>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Lib/fontTools/__init__.py
M Lib/fontTools/designspaceLib/__init__.py
M Lib/fontTools/misc/etree.py
M Lib/fontTools/misc/filesystem/_errors.py
M Lib/fontTools/misc/filesystem/_osfs.py
M Lib/fontTools/misc/filesystem/_path.py
M Lib/fontTools/misc/filesystem/_zipfs.py
M Lib/fontTools/qu2cu/qu2cu.py
M Lib/fontTools/misc/filesystem/_osfs.py
M Lib/fontTools/misc/filesystem/_path.py
M Lib/fontTools/misc/filesystem/_zipfs.py
M Lib/fontTools/subset/__init__.py
M Lib/fontTools/svgLib/path/__init__.py
M Lib/fontTools/svgLib/path/parser.py
M Lib/fontTools/ttLib/tables/E_B_D_T_.py
M Lib/fontTools/ttLib/tables/otConverters.py
M Lib/fontTools/ttLib/tables/otData.py
M Lib/fontTools/ttLib/tables/otTables.py
M Lib/fontTools/varLib/multiVarStore.py
M NEWS.rst
M Tests/designspaceLib/designspace_test.py
M Tests/misc/etree_test.py
A Tests/misc/filesystem_test.py
M Tests/misc/plistlib_test.py
M Tests/qu2cu/qu2cu_test.py
M Tests/subset/subset_test.py
M Tests/svgLib/path/parser_test.py
M Tests/svgLib/path/path_test.py
A Tests/ttLib/tables/E_B_D_T_test.py
M Tests/ttLib/tables/_m_o_r_t_test.py
M setup.cfg
M setup.py
Log Message:
-----------
Merge branch 'main' into glyf-dictlike
Commit: 2c99c225319d092bdeb0ea5ce5772b58d66f0e64
https://github.com/fonttools/fonttools/commit/2c99c225319d092bdeb0ea5ce5772b58d66f0e64
Author: Jens Kutilek <web...@kutilek.de>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Lib/fontTools/ttLib/tables/_g_l_y_f.py
Log Message:
-----------
Implement value, items with collection.abc.ValuesView, ItemsView
Commit: 87a396057016763f6d503b41c1330deb18886d4c
https://github.com/fonttools/fonttools/commit/87a396057016763f6d503b41c1330deb18886d4c
Author: Jens Kutilek <web...@kutilek.de>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Tests/ttLib/tables/_g_l_y_f_test.py
Log Message:
-----------
Add tests for lazily loaded fonts
Compare: https://github.com/fonttools/fonttools/compare/c3d224b9351f...87a396057016
Reply all
Reply to author
Forward
0 new messages