Bump the pip group across 1 directory with 3 updates by dependabot[bot] · Pull Request #1 · aldoeliacim/CoCo

dependabot · 2025-12-01T22:36:40Z

Bumps the pip group with 3 updates in the / directory: fonttools, pip and torch.

Updates fonttools from 4.59.0 to 4.61.0

Release notes

4.61.0

[varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command-line script, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.

[feaLib] Sort BaseLangSysRecords by tag (#3986).

Drop support for EOL Python 3.9 (#3982).

[instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).

[CFF2ToCFF] Add --remove-overlaps option (#3976).

[feaLib] Raise an error for rsub with NULL target (#3979).

[bezierTools] Fix logic bug in curveCurveIntersections (#3963).

[feaLib] Error when condition sets have the same name (#3958).

[cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).

[unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1

[ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).

[ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).

[subset] Don't try to subset BASE table; pass it through by default instead (#3949).

[subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).

[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).

[subset] Remove duplicate features when subsetting (#3945).

[Docs] Added documentation for the visitor module (#3944).

4.60.0

[pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

[filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

[cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

[varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,

varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,

varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,

varLib.avar.plan module moved from varLib.avarPlanner.

The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).

[interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).

[post] Speed up build_psNameMapping (#3923).

[ufoLib] Added typing annotations to fontTools.ufoLib (#3875).

4.59.2

[varLib] Clear USE_MY_METRICS component flags when inconsistent across masters (#3912).

[varLib.instancer] Avoid negative advance width/height values when instatiating HVAR/VVAR, (unlikely in well-behaved fonts) (#3918).

[subset] Fix shaping behaviour when pruning empty mark sets (#3915, harfbuzz/harfbuzz#5499).

[cu2qu] Fixed dot() product of perpendicular vectors not always returning exactly 0.0 in all Python implementations (#3911)

[varLib.instancer] Implemented fully-instantiating avar2 fonts (#3909).

[feaLib] Allow float values in VariableScalar's axis locations (#3906, #3907).

[cu2qu] Handle special case in calc_intersect for degenerate cubic curves where 3 to 4 control points are equal (#3904).

4.59.1

[featureVars] Update OS/2.usMaxContext if possible after addFeatureVariationsRaw (#3894).

[vhmtx] raise TTLibError('not enough data...') when hmtx/vmtx are truncated (#3843, #3901).

[feaLib] Combine duplicate features that have the same set of lookups regardless of the order in which those lookups are added to the feature (#3895).

... (truncated)

Changelog

Sourced from fonttools's changelog.

4.61.0 (released 2025-11-28)

[varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.

[feaLib] Sort BaseLangSysRecords by tag (#3986).

Drop support for EOL Python 3.9 (#3982).

[instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).

[CFF2ToCFF] Add --remove-overlaps option (#3976).

[feaLib] Raise an error for rsub with NULL target (#3979).

[bezierTools] Fix logic bug in curveCurveIntersections (#3963).

[feaLib] Error when condition sets have the same name (#3958).

[cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).

[unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1 (released 2025-09-29)

[ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).

[ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).

[subset] Don't try to subset BASE table; pass it through by default instead (#3949).

[subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).

[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).

[subset] Remove duplicate features when subsetting (#3945).

[Docs] Added documentation for the visitor module (#3944).

4.60.0 (released 2025-09-17)

[pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

[filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

[cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

[varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,

varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,

varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,

varLib.avar.plan module moved from varLib.avarPlanner. The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).

[interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).

[post] Speed up build_psNameMapping (#3923).

... (truncated)

Commits

e691e3b Release 4.61.0
c2d540f Update NEWS.rst
3859753 Update NEWS.rst
26eb070 black
5ff73af Merge commit from fork
a696d5b varLib: only use the basename(vf.filename)
b00bc45 varLib_test: test path traversal in variable-font filename
066512e Merge pull request #3986 from cmyr/base-minmax-sorting
ce78973 [feaLib] Sort BasLangSysRecords by tag
5bb37dc Merge pull request #3983 from fonttools/dependabot/pip/brotli-1.2.0
Additional commits viewable in compare view

Updates pip from 25.2 to 25.3

Changelog

Sourced from pip's changelog.

25.3 (2025-10-24)

Deprecations and Removals

Remove support for the legacy setup.py develop editable method in setuptools editable installs; setuptools >= 64 is now required. ([#11457](https://github.com/pypa/pip/issues/11457) <https://github.com/pypa/pip/issues/11457>_)

Remove the deprecated --global-option and --build-option. --config-setting is now the only way to pass options to the build backend. ([#11859](https://github.com/pypa/pip/issues/11859) <https://github.com/pypa/pip/issues/11859>_)

Deprecate the PIP_CONSTRAINT environment variable for specifying build constraints.

Use the --build-constraint option or the PIP_BUILD_CONSTRAINT environment variable instead. When build constraints are used, PIP_CONSTRAINT no longer affects isolated build environments. To enable this behavior without specifying any build constraints, use --use-feature=build-constraint. ([#13534](https://github.com/pypa/pip/issues/13534) <https://github.com/pypa/pip/issues/13534>_)

Remove support for non-standard legacy wheel filenames. ([#13581](https://github.com/pypa/pip/issues/13581) <https://github.com/pypa/pip/issues/13581>_)

Remove support for the deprecated setup.py bdist_wheel mechanism. Consequently, --use-pep517 is now always on, and --no-use-pep517 has been removed. ([#6334](https://github.com/pypa/pip/issues/6334) <https://github.com/pypa/pip/issues/6334>_)

Features

When :pep:658 metadata is available, full distribution files are no longer downloaded when using pip lock or pip install --dry-run. ([#12603](https://github.com/pypa/pip/issues/12603) <https://github.com/pypa/pip/issues/12603>_)

Add support for installing an editable requirement written as a Direct URL (PackageName @ URL). ([#13495](https://github.com/pypa/pip/issues/13495) <https://github.com/pypa/pip/issues/13495>_)

Add support for build constraints via the --build-constraint option. This allows constraining the versions of packages used during the build process (e.g., setuptools) without affecting the final installation. ([#13534](https://github.com/pypa/pip/issues/13534) <https://github.com/pypa/pip/issues/13534>_)

On ResolutionImpossible errors, include a note about causes with no candidates. ([#13588](https://github.com/pypa/pip/issues/13588) <https://github.com/pypa/pip/issues/13588>_)

Building pip itself from source now uses flit-core instead of setuptools. This does not affect how pip installs or builds packages you use. ([#13473](https://github.com/pypa/pip/issues/13473) <https://github.com/pypa/pip/issues/13473>_)

Bug Fixes

Handle malformed Version metadata entries and show a sensible error message instead of crashing. ([#13443](https://github.com/pypa/pip/issues/13443) <https://github.com/pypa/pip/issues/13443>_)

Permit spaces between a filepath and extras in an install requirement. ([#13523](https://github.com/pypa/pip/issues/13523) <https://github.com/pypa/pip/issues/13523>_)

Ensure the self-check files in the cache have the same permissions as the rest of the cache. ([#13528](https://github.com/pypa/pip/issues/13528) <https://github.com/pypa/pip/issues/13528>_)

Avoid concurrency issues and improve performance when caching locally built wheels, especially when the temporary build directory is on a different filesystem than the cache. The wheel directory passed to the build backend is now a temporary subdirectory inside the cache directory. ([#13540](https://github.com/pypa/pip/issues/13540) <https://github.com/pypa/pip/issues/13540>_)

Include relevant user-supplied constraints in logs when reporting dependency conflicts. ([#13545](https://github.com/pypa/pip/issues/13545) <https://github.com/pypa/pip/issues/13545>_)

Fix a regression in configuration parsing that was turning a single value into a list and thus leading to a validation error. ([#13548](https://github.com/pypa/pip/issues/13548) <https://github.com/pypa/pip/issues/13548>_)

For Python versions that do not support :pep:706, pip will now raise an installation error for a source distribution when it includes a symlink that points outside the source distribution archive. ([#13550](https://github.com/pypa/pip/issues/13550) <https://github.com/pypa/pip/issues/13550>_)

Prevent --user installs if site.ENABLE_USER_SITE is set to False. ([#8794](https://github.com/pypa/pip/issues/8794) <https://github.com/pypa/pip/issues/8794>_)

... (truncated)

Commits

a520693 Bump for release
0f2973e Fix up authors by adding entry to .mailmap
87828dc Update AUTHORS.txt
ce6a38c Merge pull request #13628 from sbidoul/imp-doc-pep517-sbi
ee16c81 Merge pull request #13629 from notatallshaw/bump-gone_in="25.3"
3e227aa Bump gone_in="25.3"
4ad1828 Merge pull request #13495 from ichard26/feat/direct-editables
66ded3b Merge pull request #13570 from ShubhamNagure/fix-constraint-reporting-13545
67e8ac2 Merge pull request #13588 from notatallshaw/hint-on-resolution-impossible-whe...
990ca8a Merge pull request #8796 from pelson/honour_user_site
Additional commits viewable in compare view

Updates torch from 2.7.1 to 2.8.0

Release notes

Sourced from torch's releases.

PyTorch 2.8.0 Release Notes

Highlights

Backwards Incompatible Changes

Deprecations

New Features

Improvements

Bug fixes

Performance

Documentation

Developers

Highlights

... (truncated)

Commits

ba56102 Cherrypick: Add the RunLLM widget to the website (#159592)
c525a02 [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (#15...
a1cb3cc [Release Only] Remove nvshmem from list of preload libraries (#158925)
c76b235 Move out super large one off foreach_copy test (#158880)
20a0e22 Revert "[Dynamo] Allow inlining into AO quantization modules (#152934)" (#158...
9167ac8 [MPS] Switch Cholesky decomp to column wise (#158237)
5534685 [MPS] Reimplement tri[ul] as Metal shaders (#158867)
d19e08d Cherry pick PR 158746 (#158801)
a6c044a [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...
620ebd0 [Dynamo] Use proper sources for constructing dataclass defaults (#158689)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the pip group with 3 updates in the / directory: [fonttools](https://github.com/fonttools/fonttools), [pip](https://github.com/pypa/pip) and [torch](https://github.com/pytorch/pytorch). Updates `fonttools` from 4.59.0 to 4.61.0 - [Release notes](https://github.com/fonttools/fonttools/releases) - [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst) - [Commits](fonttools/fonttools@4.59.0...4.61.0) Updates `pip` from 25.2 to 25.3 - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@25.2...25.3) Updates `torch` from 2.7.1 to 2.8.0 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.7.1...v2.8.0) --- updated-dependencies: - dependency-name: fonttools dependency-version: 4.61.0 dependency-type: direct:production dependency-group: pip - dependency-name: pip dependency-version: '25.3' dependency-type: direct:production dependency-group: pip - dependency-name: torch dependency-version: 2.8.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-02-13T11:54:02Z

Superseded by #8.

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Dec 1, 2025

dependabot bot closed this Feb 13, 2026

dependabot bot deleted the dependabot/pip/pip-152bbda429 branch February 13, 2026 11:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the pip group across 1 directory with 3 updates#1

Bump the pip group across 1 directory with 3 updates#1
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/pip-152bbda429

dependabot bot commented on behalf of github Dec 1, 2025

Uh oh!

dependabot bot commented on behalf of github Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Dec 1, 2025

4.61.0

4.60.1

4.60.0

4.59.2

4.59.1

4.61.0 (released 2025-11-28)

4.60.1 (released 2025-09-29)

4.60.0 (released 2025-09-17)

25.3 (2025-10-24)

Deprecations and Removals

Features

Bug Fixes

PyTorch 2.8.0 Release Notes

Highlights

Uh oh!

dependabot bot commented on behalf of github Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants