chore(deps): update svglib requirement from <1.6 to <2.1 in the python-deps group

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updates the requirements on svglib to permit the latest version.
Updates svglib to 2.0.2

Release notes

Sourced from svglib's releases.

svglib 2.0.2

Supply-chain hygiene release — no code changes.

The 2.0.1 PyPI attestation was generated by a manual workflow_dispatch run from refs/heads/main that raced ahead of the release event. As a result the Sigstore certificate embedded in the PEP 740 attestation identified refs/heads/main as the source rather than refs/tags/v2.0.1, making it impossible to verify the package against the tagged commit. This release is published exclusively via the release: [published] trigger so the attestation identity is refs/tags/v2.0.2.

Changelog

Sourced from svglib's changelog.

2.0.2 (2026-06-18)

Supply-chain hygiene release — no code changes.

The 2.0.1 PyPI attestation was generated by a manual workflow_dispatch run from refs/heads/main that raced ahead of the release event. As a result the Sigstore certificate embedded in the PEP 740 attestation identified refs/heads/main as the source rather than refs/tags/v2.0.1, making it impossible to verify the package against the tagged commit. This release is published exclusively via the release: [published] trigger so the attestation identity is refs/tags/v2.0.2.

2.0.1 (2026-06-17)

Supply-chain hygiene release — no code changes.

This release replaces 2.0.0, which was published directly with uv publish and therefore lacked the PEP 740 provenance attestation that was present in 1.6.0. Releases must be triggered via the GitHub Actions release workflow (publish-to-pypi.yml), which uses PyPI Trusted Publishing (OIDC) to produce a SLSA Level 3 attestation. Publishing locally — even with uv publish --trusted-publishing — relies on a local OAuth identity and does not meet that bar.

• Declare pillow>=9.0.0 as a direct dependency; it was previously an undeclared transitive dependency pulled in by reportlab (#463).

2.0.0 (2026-06-16)

Identical to 2.0b1 in terms of code; this release promotes the beta to a stable release and converts the project documentation files from RST to Markdown format.

2.0b1 (2026-05-26)

Breaking change — output sizes will differ from 1.x.

svglib now correctly maps SVG user units to ReportLab points using the standard SVG/CSS conversion factor: 1 px = 0.75 pt (96 dpi). Previous releases treated 1 user unit as 1 pt, which is 33 % too large. Any SVG whose width/height or viewBox uses user units or px will produce a PDF that is 75 % of its previous linear dimensions (same proportions, correct physical size).

Migration — if you need to preserve the old apparent size, scale the returned Drawing object before use:

from svglib.svglib import svg2rlg
</tr></table>

... (truncated)

Commits

• 48ffb6a Bump to 2.0.2: fix attestation identity (refs/tags vs refs/heads)
• 3afc7c9 Merge pull request #465 from deeplook/supply-chain-hygiene
• bfc64db Bump to 2.0.1: restore provenance attestation, document release process (fixe...
• 3f08e66 Declare pillow as a direct dependency (fixes #463)
• c300829 Release 2.0.0: convert docs to Markdown, bump version
• 0355e4e Merge pull request #462 from deeplook/pre-commit-ci-update-config
• 37e0747 [pre-commit.ci] pre-commit autoupdate
• 4eb1c18 Merge pull request #461 from deeplook/pre-commit-ci-update-config
• a3fcc17 [pre-commit.ci] pre-commit autoupdate
• 0d3db93 Merge pull request #460 from deeplook/pre-commit-ci-update-config
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[sourcery-ai]

Hi @dependabot[bot]! 👋

Your private repo does not have access to Sourcery.

Please upgrade to continue using Sourcery ✨

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 07fef10c-4030-428a-92e9-092fb19ea1af

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Looks like svglib is no longer being updated by Dependabot, so this is no longer needed.