[dependabot]

Bumps svglib from 2.3.0 to 2.3.2.

Release notes

Sourced from svglib's releases.

svglib v2.3.2

Security

• A long run of digits in the arguments of a path arc command (A or a) could make parsing take exponential time, so a tiny SVG could block a process for minutes or longer (CWE-1333, CWE-400, GHSA-249c-7rgc-f52h). Arc arguments are now read one token at a time, without regex backtracking. Parsing of a malformed arc stops at the first argument that does not fit.

Fixed

• Accept explicit plus signs on arc rotation and endpoints, and tab, carriage return and line feed separators in transform arguments, as allowed by SVG (#524, thanks to @​jdotc1).
• svg2rlg() no longer unpacks a .svgz file to a sibling .svg file, which overwrote an existing file of that name and then deleted it. The compressed data is now read as a stream (#518, thanks to @​jdotc1).
• A <use> that refers to itself, or to a cycle of elements that each <use> the next one, no longer crashes with RecursionError. The offending <use> is skipped and an error is logged, as already done for cyclic references between external files (#519, thanks to @​gistrec for the report).

svglib v2.3.1

Security

• Rendering an SVG could be made to take exponential time and memory through nested <use> elements, where each level references a group containing many <use> elements of the previous level (CWE-400, GHSA-555j-qj3j-c8jv). renderUse() now stops after MAX_USE_EXPANSIONS (10,000) expansions per document, logs one error and skips the remaining <use> elements. The budget is shared with the renderers of external SVG files, so referencing many external files does not reset it.

Changelog

Sourced from svglib's changelog.

2.3.2 (2026-10-23)

Security

• A long run of digits in the arguments of a path arc command (A or a) could make parsing take exponential time, so a tiny SVG could block a process for minutes or longer (CWE-1333, CWE-400, GHSA-249c-7rgc-f52h). Arc arguments are now read one token at a time, without regex backtracking. Parsing of a malformed arc stops at the first argument that does not fit.

Fixed

• Accept explicit plus signs on arc rotation and endpoints, and tab, carriage return and line feed separators in transform arguments, as allowed by SVG (#524, thanks to @​jdotc1).
• svg2rlg() no longer unpacks a .svgz file to a sibling .svg file, which overwrote an existing file of that name and then deleted it. The compressed data is now read as a stream (#518, thanks to @​jdotc1).
• A <use> that refers to itself, or to a cycle of elements that each <use> the next one, no longer crashes with RecursionError. The offending <use> is skipped and an error is logged, as already done for cyclic references between external files (#519, thanks to @​gistrec for the report).

2.3.1 (2026-10-22)

Security

• Rendering an SVG could be made to take exponential time and memory through nested <use> elements, where each level references a group containing many <use> elements of the previous level (CWE-400, GHSA-555j-qj3j-c8jv). renderUse() now stops after MAX_USE_EXPANSIONS (10,000) expansions per document, logs one error and skips the remaining <use> elements. The budget is shared with the renderers of external SVG files, so referencing many external files does not reset it.

Commits

• 696b310 Release 2.3.2
• abf3f0a Merge commit from fork
• 1c0f36b Tidy changelog entry for #524
• c007998 fix: accept explicit arc signs and SVG transform whitespace (#524)
• f7ce0f0 Detect <use> cycles that go through a cloned group (#523)
• d83ea22 Update changelog and contributors for #518 and #519
• c4cddf3 Skip self-referencing and cyclic <use> elements instead of recursing (#521)
• 8cccc06 Parse SVGZ streams without overwriting sibling SVG files (#518)
• c642b98 Bump virtualenv from 21.7.13 to 21.14.9 (#520)
• 7f17274 [pre-commit.ci] pre-commit autoupdate (#517)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

📖 Documentation Preview

⚠️ Preview deployment failed or was skipped.

No RST documentation pages changed in this PR.

Last updated: Wed, 04 Nov 2026 06:34:29 GMT