head	1.6;
access;
symbols
	pkgsrc-2026Q3:1.4.0.2
	pkgsrc-2026Q3-base:1.4
	pkgsrc-2026Q2:1.1.0.4
	pkgsrc-2026Q2-base:1.1
	pkgsrc-2026Q1:1.1.0.2
	pkgsrc-2026Q1-base:1.1;
locks; strict;
comment	@# @;


1.6
date	2026.11.10.09.50.43;	author adam;	state Exp;
branches;
next	1.5;
commitid	E5yCRipwzkmWJT2H;

1.5
date	2026.10.24.09.03.40;	author adam;	state Exp;
branches;
next	1.4;
commitid	inxi2GPLtBOJ1I0H;

1.4
date	2026.08.20.05.40.44;	author adam;	state Exp;
branches;
next	1.3;
commitid	DdEsXPnS0j1FZkSG;

1.3
date	2026.08.09.11.04.40;	author adam;	state Exp;
branches;
next	1.2;
commitid	bD7PZu8elAfv8XQG;

1.2
date	2026.07.14.13.22.34;	author adam;	state Exp;
branches;
next	1.1;
commitid	jlSYXzbdSUUNJCNG;

1.1
date	2025.12.28.14.28.55;	author adam;	state Exp;
branches;
next	;
commitid	uXEPaQg7lSSctboG;


desc
@@


1.6
log
@py-svglib: updated to 2.4.0

2.4.0 (2026-11-04)

Added

- `<textPath>` is now supported: text follows the `<path>` named by its `href`
  or `xlink:href`, with `startOffset` (a length or a percentage) and
  `text-anchor`, and styled `<tspan>` children. ReportLab can't draw text along
  a path, so each glyph is placed and rotated individually, at the point of the
  path under its midpoint; glyphs beyond the end of the path are dropped. Only
  paths of the same document can be followed, and `side`, `method`, `spacing`
  and per-glyph `dx`/`dy`/`rotate` are not supported
- The plain `opacity` property is now supported, as a presentation attribute,
  in `style` attributes and in `<style>` rules, including percentages. Opacity
  composes down the tree, so a shape at 0.5 inside a group at 0.5 is drawn at
  0.25. It is applied per shape, so overlapping shapes inside a translucent
  group show through each other, and images are not affected
  thanks to @@Pharex38).
- The CSS `font` shorthand is now expanded into `font-style`, `font-weight`,
  `font-size` and `font-family`, in `style` attributes and in `<style>` rules.
  Invalid shorthands are ignored

Removed

- Dropped support for **Python 3.9** (and PyPy 3.9). pip 26.2.2, the new
  minimum safe version, requires Python 3.10 or newer. `requires-python` is now
  `>=3.10`, the 3.9 classifier is gone, and CI no longer tests 3.9 or PyPy 3.9.

Tooling and housekeeping

- CI now fails if a locked or installed dependency, or the uv binary, is below
  its minimum safe version (`scripts/check_min_versions.py`).
- CI runs the lowest supported Python, 3.10, next to 3.13, 3.15 and PyPy 3.11.
  Python 3.15 is declared supported (classifier and tox).
- `make install` installs the dev dependency group (it used the `dev` extra,
  which doesn't exist), `make uninstall` no longer passes an option that
  `uv pip` doesn't know, and `make test-dist` works: `scripts/test-dist.sh`
  builds the wheel and tests it in a clean virtual environment. New:
  `make check-versions`.
- `tests/test_basic.py` is split into modules by topic (`test_paths.py`,
  `test_text.py`, `test_text_path.py`, `test_use.py`, `test_gradients.py`, ...).
  The tests that download files carry the pytest marker `network`, so
  `pytest -m "not network"` (or `make test-fast`) skips them.
- `tests/test_public_api.py` records the names, signatures and class members
  of `svglib`, `svglib.svglib`, `svglib.utils` and `svglib.fonts` in
  `tests/public_api.json`, so that restructuring the modules can't silently
  change what user code can import.
- The READMEs and notes in `demos/` and `tests/` are Markdown now, and the
  testing instructions describe the current uv and Makefile based workflow.

Fixed

- A `style` attribute or `<style>` rule whose value contains a colon or a
  semicolon, such as `cursor: url(http://example.com/c.cur), auto` or a data
  URL, no longer makes `svg2rlg()` fail with `ValueError` or truncates the
  value. Declarations are now parsed with `tinycss2`, malformed ones are
  skipped, and `!important` and comments are no longer part of the value
- `baseline-shift` on text is now also read from `style` attributes and
  `<style>` rules, and a percentage is taken relative to the font size instead
  of being used as a length in user units. A value on an enclosing `<g>` does
  not affect the text, as the property is not inherited
- `stroke-dasharray` values that SVG calls invalid (any negative length, or a
  list that sums to zero) no longer produce an invalid PDF dash pattern and
  raise `ValueError` while rendering; they give a solid line. `none` no longer
  relies on a swallowed exception, and an odd number of values is repeated once
  to make it even, as the specification requires
@
text
@$NetBSD: distinfo,v 1.5 2026/10/24 09:03:40 adam Exp $

BLAKE2s (svglib-2.4.0.tar.gz) = 583472881c15f69e3495589f7087a061f7007ec97c3a2fe5cdb4648dc623cb3b
SHA512 (svglib-2.4.0.tar.gz) = 195953a568492c6719a0ce2a60b04cbb2e5fb8609ae8a3dc513e16abfef682e8c1cd68d339c46df40ba01cff7816799e058871b112c57a94f33bdf54f71e5378
Size (svglib-2.4.0.tar.gz) = 1393162 bytes
@


1.5
log
@py-svglib: updated to 2.3.2

2.3.2 (2026-10-23)

Security

- A long run of digits in the arguments of a path arc command (`A` or `a`)
  could make parsing take exponential time, so a tiny SVG could block a
  process for minutes or longer (CWE-1333, CWE-400, GHSA-249c-7rgc-f52h).
  Arc arguments are now read one token at a time, without regex backtracking.
  Parsing of a malformed arc stops at the first argument that does not fit.

Fixed

- Accept explicit plus signs on arc rotation and endpoints, and tab, carriage
  return and line feed separators in transform arguments, as allowed by SVG
- `svg2rlg()` no longer unpacks a `.svgz` file to a sibling `.svg` file, which
  overwrote an existing file of that name and then deleted it. The compressed
  data is now read as a stream
- A `<use>` that refers to itself, or to a cycle of elements that each `<use>`
  the next one, no longer crashes with `RecursionError`. The offending `<use>`
  is skipped and an error is logged, as already done for cyclic references
  between external files

2.3.1 (2026-10-22)

Security

- Rendering an SVG could be made to take exponential time and memory through
  nested `<use>` elements, where each level references a group containing many
  `<use>` elements of the previous level (CWE-400, GHSA-555j-qj3j-c8jv).
  `renderUse()` now stops after `MAX_USE_EXPANSIONS` (10,000) expansions per
  document, logs one error and skips the remaining `<use>` elements. The budget
  is shared with the renderers of external SVG files, so referencing many
  external files does not reset it.
@
text
@d1 1
a1 1
$NetBSD: distinfo,v 1.4 2026/08/20 05:40:44 adam Exp $
d3 3
a5 3
BLAKE2s (svglib-2.3.2.tar.gz) = c7f4474ee258f76187888d2254e5fd4328b07ffb9d9b287a15c8aed581a77962
SHA512 (svglib-2.3.2.tar.gz) = 114ab498304d44ce913c8d8a50c68720b0a5c4b00980c34df9197b2166291bb4831a51ff799f4b566656c03479d5f8b4b29b1822ea80f4154f2cb81ff3df3cac
Size (svglib-2.3.2.tar.gz) = 1381814 bytes
@


1.4
log
@py-svglib: updated to 2.2.0

2.2.0 (2026-08-14)

Tooling and housekeeping

- Modernized type annotations across `src/svglib/` and `tests/` to use PEP
  585 builtin generics (`list[...]`, `dict[...]`, `tuple[...]`, `set[...]`)
  instead of `typing.List`/`Dict`/`Tuple`/`Set`, and simplified a few
  emptiness/membership checks (`not points` instead of `len(points) == 0`,
  a set literal instead of a list for `in` checks). No behavior change.
- Silenced a `UserWarning` from `test_convert_pdf_png` that came from
  ReportLab's own `renderPM.drawImage`, not from svglib: it reopens a
  `<image>` file referenced by path and converts it straight to RGB without
  normalizing palette-with-transparency PNGs first, unlike svglib's own
  handling of base64-embedded images. The referenced PNG (a dedicated
  tRNS-chunk test fixture) still renders correctly; there was nothing to fix
  in svglib's output.

Fixed

- `font-size` no longer has `PX_TO_PT` applied twice. The viewport group
  already carries the conversion, but `String.fontSize` and the advance widths
  used to position text fragments were converted to points as well. Text
  therefore rendered at 0.75x the size of the geometry in the same document,
  and multi-`tspan` runs were laid out in the wrong unit. Both now
  stay in user units, like every other coordinate below the transform.
  `String.fontSize` in the shape tree is in user units accordingly; multiply by
  the enclosing group's transform to get the rendered size.
@
text
@d1 1
a1 1
$NetBSD: distinfo,v 1.3 2026/08/09 11:04:40 adam Exp $
d3 3
a5 3
BLAKE2s (svglib-2.2.0.tar.gz) = 7d982f30c746e4bd4cf40ad338eb2a6bd07a58dc90255d6d3437589427aae121
SHA512 (svglib-2.2.0.tar.gz) = b5c3927e25e7d21700b159acfa1ae34a211682d4eebf153886691eef353f30c51e63f1fd7d6103c542f7ffa8e8e5ea9d9bdb99caeb59003534ab550c1935ff1b
Size (svglib-2.2.0.tar.gz) = 1373629 bytes
@


1.3
log
@py-svglib: updated to 2.1.0

2.1.0 (2026-08-01)

Added

- Declared support for **Python 3.14** (added the classifier and CI matrix
  entry across Ubuntu, macOS, and Windows, alongside the existing 3.9–3.13).
- **Clipping paths** now support `<circle>`, `<ellipse>`, and `<polygon>` clip
  shapes, in addition to paths and rectangles, and clipping masks referenced
  from within a `<use>` element.
- Transforms are now applied to clipping-path shapes, fixing clip paths that
  relied on previously unsupported transforms.
- The gradient shape classes now implement `getBounds()`, so drawings that
  contain gradient fills can be measured — for example when used as a flowable
  by rst2pdf.

Changed

- Renamed the gradient shape classes `_LinearGradientShape` and
  `_RadialGradientShape` to `LinearGradientShape` and `RadialGradientShape`.
  They appear in the rendered `Drawing` tree and were never meant to be
  private, so the leading underscore was misleading.

Removed

- Removed the deprecated `_LinearGradientShape` and `_RadialGradientShape`
  aliases. Use `LinearGradientShape` and `RadialGradientShape` instead.

Fixed

- The `visibility` property is now respected on shapes. Elements with
  `visibility="hidden"` (or `collapse`), set directly or inherited from an
  ancestor, were still rendered.

- `display: none` set through a `style` attribute is now respected. Only the
  `display` presentation attribute was read, so `<g style="display:none">` and
  `<rect style="display:none"/>` were still rendered.

- Embedded `<image>` geometry is no longer truncated to whole points. The
  `x`, `y`, `width`, and `height` of an SVG `<image>` were each passed through
  `int()`, so a raster placed at fractional coordinates landed up to ~1pt away
  from a vector element with identical coordinates. Because width/height were
  truncated too, the error grew across the image rather than being a constant
  shift.
- `font-family` values are now split per CSS instead of on whitespace. An
  unquoted multi-word name such as `font-family: Cascadia Code` was split into
  `Cascadia` and `Code`, so a font registered under its full name was never
  found. Commas inside a quoted name (`font-family: "Foo, Bar",
  Arial`) no longer split the list either; that previously handed `shlex` an
  unbalanced quote and raised `ValueError: No closing quotation`, aborting the
  conversion of a valid value.
- Replaced `locale.getdefaultlocale()` (used for `<switch>` `systemLanguage`
  matching) with a small environment-variable lookup. `getdefaultlocale()` is
  deprecated and is **removed in Python 3.15**; the replacement keeps the same
  behaviour, emits no deprecation warning on 3.12–3.14, and adds unit tests for
  the language-matching path.
- Clipping paths now support the `clip-rule` attribute instead of incorrectly
  using `fill-rule`.
- `fill="url(...)"` and gradient `xlink:href` values are now matched correctly
  when the referenced id is quoted (`url('#name')`, `url("#name")`) or
  contains a right parenthesis; the previous regex rejected or truncated
  these forms.
- Rendering to `reportlab.graphics.renderSVG.SVGCanvas` (as used by
  `easy-thumbnails[svg]`) no longer raises
  `AttributeError: 'SVGCanvas' object has no attribute 'beginPath'` when
  drawing a clipped gradient; that canvas doesn't implement `beginPath()`,
  so the gradient's clip path is now skipped on it instead of erroring.

Type safety and internal quality (no behavior change)

- Completed static type annotations for `svglib.py`; the package now passes
  `mypy --strict` on its own source, with a single documented per-module
  override for the untyped reportlab/cssselect2 base classes it subclasses.
- Pinned a `[tool.mypy]` configuration in `pyproject.toml` and now enforce mypy
  in CI (new `type-check.yml` workflow) and via a local pre-commit hook, so type
  regressions fail before merge.
- Tightened internal gradient handling types: parsed gradient definitions now
  use a `TypedDict` instead of an opaque `Dict[str, Any]`, and the internal
  group/parent parameters are typed as `Optional[Group]`.
- Added docstrings to the remaining undocumented functions in `svglib.py`,
  bringing documentation coverage to 100%.

Tooling and housekeeping

- Removed the DeepSource configuration. Its checks were redundant with ruff,
  `mypy --strict`, CodeQL, and the pytest matrix, and only produced recurring
  noise on pull requests.
- Removed the long-defunct `uniconv` sample tests. They contained no assertions
  and shelled out to UniConvertor, an abandoned Python 2 tool, so they had been
  permanently skipped.
- Fixed and revived the Windows CI workflow. It was a disabled placeholder that
  compiled GTK/Cairo from source (a ~20–40 minute step); it now runs a real
  CPython 3.9/3.13 matrix in well under a minute by dropping the source build
  and skipping the network-heavy sample tests on Windows (they already run on
  Ubuntu and macOS). The redundant manual Windows workflow was removed.
@
text
@d1 1
a1 1
$NetBSD: distinfo,v 1.2 2026/07/14 13:22:34 adam Exp $
d3 3
a5 3
BLAKE2s (svglib-2.1.0.tar.gz) = 8bf9f864acd79b4968beb3faeae1f33223e44de7adf6c1f4c8627791bf0bb3b6
SHA512 (svglib-2.1.0.tar.gz) = c2b06501e8d70ce840d9390f71ed5676eb12e5ba6619b5eeb76db00f047cb16493c2e7cc36d98db9463dcd8289c797be181cca9c46ae6c52aff49b27c2b12d03
Size (svglib-2.1.0.tar.gz) = 1371234 bytes
@


1.2
log
@py-svglib: updated to 2.0.2

2.0.2 (2026-06-18)

Supply-chain hygiene release — no code changes.

The 2.0.1 PyPI attestation was generated by a manual `workflow_dispatch` run
from `refs/heads/main` that raced ahead of the release event. As a result the
Sigstore certificate embedded in the PEP 740 attestation identified
`refs/heads/main` as the source rather than `refs/tags/v2.0.1`, making it
impossible to verify the package against the tagged commit. This release is
published exclusively via the `release: [published]` trigger so the attestation
identity is `refs/tags/v2.0.2`.

2.0.1 (2026-06-17)

Supply-chain hygiene release — no code changes.

This release replaces 2.0.0, which was published directly with `uv publish`
and therefore lacked the PEP 740 provenance attestation that was present in
1.6.0. Releases must be triggered via the GitHub Actions release workflow
(`publish-to-pypi.yml`), which uses PyPI Trusted Publishing (OIDC) to produce
a SLSA Level 3 attestation. Publishing locally — even with
`uv publish --trusted-publishing` — relies on a local OAuth identity and does
not meet that bar.

- Declare `pillow>=9.0.0` as a direct dependency; it was previously an
  undeclared transitive dependency pulled in by reportlab.

2.0.0 (2026-06-16)

Identical to 2.0b1 in terms of code; this release promotes the beta to a
stable release and converts the project documentation files from RST to
Markdown format.

2.0b1 (2026-05-26)

**Breaking change — output sizes will differ from 1.x.**

svglib now correctly maps SVG user units to ReportLab points using the
standard SVG/CSS conversion factor: 1 px = 0.75 pt (96 dpi). Previous
releases treated 1 user unit as 1 pt, which is 33 % too large. Any SVG
whose `width`/`height` or `viewBox` uses user units or `px` will
produce a PDF that is 75 % of its previous linear dimensions (same
proportions, correct physical size).
@
text
@d1 1
a1 1
$NetBSD: distinfo,v 1.1 2025/12/28 14:28:55 adam Exp $
d3 3
a5 3
BLAKE2s (svglib-2.0.2.tar.gz) = 6a89746f689dfe68d88a09aa78243e7c99d0fb8562530a3010e16402f85acb43
SHA512 (svglib-2.0.2.tar.gz) = 695bd1aa17cd590c2d3bb5a4745d253d52b34f330c717c32ebaa8dceb13b5e442346f4fc848f962f16aa22cf6a2bde0eed2ef1466b76d7eb519487fab0fa3609
Size (svglib-2.0.2.tar.gz) = 1341040 bytes
@


1.1
log
@py-svglib: added version 1.6.0

Svglib is a Python library for reading SVG files and converting them (to a
reasonable degree) to other formats using the ReportLab Open Source toolkit.
@
text
@d1 1
a1 1
$NetBSD: distinfo,v 1.53 2025/12/22 10:03:25 adam Exp $
d3 3
a5 3
BLAKE2s (svglib-1.6.0.tar.gz) = 320f08c04dcd75feb9cbe8870310f09ce344f9d5b70fdb2b6256bae43fa46e2f
SHA512 (svglib-1.6.0.tar.gz) = 7d6e30629b409cbdf80de3278a6b7a67ae4a3d82cd83c6f53cb72c21b59839eafbef4d34989621744773f9c7ba47b6cbe86d8f8b222054ff016061a740bf2bc2
Size (svglib-1.6.0.tar.gz) = 1318276 bytes
@