Scheduled weekly dependency update for week 40

[pyup-bot]

Update fonttools[lxml,unicode,repacker,ufo] from 4.42.0 to 4.43.0.

Changelog

4.43.0

----------------------------

- [subset] Set up lxml ``XMLParser(resolve_entities=False)`` when parsing OT-SVG documents
to prevent XML External Entity (XXE) attacks (9f61271dc):
https://codeql.github.com/codeql-query-help/python/py-xxe/
- [varLib.iup] Added workaround for a Cython bug in ``iup_delta_optimize`` that was
leading to IUP tolerance being incorrectly initialised, resulting in sub-optimal deltas
(60126435d, cython/cython5732).
- [varLib] Added new command-line entry point ``fonttools varLib.avar`` to add an
``avar`` table to an existing VF from axes mappings in a .designspace file (0a3360e52).
- [instancer] Fixed bug whereby no longer used variation regions were not correctly pruned
after VarData optimization (3268).
- Added support for Python 3.12 (3283).

4.42.1

----------------------------

- [t1Lib] Fixed several Type 1 issues (3238, 3240).
- [otBase/packer] Allow sharing tables reached by different offset sizes (3241, 3236).
- [varLib/merger] Fix Cursive attachment merging error when all anchors are NULL (3248, 3247).
- [ttLib] Fixed warning when calling ``addMultilingualName`` and ``ttFont`` parameter was not
passed on to ``findMultilingualName`` (3253).

Links

• PyPI: https://pypi.org/project/fonttools
• Changelog: https://data.safetycli.com/changelogs/fonttools/
• Repo: http://github.com/fonttools/fonttools

Update glyphsLib from 6.2.5 to 6.4.1.

Changelog

6.4.1

- Do not set unicode codepoints for COLRv1 layer glyphs to prevent ufo2ft raising error about duplicate unicode mappings (947, 946).

6.4.0

* Require Python >= 3.8 (935)
* Improved handle production names for ligatures (770, 771)
* Do not set Unicode values for each layer in a COLRv0 color glyph (937, 939)

6.3.0

- Support contextual anchors (921).
- Support loading UIState.plist file from .glyphspackage (933).
- Accept .glyphspackage path directly in GSFont's constructor (932).

Links

• PyPI: https://pypi.org/project/glyphslib
• Changelog: https://data.safetycli.com/changelogs/glyphslib/
• Repo: https://github.com/googlefonts/glyphsLib

Update compreffor from 0.5.3 to 0.5.5.

Changelog

0.5.5

Dropped support for Python 3.7, added support for Python 3.12

0.5.4

- Use old_build_ext for Cython 3 compatibility
- Replace deprecated license_file with license_files in setup.cfg

No code changes in the main lib code.

Links

• PyPI: https://pypi.org/project/compreffor
• Changelog: https://data.safetycli.com/changelogs/compreffor/

Update orjson from 3.9.3 to 3.9.7.

Changelog

3.9.7

Fixed

- Fix crash in `orjson.loads()` due to non-reentrant handling of persistent
buffer. This was introduced in 3.9.3.
- Handle some FFI removals in CPython 3.13.

3.9.6

Fixed

- Fix numpy reference leak on unsupported array dtype.
- Fix numpy.datetime64 reference handling.

Changed

- Minor performance improvements.

3.9.5

Fixed

- Remove futex from module import and initialization path.

3.9.4

Fixed

- Fix hash builder using default values.
- Fix non-release builds of orjson copying large deserialization buffer
from stack to heap. This was introduced in 3.9.3.

Links

• PyPI: https://pypi.org/project/orjson
• Changelog: https://data.safetycli.com/changelogs/orjson/
• Repo: https://github.com/ijl/orjson

[pyup-bot]

Closing this in favor of #1046