(superset) branch master updated: chore(deps): bump fonttools to 4.62.0 (#45383)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git


The following commit(s) were added to refs/heads/master by this push:
     new c645e007054 chore(deps): bump fonttools to 4.62.0 (#45383)
c645e007054 is described below

commit c645e0070548d65bca1d265fb83b3f838b52b379
Author: Alejandro Solares <21...@users.noreply.github.com>
AuthorDate: Mon Oct 26 23:48:04 2026 -0600

    chore(deps): bump fonttools to 4.62.0 (#45383)
    
    Co-authored-by: Claude Opus 5.5 <no...@anthropic.com>
---
 requirements/development.in  | 5 +++++
 requirements/development.txt | 6 ++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/requirements/development.in b/requirements/development.in
index a5ba20f701a..ada7f8229c0 100644
--- a/requirements/development.in
+++ b/requirements/development.in
@@ -65,3 +65,8 @@ zope.interface>=7.2
 # Security: CVE-2026-23949 (Zip Slip path traversal in jaraco.context.tarball)
 # jaraco.context is a transitive dependency (via keyring); 6.1.0 is the first fixed release.
 jaraco.context>=6.1.0
+
+# Security: fonttools (via matplotlib) < 4.62.0 evaluates TTX XML values with
+# eval() in cffLib parseBlendList(), allowing arbitrary code execution from a
+# crafted TTX file (fonttools/fonttools#4039, fixed in 4.62.0 by #4040).
+fonttools>=4.62.0,<5.0.0
diff --git a/requirements/development.txt b/requirements/development.txt
index 5795442a28f..5ccec1f2d64 100644
--- a/requirements/development.txt
+++ b/requirements/development.txt
@@ -365,8 +365,10 @@ flask-wtf==1.3.0
     #   -c requirements/base-constraint.txt
     #   apache-superset
     #   flask-appbuilder
-fonttools==4.60.2
-    # via matplotlib
+fonttools==4.62.0
+    # via
+    #   -r requirements/development.in
+    #   matplotlib
 freezegun==1.5.1
     # via apache-superset
 frozenlist==1.8.0