Bump fonttools from 4.62.1 to 4.64.0

[dependabot]

Bumps fonttools from 4.62.1 to 4.64.0.

Release notes

Sourced from fonttools's releases.

4.64.0

• [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
• [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
• [subset] Keep East Asian spacing palt by default (#4094).
• [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
• [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
• [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
• [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
• [ttLib] Add support for TrueType Collection version 2 (#4100).
• [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
• [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
• [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
• [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
• [misc.roundTools] Add types and documentation (#4123).
• [varLib.instancer] Instance the BASE table (#4137).
• [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
• [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
• [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
• [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
• [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
• [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
• [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
• [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
• [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
• [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
• [cmap] Don't drop subtables in unsupported formats when compiling or dumping a font read from binary (#4136).
• [ttLib] Implement splitSinglePos so GPOS lookup type 1 offset overflows can be recovered by splitting the subtable (#4091, #4108).
• [cmap] Round-trip empty Macintosh format 2 subtables (#3663, #4117).
• [glyf] Raise TTLibError instead of RecursionError when recalcBounds() hits a composite-component reference cycle (#3899, #4116).
• [svgLib] Fix crash parsing an SVG path with consecutive closepath commands (Z Z) (#4122).
• [ttLib] Fix DefaultTable type annotations (#4126).
• [ttLib] Add support for the EBSC (Embedded Bitmap Scaling) table (#4113).
• [svgLib] Suppress spurious close segments caused by floating-point drift in relative path commands (#3860, #4127).
• [qu2cu] Fix TypeError in the Cython-compiled build when Qu2CuPen passes tuple splines (#4160).
• [mort] Add semantic decompilation, TTX, and compilation support for rearrangement, contextual-substitution, ligature, and insertion subtables (#4158, #4159, #4161).
• [svgLib] Start a new subpath at the just-closed subpath's initial point when a drawto command follows a closepath, per SVG spec (#4154, #4155).
• [misc.filesystem] SECURITY Reject paths that resolve outside the filesystem root: a malicious UFO could read arbitrary files via .. components in contents.plist, and a crafted .ufoz could create files outside its temporary mirror (#4124).
• [ttLib] SECURITY Sanitise glyph names used as filenames in EBDT/CBDT ttx -z extfile export, preventing arbitrary file writes from untrusted fonts (#4128).
• [misc.etree] SECURITY Don't resolve external XML entities in XMLParser when lxml is used, preventing XXE file disclosure on lxml < 5.0 (#4145).
• [subset] Fully prune VARC auxiliary data: collect and remap variation indices referenced by condition tables when subsetting the MultiVarStore, and drop the AxisIndicesList, ConditionList, and MultiVarStore when they end up empty (#4162).

4.63.0

• [ttLib] Add support for Apple Color Emoji bgcl table (#4065).
• [ttLib] Add support for IFT and IFTX tables (Incremental Font Transfer, PatchMapFormat2) (#4070, #4072).
• [otData] Introduce FieldSpec dataclass for OpenType table schema definitions, replacing raw tuples in otData.py (#4076).
• [Feat] Show name table strings as comments next to label IDs in TTX output, matching the convention used by fvar, STAT, trak (#4089).
• [cu2qu] Fix Cython complex-division rounding difference in split_cubic_into_three that could cause ±1 off-curve coordinate shifts (#3928, #4083).
• [designspaceLib] Fix map_backwardgooglefonts/ufo2ft#978#4085).
• [OS/2] Fix setUnicodeRanges to accept reserved bits 123-127, restoring round-trip with getUnicodeRanges and fixing recalcUnicodeRanges crash in the subsetter (#4087, #4088).
• [cython] Declare Cython extensions as free-threading compatible on Python 3.13+, so that importing them on free-threaded Python no longer re-enables the GIL (#4073, #4090).

Changelog

Sourced from fonttools's changelog.

4.64.0 (released 2026-08-31)

• [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
• [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
• [subset] Keep East Asian spacing palt by default (#4094).
• [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
• [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
• [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
• [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
• [ttLib] Add support for TrueType Collection version 2 (#4100).
• [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
• [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
• [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
• [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
• [misc.roundTools] Add types and documentation (#4123).
• [varLib.instancer] Instance the BASE table (#4137).
• [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
• [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
• [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
• [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
• [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
• [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
• [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
• [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
• [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
• [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
• [cmap] Don't drop subtables in unsupported formats when compiling or dumping a

... (truncated)

Commits

• 37dfa71 Release 4.64.0
• 5cab496 Update NEWS.rst [skip ci]
• 6f1429b [subset] Fully prune VARC auxiliary data (#4162)
• 93fc470 Merge pull request #4145 from insaf021/etree-no-external-entities
• 1ce6993 [misc.etree] only override resolve_entities on lxml < 5.0
• 9c10287 Merge pull request #4128 from insaf021/ebdt-extfile-basename
• 53e2b0b [E_B_D_T_] don't let sanitised glyph names collide
• 3bbd268 Merge pull request #4124 from insaf021/osfs-path-containment
• 6840516 [misc.filesystem] simplify containment check, pin symlink strictness
• 8f4b4ee [misc.filesystem] don't publish a half-built zip directory mirror
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
fair-code	Ready	Preview	Sep 4, 2026 9:45am UTC

[github-actions]

@yakew7 - new PR touching a path you own, please review.