fix(deps): Bump fonttools to address cve

[CyMule]

Note

Constrain fonttools to >=4.60.2 (CVE-2025-66034), bump extras to 4.61.0, switch setup_ingest to ubuntu-latest-m, and release 0.18.22.

• Dependencies:
  • Constrain fonttools>=4.60.2 in requirements/deps/constraints.txt to address CVE-2025-66034.
  • Bump fonttools to 4.61.0 in requirements/extra-*.txt; refresh files via uv and align constraint references.
• CI:
  • Update setup_ingest job in .github/workflows/ci.yml to run on ubuntu-latest-m.
• Release:
  • Bump version to 0.18.22 and update CHANGELOG.md.

^{Written by Cursor Bugbot for commit 6ec072e. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​fonttools@​4.60.1 ⏵ 4.61.0	+1	+2

View full report

[lawrence-u10d]

Same here, should we say 4.61.0?

[CyMule]

updated to Constrain fonttools to >=4.60.2 to address CVE-2025-66034

[cursor]

Bug: Fonttools constraint version may allow vulnerable versions

The constraint fonttools>=4.60.2 is inconsistent with the pinned version 4.61.0 in the resolved requirements files. According to Snyk, 4.61.0 is listed as the "latest non vulnerable version" for CVE-2025-66034. The PR discussion also questions whether the constraint should specify 4.61.0 instead. If the CVE fix is actually in version 4.61.0 rather than 4.60.2, the current constraint would allow installation of still-vulnerable versions (4.60.2, 4.60.3, etc.).

Additional Locations (1)

• CHANGELOG.md#L3-L4

 

[CyMule]

the link here shows it is patched in 4.60.2. same with https://nvd.nist.gov/vuln/detail/CVE-2025-66034
4.60.2 is fine and so is 4.61.0