Update freetype to 2.15.0 (CVE-2026-50811, CVE-2026-95512) by bryan-minimal · Pull Request #919 · gominimal/pkgs

bryan-minimal · 2026-10-17T19:05:25Z

What this fixes

This PR bumps freetype from 2.14.3 to 2.15.0 (released 2026-10-12). That clears two CVEs the #848 Debian-revision audit found against the version we ship (gominimal/pkgmgr-rs#848):

CVE	bug	fix commit	in VER-2-14-3?	in VER-2-15-0?
CVE-2026-50811	OOB read in `TT_Get_Var_Design` (`src/truetype/ttgxvar.c`)	`5a280ecde6f3`	no (`behind`)	yes (`ahead`)
CVE-2026-95512	CID loader: repeated subroutine allocation/decryption on crafted CID-keyed fonts	`f3ca71c9900f`	no	yes

The ancestry columns come from gh api repos/freetype/freetype/compare/<fix>...<tag> on the official mirror. The 2.15.0 docs/CHANGES also names CVE-2026-95512. Debian fixed both by patching 2.14.3 (2.14.3+dfsg-2, -3). We take the upstream release instead, so we carry no patches.

Release notes worth a look

ABI. libfreetype.so.6, libtool 26:7:20; it was 26:6:20 before. This is a revision bump, so the ABI is compatible.
Large release. 2.15.0 adds ISO OFF Edition 5 support: the new VARC table, fonts with more than 65536 glyphs, and the uppercase MAXP/GLYF/LOCA/… tables. It also changes the TrueType v40 interpreter's ClearType behaviour, and adds an experimental HVF driver (hvf.o is compiled, upstream says it is functional on macOS only). Downstream rendering can change slightly, so the dependents' standalone tests are the real signal here.
Supply-chain check. The tarball's sha256 93cd47eb719c325107f2d3cf087d06299e944c3b48a40b55537302304dea1dd5 is identical from download.savannah.gnu.org and downloads.sourceforge.net. It is uploaded to gs://minimal-staging-archives/freetype-2.15.0.tar.xz, and the object's MD5 matches. The .sig was not GPG-verified, because there is no gpg on the host.

Verification

All of this ran in a min session with the pkgbuild loadout, on arm64.

min package build --rebuild --verbose freetype produced libfreetype.so.6.20.7 and printed build finished.
min check --packages freetype passes every check.
There is no new regression test. Both fixes arrive with the upstream release rather than a carried patch, and we have no crafted font for either CVE. This is a release bump, not a backport.

Provenance is deliberately not added (yet)

freetype still has no source_provenance. Adding one today would be worse than leaving it out. The two candidates, checked against sc main @ bf4dc6d and prod advisories:

'Gitlab gitlab.freedesktop.org/freetype/freetype is the canonical home, and its purl reaches both CVEs. But the Gitlab arm (sc scan.rs:4334-4363) only falls back to the curated freetype:freetype CPE identity when the purl holds zero rows. It holds 20, so we would lose the roughly 95 NVD-CPE advisories. The OSV GIT records it would gain carry VER-X-Y-Z tags and gitlab commit fixes, which the purl path cannot place. They would stay "affected" at every version, including 2.15.0.
'GithubRepo freetype/freetype is the official mirror, and it keeps the curated CPE identity. But ecosystem::git_query_params has no freetype arm, so ancestry asks GitHub for a v2.15.0 tag that doesn't exist (404, inconclusive). normalize_git_tag also leaves VER-2-14-3 unparsed, so the enumerated-versions[] filter fails open. 7 of the 16 matching GIT records have no versions[] at all.

The prerequisite is a minimal-supply-chain change: a "freetype" => VER-{major}-{minor}-{patch} arm in git_query_params, plus VER- handling in normalize_git_tag. After that, GithubRepo freetype/freetype is a one-hunk follow-up. This is tracked in pkgmgr-rs#848.

Rebuild blast radius

28 direct importers: chromiu 8000 m-bin, chromium-headless-shell-bin, ffmpeg, fontconfig, ghostscript, harfbuzz, icedtea-7/8, libass, libgd, pango, and the whole openjdk-9 … openjdk-25 boot-JDK ladder.
33 transitively. That adds agent-browser, cairo, graphviz, mermaid-cli, tamarin-prover.
The JDK ladder rebuilds serially, so expect the longest CI run of this batch.

Refs gominimal/pkgmgr-rs#848

🤖 Generated with Claude Code

2.15.0 (2026-10-12) contains the fix commits for both CVEs. Checked with gh compare on the official mirror: 5a280ecde6f3 (CVE-2026-50811, OOB read in TT_Get_Var_Design) and f3ca71c9900f (CVE-2026-95512, CID loader) are both ancestors of VER-2-15-0, and both are absent from VER-2-14-3. The 2.15.0 CHANGES names CVE-2026-95512. The soname stays libfreetype.so.6 (6.20.6 -> 6.20.7), so the change is ABI-compatible. Tarball sha256 93cd47eb... matches on both download.savannah.gnu.org and downloads.sourceforge.net. It is mirrored to gs://minimal-staging-archives. Refs gominimal/pkgmgr-rs#848 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-17T19:05:36Z

Warning

Review limit reached

Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 26 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 55 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
Review profile: CHILL
Plan: Essentials
Run ID: e666aa13-5495-487f-82f1-957ce2a99917

📥 Commits

Reviewing files that changed from the base of the PR and between 5a26fc2 and 95f4122.

📒 Files selected for processing: 1

packages/freetype/build.ncl

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

norrietaylor

LGTM.

Both fixes are in 2.15.0 and not in 2.14.3: 5a280ecde6f3 (ttgxvar.c, CVE-2026-50811) and f3ca71c9900f (cidload.c, CVE-2026-95512).
The tarball matches VER-2-15-0, the sha256 matches on both SourceForge and staging, and version_info confirms the ABI-compatible .so.6.20.7.
Both sed targets in build.sh still exist.
The 50-minute minimal build covered the dependents.

Omitting source_provenance (tracked in pkgmgr-rs#848) is reasonable.

Generated by Claude Code

bryan-minimal requested a review from a team as a code owner October 17, 2026 19:05

norrietaylor approved these changes Oct 19, 2026

View reviewed changes

bryan-minimal added this pull request to the merge queue Oct 19, 2026

github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Oct 19, 2026

bryan-minimal added this pull request to the merge queue Oct 19, 2026

Merged via the queue into main with commit b154c6b Oct 19, 2026
10 checks passed

bryan-minimal deleted the freetype-cve-backport branch October 19, 2026 21:48

This was referenced Oct 26, 2026

build: bump the pkgs locked_commit for the October security fixes gominimal/minimal#2637

Merged

build: bump the pkgs locked_commit on release/0.7.0 for 0.7.2 gominimal/minimal#2638

Merged

Navigation Menu

Repository navigation

Update freetype to 2.15.0 (CVE-2026-50811, CVE-2026-95512) - #919

Update freetype to 2.15.0 (CVE-2026-50811, CVE-2026-95512)#919
bryan-minimal merged 1 commit into
mainfrom
freetype-cve-backport

Uh oh!

Review limit reached

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

What this fixes

Release notes worth a look

Verification

Provenance is deliberately not added (yet)

Rebuild blast radius

Uh oh!

Review limit reached

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants