librsvg - Debian Package Tracker

general

source: librsvg (main)
version: 2.63.2+dfsg-1
maintainer: Debian GNOME Maintainers (archive) (DMD)
uploaders: Laurent Bigonville [DMD] – Emilio Pozuelo Monfort [DMD] – Jeremy Bícha [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.50.3+dfsg-1+deb11u1
o-o-sec: 2.50.3+dfsg-1+deb11u1
oldstable: 2.54.7+dfsg-1~deb12u1
old-sec: 2.54.7+dfsg-1~deb12u1
stable: 2.60.0+dfsg-1
testing: 2.62.1+dfsg-1
unstable: 2.63.2+dfsg-1

versioned links

2.50.3+dfsg-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.54.7+dfsg-1~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.60.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.62.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.63.2+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gir1.2-rsvg-2.0
librsvg2-2 (11 bugs: 0, 11, 0, 0)
librsvg2-bin (15 bugs: 0, 12, 3, 0)
librsvg2-common (5 bugs: 0, 5, 0, 0)
librsvg2-dev
librsvg2-doc
librsvg2-tests

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-96889: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Created: 2026-09-24 Last update: 2026-10-03 15:48

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-96889: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Created: 2026-09-24 Last update: 2026-10-03 15:48

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-96889: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Created: 2026-09-24 Last update: 2026-10-03 15:48

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

librsvg2-tests could be marked Multi-Arch: same

Created: 2026-10-06 Last update: 2026-10-08 01:00

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-04-15 Last update: 2026-10-08 00:30

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 909e0219a5d1ad18ad982730d28cbf7690b6676a
Author: Jeremy Bícha <jbicha@ubuntu.com>
Date:   Sat Oct 3 17:22:18 2026 +0200

    Opt into Salsa CI

Created: 2026-10-04 Last update: 2026-10-04 04:46

testing migrations

excuses:
- Migration status for librsvg (2.62.1+dfsg-1 to 2.63.2+dfsg-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for asymptote/3.15+ds-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for auto-multiple-choice/1.7.0-6: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for breathe/4.36.0-2: arm64: Pass ♻, i386: Pass ♻, ppc64el: Pass ♻
- ∙ ∙ Autopkgtest for breathe/5.1.0-1: amd64: Pass, armhf: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for cairo-5c/1.25: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for chafa/1.18.2-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: No tests, superficial or marked flaky ♻
- ∙ ∙ Autopkgtest for conky/1.24.2+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for desktop-base/14.0.0~pre3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for ffmpeg/7:9.0.2-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for flowblade/2.24.2-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for formiko/2.0.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for gdm3/50.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for gegl/1:0.4.72-2: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: No tests, superficial or marked flaky ♻
- ∙ ∙ Autopkgtest for gimp/3.2.6-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for glycin/2.2.1+ds-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Regression ♻ (reference ♻), s390x: Pass
- ∙ ∙ Autopkgtest for gnome-mastermind/0.4.0-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for gnome-shell/50.5-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for gramps/6.0.8+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for graphviz/14.1.2-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for gst-plugins-bad1.0/1.28.7-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for gtk+3.0/3.24.52-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for gtk4/4.24.0+ds-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for hyprcursor/0.1.13-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for hyprgraphics/0.5.1-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for ibus/1.5.35~beta2-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for libgtk3-imageview-perl/12-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for libimage-librsvg-perl/0.07-12: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for librsvg/2.63.2+dfsg-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for mat2/0.15.0-1: amd64: Failed (not a regression) ♻ (reference ♻), arm64: Failed (not a regression) ♻ (reference ♻), armhf: Failed (not a regression) ♻ (reference ♻), i386: Failed (not a regression) ♻ (reference ♻), ppc64el: Failed (not a regression) ♻ (reference ♻), riscv64: Test triggered, s390x: Failed (not a regression) ♻ (reference ♻)
- ∙ ∙ Autopkgtest for node-canvas/3.2.3+dfsg-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for plastex/3.1-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for proton-vpn-gtk-app/4.15.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for publican/4.3.2-7: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for pysdl2/0.9.17+dfsg-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for qtile/0.36.0-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: No tests, superficial or marked flaky ♻
- ∙ ∙ Autopkgtest for r-cran-partitions/1.11-1+ds-1: amd64: Pass, arm64: Pass, ppc64el: Pass, riscv64: Test triggered
- ∙ ∙ Autopkgtest for r-cran-rsvg/2.7.0-1: amd64: Pass, arm64: Pass, ppc64el: Pass, riscv64: Test triggered
- ∙ ∙ Autopkgtest for railroad-diagrams/3.0.1+20260511+git736dec7-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for rust-librsvg-rebind/0.3.0-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for rust-librsvg-rebind-sys/0.3.0-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for scour/0.38.2-6: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for shutter/0.99.6-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for sphinx/9.1.0-8: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for sympy/1.14.0-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for tryton-client/7.0.43-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for vlc/3.0.24-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for xdg-desktop-portal/1.22.1+ds-1: amd64: Pass, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/libr/librsvg.html
- ∙ ∙ Not reproduced on amd64 (not a regression): librsvg2-2, librsvg2-dev
- ∙ ∙ Not reproduced on arm64 (not a regression): librsvg2-2, librsvg2-dev
- ∙ ∙ Not reproduced on armhf (not a regression): librsvg2-2, librsvg2-dev
- ∙ ∙ Not reproduced on i386 (not a regression): librsvg2-2, librsvg2-dev
- ∙ ∙ 5 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-10-03] Accepted librsvg 2.63.2+dfsg-1 (source) into unstable (Jeremy Bícha)
[2026-04-14] librsvg 2.62.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-04-08] Accepted librsvg 2.62.1+dfsg-1 (source) into unstable (Jeremy Bícha)
[2025-12-18] librsvg 2.61.3+dfsg-3 MIGRATED to testing (Debian testing watch)
[2025-12-10] Accepted librsvg 2.61.3+dfsg-3 (source) into unstable (Jeremy Bícha)
[2025-11-11] librsvg 2.61.3+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-11-04] Accepted librsvg 2.61.3+dfsg-2 (source) into unstable (Jeremy Bícha)
[2025-11-04] Accepted librsvg 2.61.3+dfsg-1 (source) into experimental (Jeremy Bícha)
[2025-10-28] Accepted librsvg 2.61.2+dfsg-1 (source) into experimental (Jeremy Bícha)
[2025-03-24] librsvg 2.60.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-03-19] Accepted librsvg 2.60.0+dfsg-1 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
[2025-02-17] librsvg 2.59.90+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-02-12] Accepted librsvg 2.59.90+dfsg-2 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
[2025-02-11] Accepted librsvg 2.59.90+dfsg-1 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-11-26] Accepted librsvg 2.59.2+dfsg-1 (source) into unstable (Nathan Pratta Teodosio) (signed by: Sebastien Bacher)
[2024-10-06] librsvg 2.59.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-09-30] Accepted librsvg 2.59.1+dfsg-1 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-09-20] librsvg 2.59.0+dfsg-3 MIGRATED to testing (Debian testing watch)
[2024-09-14] Accepted librsvg 2.59.0+dfsg-3 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-09-14] Accepted librsvg 2.59.0+dfsg-2 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-09-13] Accepted librsvg 2.59.0+dfsg-1 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-09-11] Accepted librsvg 2.58.94+dfsg-3 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-09-10] Accepted librsvg 2.58.94+dfsg-2 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-09-04] Accepted librsvg 2.58.94+dfsg-1 (source) into experimental (Alessandro Astone) (signed by: Jeremy Bicha)
[2024-08-27] Accepted librsvg 2.58.93+dfsg-5 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-08-21] Accepted librsvg 2.58.93+dfsg-4 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-08-15] Accepted librsvg 2.58.93+dfsg-3 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-08-15] Accepted librsvg 2.58.93+dfsg-2 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-08-15] Accepted librsvg 2.58.93+dfsg-1 (source) into experimental (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-04-27] librsvg 2.58.0+dfsg-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 38 39
RC: 1
I&N: 33 34
M&W: 4
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.62.1+dfsg-1
33 bugs (1 patch)