[dependabot]

Bumps resvg from 0.46.0 to 0.48.1.

Release notes

Sourced from resvg's releases.

v0.48.1

• resvg-0.*.0.tar.xz is a sources archive with vendored Rust dependencies
• resvg-explorer-extension.exe is an SVG thumbnailer for Windows Explorer

Check CHANGELOG.

v0.48.0

• resvg-0.*.0.tar.xz is a sources archive with vendored Rust dependencies
• resvg-explorer-extension.exe is an SVG thumbnailer for Windows Explorer

Check CHANGELOG.

v0.47.0

• resvg-0.*.0.tar.xz is a sources archive with vendored Rust dependencies
• resvg-explorer-extension.exe is an SVG thumbnailer for Windows Explorer

Check CHANGELOG.

Changelog

Sourced from resvg's changelog.

[0.48.1] 2026-08-02

This release has an MSRV of 1.85.0 for usvg and resvg and the C API.

Changed

• MSRV lowered from 1.89 to 1.85. (#1109)
• Downgraded strict-num dependency to 0.1.1. This prevents duplicate versions from being included (#1110)

Fixed

• Fixed an as_mut_slice future-compatibility warning. (#1108)

[0.48.0] 2026-07-31

This release has an MSRV of 1.89.0 for usvg and resvg and the C API.

The big change in this release is that text support is now backed by skrifa and harfrust rather than ttf-parser and rustybuzz:

• Moves resvg onto an actively maintained font stack.
• Should have faster and more correct text rendering.
• Will enable further improvements to things like variable font rendering in future.
• May impact binary size (expected +~500kb for people not otherwise including fontations dependencies in their tree).
• May result in small rendering changes compared to older versions of resvg.

Added

• New svgz and writer feature gates to reduce the number of required dependencies. (#1088 by @​reed-smout)
• Warnings when parsing malformed paths. (#1011)
• A Display implementation for Units. (#986)

Changed

• MSRV bumped from 1.87 to 1.89. The requirement comes from font-types.
• Text shaping now uses harfrust instead of rustybuzz, and font parsing uses skrifa (fontations) instead of ttf-parser. (#922 by @​nicoburns)
• Filter input dimension checks are now debug-only assertions. (#991)

Fixed

• Glyph advances are now calculated correctly. (#1043 by @​fundon)
• Text nodes now inherit their absolute transform. (#1040 by @​fundon)
• Fixes related to non-finite values. (#1049 by @​SAY-5)
• Transforms are no longer applied twice in abs_transform. (#1056 by @​fundon)
• fr is now resolved for radial gradients referenced via href. (#1098 by @​T1mVo)
• Panic in feComposite with the arithmetic operator when the filter region is larger than the clamped layer. (#1021, #1007)
• Application of transform (and other group properties like opacity) on a nested svg

... (truncated)

Commits

• 68b14c4 Prepare v0.48.1 release (#1111)
• 649f488 Reduce strict-num dependency back down to 0.1.1 (#1110)
• 3785e57 Reduce MSRV to 1.85 (#1109)
• 7a2fe59 Fix as_mut_slice future-compatibility warning (#1108)
• af7573d Prepare v0.48 release (#1105)
• 779e4b7 Update README + changelog (#1107)
• 35a9781 Clamp too large bboxes instead of panicking (#989)
• 3f37a8c Fix y-axis offset in feSpotLight transform_light_source (#1052)
• b5e749a Change some assertions to debug assertions (#991)
• 376fafb Make href take precedence over xlink:href (#1080)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0c3f5499-f50b-42b2-9c56-ec703da3ea72

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

_{Comment @coderabbitai help to get the list of available commands.}

[chukfinley]

landed on master in 5c1d1c9 (rebased onto current master, sha2 needed a small hex::encode fix)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.