Merge with Debian's 2.54.7

[Nathan Teodosio]

CVE-2023-38633.patch applied upstream, dropped.

Builds succeed[1] dropping delta on debian/rules; Debian's changes suffice.

Also keeping Debian's hunk refreshes on patches.

[1] https://launchpad.net/~nteodosio/+archive/ubuntu/rebuilds/+sourcepub/15066607/+listing-archive-extra

[Brian Murray (brian-murray)]

While the merge looks great from a sponsoring perspective I'm curious about what is the reasoning behind doing this merge? From what I can tell the new version has multiple tests disabled and does not include any changes which would benefit users or developers. (Our version of librsvg already has the security fix included.) In my opinion holding off until Debian bug 1038447 is fixed would make sense.

diff -Nru librsvg-2.54.5+dfsg/NEWS librsvg-2.54.7+dfsg/NEWS
--- librsvg-2.54.5+dfsg/NEWS 2022-08-26 21:06:23.000000000 +0200
+++ librsvg-2.54.7+dfsg/NEWS 2023-07-23 01:48:21.000000000 +0200
@@ -1,3 +1,15 @@
+Version 2.54.7
+==============
+
+- Fix compilation on rustc < 1.58.
+
+Version 2.54.6
+==============
+
+This is a security release for bug #996.
+
+- #996 - Fix arbitrary file read when href has special characters.
+

...

[Nathan Teodosio (nteodosio)]

Hmm that's true.