Cool, it supports building with Meson now: https://sourceforge.net/projects/freetype/files/freetype2/2.10.3/

Qutebrowser dev says that CVE-2020-15999 is already exploited in the wild. As there seems to be no patch available, I backported the bump:
nixos-20.09 a583a60
nixos-20.03 3f8fd69

Please shout at me if you think this was a bad idea.

@erictapen, you might need to backport #101215 as well.

Just reverted my backports in e9600da, 9641db6, as they broke at least ghostscript and therefore broke basically anything desktop related…

@TredwellGit Damn I should have read your comment before reverting. I'm somewhat anxious of backporting #101215, as I'm afraid bumping ghostscript will break even more stuff.

Just discovered, that the Archlinux page about CVE-2020-15999 links a patch.

I'll investigate into wether we could just backport this patch without breaking freetype API.

So I decided to apply the mentioned patch to release-20.03 and release-20.09, as

• I'm very confident that this patch actually fixes CVE-2020-15999, due to the commit message and the way it is mentioned in freetype Changelog
• I'm very confident that this doesn't break freetype API, as the patch is very simple and doesn't touch function signatures.
• I managed to build ghostscript with it.

I commited directly to the release branches as I guess we have to find out wether anything breaks anyway and it should happen fast, as this issue seems to get exploited in the wild.

259b0ce, afcf353