SUSE-RU-2026:21283-1: moderate: Recommended update for python-graphviz, graphviz

Mon Apr 27 08:40:55 UTC 2026

# Recommended update for python-graphviz, graphviz

Announcement ID: SUSE-RU-2026:21283-1  
Release Date: 2026-03-05T14:29:01Z  
Rating: moderate  
References:

Affected Products:

  * SUSE Linux Enterprise Server High Availability Extension 16.0

An update that can now be installed.

## Description:

This update for python-graphviz, graphviz fixes the following issues:

Changes in python-graphviz:

Update to 0.21:

  * Drop Python 3.8 support (end of life 7 Oct 2024).
  * Tag Python 3.13 support.
  * Add support for `format=&#x27;svg_inline&#x27;`, available since upstream
    Graphviz 10.0.1. Produces header-less SVG suitable for inlining into HTML
    (see https://www.graphviz.org/docs/outputs/svg/).
  * Switch project to `pyproject.toml` and build to `python -m build`)
    (https://build.pypa.io). This changes the source distribution formar from
    `.zip` to PEP 625 compliant `.tar.gz` (https://peps.python.org/pep-0625/).

Changes in graphviz:

Update to 12.2.1:

  * Added

    * Support for building the SWIG-generated R language bindings has been integrated into the CMake build system. This is controllable by the -DENABLE_R={AUTO|ON|OFF} option.
    * A sandboxing wrapper, dot_sandbox, is now included with Graphviz. Users should prefer their platform’s native security solutions, but if nothing better is available this wrapper offers safe processing of untrusted inputs in some scenarios.
  * Changed

    * JPEG images without an APP0 leading segment are supported for use in src fields and friends. Previously Graphviz was overly strict with the types of JPEGs it would recognize. #2619
    * The CMake build system now discovers and uses pango_fc_font_lock_face if possible, for the Pango plugin to provide more information about used fonts.
  * Fixed

    * The GVPR library program depath no longer acts on previously deleted nodes, causing unpredictable results. #1702 (closed)
    * Void-typed function parameters (int foo(void bar)) and variables void baz; in GVPR are gracefully rejected. #2585 (closed)
    * Input that induce a set node height but no set node width no longer crash with the failure "Assertion failed: (r->boundary[i] <= r->boundary[NUMDIMS + i]), function RTreeInsert". It is typically not obvious to users when their input falls into this situation, hence why the assertion message is quoted here. This was a regression in Graphviz 12.0.0. #2613 (closed)
    * Strings containing double quote characters preceded by escape sequences (e.g. \n") are once again correctly escaped in dot or canonical output. This was a regression in Graphviz 9.0.0. #2614 (closed)
    * dot_builtins no longer lists duplicate format options in its error messages. #2604 (closed)
    * A precision error that resulted in truncated edge lines has been corrected. This was a regression in Graphviz 12.0.0. #2620 (closed)
    * The xlib plugin (-Tx11) resets its initialization state during finalization. This fixes a rare scenario where multiple input graphs are supplied and initialization for one of the not-first graphs fails. In this scenario, finalization would be unaware of this failure and act on invalid state.

Update to 12.2.0:

  * Removed

    * Visual Studio build files have been removed. CMake is now the only supported build system on Windows.
  * Added

    * Support for building the SWIG-generated PHP language bindings has been integrated into the CMake build system. This is controllable by the -DENABLE_PHP={AUTO|ON|OFF} option.
    * Support for building the SWIG-generated Python language bindings has been integrated into the CMake build system. This is controllable by the -DENABLE_PYTHON={AUTO|ON|OFF} option.
  * Changed

    * An algorithm closer to that described in RFC 1942 and/or the CSS 2.1 specification is now used for sizing table cells within HTML-like labels. This is less scalable than the network simplex algorithm it replaces, but in general produces more intuitive results. #2159 (closed)
    * Tooltips on table elements within HTML-like labels are now propagated to SVGs produced by the core plugin (-Tsvg) even when the elements do not have href attributes. #1425 (closed)
    * In the Autotools build system, pkg-config is the only supported way for discovering Guile. Previous use of guile-config* has been removed. #2606 (closed)
    * The Autotools release artifacts for macOS (Darwin_ __graphviz-_.tar.gz) now use relative paths in links to dependent libraries and plugins. This should make the tree relocatable instead of having to live at /Users/gitlab/builds. #2501 (closed)
    * gml2gv no longer maps GML label attributes to Graphviz name attributes. These are now mapped to Graphviz label attributes. #2586 (closed)
  * Fixed

    * In the Autotools build system, the core plugin links against libm, fixing some unresolvable symbols. This was a regression in Graphviz 4.0.0. Though it would primarily have affected non-Graphviz applications attempting to load this plugin on Linux.
    * The osage layout engine now understands a cluster to be indicated by the common rules, including the "cluster" prefix being case insensitive and the cluster=true attribute as an alternative. #2187
    * acyclic once again produces its output on stdout. This was a regression in Graphviz 10.0.1. #2600 (closed)
    * When using the Tclpathplan module, created vgpanes can once again be named and addressed. This was a regression in Graphviz 12.1.2.
    * Omitting a polygon identifier when running triangulation using the Tclpathplan module (e.g. vgpane0 triangulate instead of vgpane0 triangulate 42) no longer goes unnoticed and reads invalid memory. This bug seems to have existed since the first revision of Graphviz.
    * When using the Tclpathplan module, defining a malformed <3-point polygon and then attempting to triangulate this polygon no longer reads invalid memory. This case is now rejected with an error during triangulation. Like the previous entry, this bug seems to have existed since the first revision of Graphviz.
    * When using the Tclpathplan module, binding a pane’s triangulation callback to a string ending in a trailing % (e.g. vgpane0 bind triangle %) no longer causes later out-of-bounds reads during triangulation. Like the previous entries, this bug seems to have existed since the first revision of Graphviz. #2596 (closed)
    * Mouse right-clicks in Smyrna are no longer sticky. In some contexts, right-clicking the mouse would register a mouse down event but no mouse up event, leading Smyrna to believe the user was dragging with the right button held down.
    * Arrowhead missing from tail-end of edge #2437 (closed)
    * The Ruby bindings package (libgv-ruby) is once again installable on Ubuntu. This became uninstallable when Ruby 1.8 was no longer available on Ubuntu, as it had a hard coded dependency of Ruby 1.8. This has now been relaxed to depend on any Ruby version ≥ 1.8. #2607 (closed)
    * Generated GIFs and JPEGs display the graphed image instead of a single solid color. This was a regression in Graphviz 12.1.1. #2609 (closed)
    * The CMake build system includes some supporting pieces of the SWIG-generated language bindings that were previously missing. It also links further dependencies that were previously missing.
    * In the CMake build system, linking of the Guile language bindings uses the full path to libguile, fixing issues on macOS.
    * The provided release packages for Debian-based operating systems (only Ubuntu currently) have corrected package dependencies. #2466 (closed)
    * Discussion of gvpr -c "" in the gvpr man page has been removed. This invocation did not do what was claimed. #2584 (closed)
    * To see the full changelog for all intermediate releases, see: https://gitlab.com/graphviz/graphviz/-/blob/main/CHANGELOG.md

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server High Availability Extension 16.0  
    zypper in -t patch SUSE-SLES-HA-16.0-361=1

## Package List:

  * SUSE Linux Enterprise Server High Availability Extension 16.0 (ppc64le s390x
    x86_64)
    * graphviz-plugins-core-debuginfo-12.2.1-160000.1.1
    * graphviz-addons-debuginfo-12.2.1-160000.1.1
    * graphviz-gd-debuginfo-12.2.1-160000.1.1
    * graphviz-12.2.1-160000.1.1
    * graphviz-gd-12.2.1-160000.1.1
    * graphviz-plugins-core-12.2.1-160000.1.1
    * graphviz-addons-debugsource-12.2.1-160000.1.1
    * graphviz-debuginfo-12.2.1-160000.1.1
    * graphviz-debugsource-12.2.1-160000.1.1

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260427/074c0ff2/attachment.htm>