Bump afdko from 4.0.3 to 5.0.1

[dependabot]

Bumps afdko from 4.0.3 to 5.0.1.

Release notes

Sourced from afdko's releases.

5.0.1

Release Notes

5.0.0

Release Notes

Changelog

Sourced from afdko's changelog.

5.0.1 (released 2026-05-18)

• [otfautohint/otfstemhist] Fix "No module named 'typing_extensions'" failure on Python 3.10 (#1828)
• [spot] Fix U+00A9 (copyright) rendering as U+FFFD in name table output (#1828)
• [build] Fix STRCPY_S macro to avoid format-security error (#1830)
• [addfeatures tests] Fix variable font test files; add comprehensive test coverage (#1832)
• [README] Remove outdated macOS Python installation note (#1836)

5.0.0 (released 2026-03-22)

Major restructuring: Unified command interface, massive C++ modernization, and build system overhaul

This is a major release with extensive architectural changes including a substantial C→C++ conversion. While we have worked to maintain compatibility, with this much change there are likely to be regressions. Users not in a position to thoroughly verify their output may want to wait for 5.0.1 or 5.0.2 before upgrading.

Summary of Command and Interface Changes

Unified Command Interface

• New primary interface: All AFDKO tools are now accessed through afdko <command> syntax

  afdko makeotf -r
  afdko tx -dump font.otf
  afdko spot -Proof font.otf

• Deprecated wrappers: Individual command wrappers (e.g., makeotf, tx, spot) are deprecated with gradual rollout:
  • By default, wrappers work silently (opt-in warnings with AFDKO_WRAPPER_MODE=warn)
  • Two-tier removal timeline: less-used commands will be present for at least 6 months, commonly-used commands for at least 12 months
  • Wrappers will start to omit warnings in a future release
  • See https://github.com/adobe-type-tools/afdko/blob/develop/docs/Deprecation_System.md for details

makeotfexe → addfeatures Transition

• Variable Font Support: addfeatures, which replaces makeotfexe, supports more direct building of variable fonts:
  • Accepts CFF2 table as input in addition to CFF
  • Enhanced feature file syntax for direct specification of variable values
    • See https://github.com/adobe-type-tools/afdko/blob/develop/docs/CFF2_Support.md for details
• Workflow changes: For direct invocation, you may now need to build a CFF table first using tx
  • tx has been enhanced with features previously exclusive to makeotfexe, including GlyphOrderAndAliasDB support

Other Changes

Major C/C++ Port

• C → C++ conversion: Overall codebase is now 49% C++ vs 4% C++ in v4.0
  • Major files: tx_shared, uforead, ufowrite, t1read, t1cstr, t2cstr, ttread, and many more
  • Total source files: 177 → 150 (-15%)
  • Better type safety, modern C++ patterns, improved maintainability
  • See https://github.com/adobe-type-tools/afdko/blob/develop/docs/C_CPP_Changes.md for comprehensive architectural details

... (truncated)

Commits

• cef990e Release 5.0.1
• 586d0f6 Update NEWS.md for 5.0.1 release (#1837)
• 91f6af6 Remove outdated macOS Python installation note from README (#1836)
• cd16e5e Fix variable font test files and add comprehensive test coverage (#1832)
• dee0d52 Fix STRCPY_S macro to avoid format-security error (#1830)
• 547ac97 Update Python version requirements and fix deprecations (#1826)
• d11932f Merge pull request #1828 from adobe-type-tools/fix-typing-extensions-and-spot...
• 60b11e9 Fix mypy compatibility for Self imports
• a5095c3 Fix two bugs: missing typing_extensions dependency and spot isprint locale issue
• 7bc9e01 Simplify Recent News section in README
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

requirements.txt

Package	Version	License	Issue Type
afdko	5.0.1	Null	Unknown License

setup.py

Package	Version	License	Issue Type
afdko	5.0.1	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/afdko	5.0.1	Unknown	Unknown
pip/afdko	5.0.1	Unknown	Unknown

Scanned Files

• requirements.txt
• setup.py