[librsvg] Update NEWS

[Federico Mena Quintero <federico src gnome org>]

commit c1a9ab7b5cca5fdb8a214dd75cc180ec51bc6d4e
Author: Federico Mena Quintero <federico gnome org>
Date:   Fri May 29 16:32:58 2020 -0500

    Update NEWS

 NEWS | 137 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 137 insertions(+)
---
diff --git a/NEWS b/NEWS
index 5fba43a6..99ccfa2d 100644
--- a/NEWS
+++ b/NEWS
@@ -1,7 +1,144 @@
 Version 2.49.0
 
+- Memory consumption of parsed SVG data is greatly reduced.  Property
+  values, path data, and text nodes now use much less memory than
+  before.  Thanks to Sergey "Shnatsel" Davidoff and Adam Reichold for
+  their contributions.
+
+- With that reduction in memory consumption, librsvg can now load up
+  to 1 million XML elements.  This is a hard limit to avoid malicious
+  files consuming arbitrary amounts of memory.
+
+- #508 - radialGradient now supports the "fr" property from SVG2
+  (Dunja Lalic, Corentin Rossignon).
+
+- Sven Neumann has written a fantastic test suite for rsvg-convert(1).
+  Now we can modify this program with confidence.
+
+- Many, many cleanups (Paolo Borelli).
+
+- #594 - Only compute locale information for elements that need it.
+
+- As usual, thanks to Bastien Orivel for keeping dependent crates updated.
+
+- Fix Windows builds without PangoFT2.
+
+- Benchmarks of internal functions work now.  You can run "cargo bench"
+  in librsvg/ and rsvg_internals/.
+
+Version 2.48.5
+
+- #577 - Support multiple fonts in the font-family property (Bastien Orivel).
+  Previously in font-family="Foo, Bar, Baz" only Foo would get used.
+
+- #591 - Catch overflow when rendering files with a huge viewBox.
+
+- #593 - Don't panic with an empty objectBoundingBox for a mask.
+
+- #596 - Fix introspection data for rsvg_handle_set_stylesheet (Sutou Kouhei).
+
+- Fixes to the librsvg_crate documentation (Abraham Toriz).
+
+- Loading raster images for inclusion in an SVG and producing
+  GdkPixbufs is now faster.
+
+Version 2.48.4
+
+- #590 - Fix regression when rendering masks.
+
+- #588 - Fix panic when a big viewBox creates an invalid transform.
+
+- #592 - Fix invalid argument to g_log_structured_array()
+
+Version 2.48.3
+
 - Librsvg now requires glib 2.50.0 or later.
 
+- rsvg-convert's --background-color option now accepts colors with
+  transparency like #rrggbbaa, rgba(...), hsla(...); the transparency
+  value was ignored before (Hao Guan).
+
+- #584 - Fix arithmetic overflow when rendering to large GdkPixbufs.
+
+- #582 - Make librsvg build with Rust 1.39 again.
+
+- #581 - Don't require upcalls into C code for Debian powerpc.
+
+Version 2.48.2
+
+- Fix linking of the test suite against Harfbuzz.
+
+Version 2.48.1
+
+- #129 - Fix baseline-shift for simple subscripts/superscripts and
+  absolute offsets.  This should fix a lot of Wikimedia images with
+  formulas.
+
+- #548 - Support images with data: URLs that don't have a MIME-type.
+  This fixes some Open Clip Art images generated by old versions
+  of Adobe Illustrator.
+
+- Fix build of the test suite on Windows (Chun-wei Fan).
+
+- Support running the rsvg_internals tests on Windows (Chun-wei Fan).
+
+Version 2.48.0
+
+- The following is a summary of changes between 2.46.x and 2.48.0.
+  For full details, please see the 2.47.x release notes below.
+
+- This release requires at least Rust 1.39.
+
+- #379 - New API, rsvg_handle_set_stylesheet(), to set a CSS
+  stylesheet independent of the SVG document.
+
+- #510 - support opacity in patterns.
+
+- Librsvg's XML parser now supports namespaces (xmlns), and is
+  stricter than before about it.  Files may fail to parse if there are
+  attributes or elements with namespace prefixes (e.g. foo:bar instead
+  of plain bar), but without a corresponding namespace declaration
+  (e.g. xmlns:foo="http://example.com/foo";).
+
+  This may happen especially with incorrectly-written SVGs that use
+  xlink:href or xi:include attributes without the corresponding
+  namespace declarations.  If you run into this, just add the
+  following to your toplevel SVG element:
+
+      <svg xmlns="http://www.w3.org/2000/svg";
+           xmlns:xlink="http://www.w3.org/1999/xlink";
+          xmlns:xi="http://www.w3.org/2001/XInclude";>
+           ^^^^^^^^^ these ones
+
+- Librsvg no longer depends on libcroco, and now does all CSS
+  processing using Rust crates from Mozilla Servo.  As a result,
+  librsvg can now handle much more complex CSS selectors than before.
+
+- Link-time optimization (LTO) is disabled by default on release
+  builds, as this increased build time too much.  Downstream
+  distributors may want to turn it back on in the toplevel Cargo.toml.
+
+- #515 (CVE-2019-20446) - Librsvg now has limits on the number of
+  loaded XML elements, and the number of referenced elements within an
+  SVG document.  This is to mitigate malicious SVGs which try to
+  consume all memory, and those which try to consume an exponential
+  amount of CPU time.
+
+- Many bugfixes; please see the 2.47.x release notes below.
+
+Version 2.47.4
+
+- (#240) - Fix rsvg-convert's multipage PDF output when the zoom
+  option is used (Sven Neumann).
+
+- (#547) - Do not stop rendering if an <image> element references a
+  nonexistent file.  This fixes a number of Open Clipart cases.
+
+- (#558) - Compute the font-size cascade correctly when there are "em"
+   #and "ex" units involved.
+
+- Updated the man page for rsvg-convert (Sven Neumann).
+
 Version 2.47.3
 
 - #379 - New API, rsvg_handle_set_stylesheet(), to set a CSS