uharfbuzz: update packages

.github/workflows/build-uharfbuzz.yml

@@ -46,21 +46,23 @@ jobs:
   build_wheels:
     needs: [setup]
     if: needs.setup.outputs.versions != '[]'
-    name: Build uharfbuzz ${{ matrix.version }} cp310-abi3-${{ matrix.libc }}_riscv64
+    name: Build uharfbuzz ${{ matrix.version }} ${{ startsWith(matrix.version, '0.56.') && 'cp310' || 'cp311' }}-abi3-${{ matrix.libc }}_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
         version: ${{ fromJSON(needs.setup.outputs.versions) }}
-        # abi3 (setup.py: bdist_wheel py_limited_api="cp310"), so the single
-        # cp310 build (the abi3 floor, gotcha 96) is loadable on every newer
-        # CPython; upstream ships no free-threaded wheel (pyproject.toml
-        # skips cp3??t) so there is no second build.
+        # abi3 (setup.py: bdist_wheel py_limited_api), so the single build on
+        # the abi3 floor (gotcha 96: cp310 up to 0.56.x, cp311 from 0.57.0,
+        # per python_requires) is loadable on every newer CPython; upstream
+        # ships no free-threaded wheel (pyproject.toml skips cp3??t) so there
+        # is no second build.
         libc: [manylinux, musllinux]
 
     env:
       UHARFBUZZ_VERSION: ${{ matrix.version }}
+      ABI3_FLOOR: ${{ startsWith(matrix.version, '0.56.') && 'cp310' || 'cp311' }}
 
     steps:
       - name: Checkout uharfbuzz v${{ env.UHARFBUZZ_VERSION }}
@@ -89,7 +91,7 @@ jobs:
           output-dir: wheelhouse/
         env:
           CIBW_ARCHS: riscv64
-          CIBW_BUILD: cp310-${{ matrix.libc }}_riscv64
+          CIBW_BUILD: ${{ env.ABI3_FLOOR }}-${{ matrix.libc }}_riscv64
           CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
           CIBW_MUSLLINUX_RISCV64_IMAGE: ${{ env.MUSLLINUX_RISCV64_IMAGE }}
           # The riscv64-compat patch leaves the checkout dirty relative to the
@@ -103,7 +105,7 @@ jobs:
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          name: uharfbuzz-${{ env.UHARFBUZZ_VERSION }}-cp310-abi3-${{ matrix.libc }}_riscv64
+          name: uharfbuzz-${{ env.UHARFBUZZ_VERSION }}-${{ env.ABI3_FLOOR }}-abi3-${{ matrix.libc }}_riscv64
           path: wheelhouse/*.whl
           if-no-files-found: error
 

docs/packages/uharfbuzz.yaml

@@ -51,3 +51,5 @@ versions:
   - filename: uharfbuzz-0.56.3-cp310-abi3-musllinux_1_2_riscv64.whl
     sha256: 64a3148af71afd940b31096c062d6c789945de704cb0f2d3e6c9bbe3e4f5ca0c
     requires-python: '>=3.10'
+- version: 0.56.4
+- version: 0.57.0

patches/uharfbuzz/0.56.4/0001-ship-harfbuzz-s-licence-alongside-uharfbuzz-s-own.patch

@@ -0,0 +1,38 @@
+From 19248e0348f0749399fb1f3a50c5fcd21b158238 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Tue, 8 Sep 2026 00:00:00 +0200
+Subject: [PATCH] ship harfbuzz's licence alongside uharfbuzz's own
+
+Upstream-Status: To upstream [not yet submitted; the same gap exists in every uharfbuzz wheel on PyPI, so this needs a maintainer discussion rather than a drive-by PR]
+
+The extension statically links the vendored HarfBuzz C++ sources
+(harfbuzz/, a git submodule, compiled in as harfbuzz-world.cc), which
+carry their own "Old MIT" notice. That licence requires the copyright
+notice to travel with binary redistributions, but setup.cfg's
+`license_file` names only uharfbuzz's own LICENSE (Apache-2.0), so the
+built wheel ships a single notice covering the wrapper alone --
+confirmed on the published `uharfbuzz-0.56.0-cp310-abi3-*.whl`, whose
+dist-info/licenses/ carries just LICENSE.
+
+Switching to the plural `license_files` (setuptools' modern key,
+`license_file` is its deprecated singular alias) and naming the
+vendored file in place keeps the patch to one line of intent and lets
+it track the submodule: setuptools resolves each license-files entry
+relative to the project root and preserves its path in the wheel, so
+it lands as dist-info/licenses/harfbuzz/COPYING.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ setup.cfg | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/setup.cfg b/setup.cfg
+index 0c9e0fc..7cf49c6 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -1,2 +1,4 @@
+ [metadata]
+-license_file = LICENSE
++license_files =
++    LICENSE
++    harfbuzz/COPYING

patches/uharfbuzz/0.57.0/0001-ship-harfbuzz-s-licence-alongside-uharfbuzz-s-own.patch

@@ -0,0 +1,38 @@
+From 19248e0348f0749399fb1f3a50c5fcd21b158238 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Tue, 8 Sep 2026 00:00:00 +0200
+Subject: [PATCH] ship harfbuzz's licence alongside uharfbuzz's own
+
+Upstream-Status: To upstream [not yet submitted; the same gap exists in every uharfbuzz wheel on PyPI, so this needs a maintainer discussion rather than a drive-by PR]
+
+The extension statically links the vendored HarfBuzz C++ sources
+(harfbuzz/, a git submodule, compiled in as harfbuzz-world.cc), which
+carry their own "Old MIT" notice. That licence requires the copyright
+notice to travel with binary redistributions, but setup.cfg's
+`license_file` names only uharfbuzz's own LICENSE (Apache-2.0), so the
+built wheel ships a single notice covering the wrapper alone --
+confirmed on the published `uharfbuzz-0.56.0-cp310-abi3-*.whl`, whose
+dist-info/licenses/ carries just LICENSE.
+
+Switching to the plural `license_files` (setuptools' modern key,
+`license_file` is its deprecated singular alias) and naming the
+vendored file in place keeps the patch to one line of intent and lets
+it track the submodule: setuptools resolves each license-files entry
+relative to the project root and preserves its path in the wheel, so
+it lands as dist-info/licenses/harfbuzz/COPYING.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ setup.cfg | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/setup.cfg b/setup.cfg
+index 0c9e0fc..7cf49c6 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -1,2 +1,4 @@
+ [metadata]
+-license_file = LICENSE
++license_files =
++    LICENSE
++    harfbuzz/COPYING