chore(deps): update cairosvg requirement from >=2.7.0 to >=2.9.0 in /containers/drawio-oci

[dependabot]

Updates the requirements on cairosvg to permit the latest version.

Changelog

Sourced from cairosvg's changelog.

Version 2.9.0 released on 2026-03-13

WARNING: this is a security update.

Using a lot of recursively nested use tags could lead to long rendering times with relatively small inputs. CairoSVG now stops rendering when more than 100k use tags are rendered.

Using the --unsafe option allows to render larger documents.

• Drop support of Python 3.9, add support of Python 3.14

Version 2.8.2 released on 2025-05-15

• Allow both Unicode strings and bytes as input

Version 2.8.1 released on 2025-05-14

• Allow both text- and bytes-based file objects as input

Version 2.8.0 released on 2025-05-12

• Drop support of Python 3.7 and 3.8, add support of Python 3.12 and 3.13
• Optimize math operations
• Use pathlib
• Close paths for ellipses and circles
• Fix output ratio for SVG surfaces
• Avoid endless loops when updating def attributes
• Round PNG size
• Don’t crash when more than 2 values are given to translate and scale functions

Version 2.7.1 released on 2023-08-05

• Don’t draw clipPath when defined after reference
• Handle evenodd fill rule with gradients and patterns
• Fix ratio and clip for "image" tags with no size
• Handle data-URLs in safe mode
• Use f-strings

Version 2.7.0 released on 2023-03-20

... (truncated)

Commits

• fe5cae5 Version 2.9.0
• 6dde868 Abort when more than 100k referenced elements are rendered
• a6b3a98 Cut long line again
• ce8b51d Cut long line
• b7818c9 Clarify unsafe option scope without removing security warning
• 9e8c6ed Version 2.8.2
• 1c28b57 De-duplicate input string encoding
• b4670ec Merge pull request #443 from marcelometal/ensure-bytestring-type-before-gzip
• 245b3f2 Ensure bytestring is bytes before checking for gzip header
• e5128ec Version 2.8.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.