Bump fonttools from 4.58.5 to 4.59.0

[dependabot]

Bumps fonttools from 4.58.5 to 4.59.0.

Release notes

Sourced from fonttools's releases.

4.59.0

• Removed hard-dependency on pyfilesystem2 (fs package) from fonttools[ufo] extra. This is replaced by the fontTools.misc.filesystem package, a stdlib-only, drop-in replacement for the subset of the pyfilesystem2's API used by fontTools.ufoLib. The latter should continue to work with the upstream fs (we even test with/without). However, clients who wish to continue using fs can do so by depending on it directly instead of via the fonttools[ufo] extra (#3885, #3620).
• [xmlWriter] Replace illegal XML characters (e.g. control or non-characters) with "?" when dumping to ttx (#3868, #71).
• [varLib.hvar] Fixed vertical metrics fields copy/pasta error (#3884).
• Micro optimizations in ttLib and sstruct modules (#3878, #3879).
• [unicodedata] Add Garay script to RTL_SCRIPTS (#3882).
• [roundingPen] Remove unreliable kwarg usage. Argument names aren’t consistent among point pens’ .addComponent() implementations, in particular baseGlyphName vs glyphName (#3880).

Changelog

Sourced from fonttools's changelog.

4.59.0 (released 2025-07-16)

• Removed hard-dependency on pyfilesystem2 (fs package) from fonttools[ufo] extra. This is replaced by the fontTools.misc.filesystem package, a stdlib-only, drop-in replacement for the subset of the pyfilesystem2's API used by fontTools.ufoLib. The latter should continue to work with the upstream fs (we even test with/without). Clients who wish to continue using fs can do so by depending on it directly instead of via the fonttools[ufo] extra (#3885, #3620).
• [xmlWriter] Replace illegal XML characters (e.g. control or non-characters) with "?" when dumping to ttx (#3868, #71).
• [varLib.hvar] Fixed vertical metrics fields copy/pasta error (#3884).
• Micro optimizations in ttLib and sstruct modules (#3878, #3879).
• [unicodedata] Add Garay script to RTL_SCRIPTS (#3882).
• [roundingPen] Remove unreliable kwarg usage. Argument names aren’t consistent among point pens’ .addComponent() implementations, in particular baseGlyphName vs glyphName (#3880).

Commits

• d12eea7 Release 4.59.0
• 64c55fd Update NEWS.rst
• 6580a42 [LICENSE.external] Include pyfilesystem2's original copyright and license notice
• e687881 Merge pull request #3885 from fonttools/drop-fs
• 83ab1bd [filesystem] suggest migration work for client code in the docstring
• 201c95c [osfs] implement movedir(create=False)
• c45509e sort imports with ruff check --select I --fix
• 1f0bcde allow clients to do 'from fontTools.misc import filesystem as fs'...
• a96ce9b [UFOZ_test] exercise reading GLIF off of .ufoz
• 6b050da [Tests/ufoLib] test getFileModificationTime
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)