- updated to 2.5.3 (security fix); enabled harfbuzz autohinting