> clone librsvg to cherry-pick stuff on top of pre-rust version (2.40.21)

> ./devel-docs/security.rst / SECURITY.md knows about this release

> no git tag for 2.40.x beyond 2.40.16

WTF