There is a new pull request by travankor against master on the void-packages repository

https://github.com/travankor/void-packages pango
https://github.com/void-linux/void-packages/pull/16356

pango: fix CVE-2019-1010238.patch
None

A patch file from https://github.com/void-linux/void-packages/pull/16356.patch is attached