CVS commit: pkgsrc/graphics/png

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Feb 10 07:01:20 UTC 2026

Modified Files:
        pkgsrc/graphics/png: Makefile distinfo

Log Message:
png: update to 1.6.55.

Version 1.6.55 [February 9, 2026]
  Fixed CVE-2026-25646 (high severity):
    Heap buffer overflow in `png_set_quantize`.
    (Reported and fixed by Joshua Inscoe.)
  Resolved an oss-fuzz build issue involving nalloc.
    (Contributed by Philippe Antoine.)


To generate a diff of this commit:
cvs rdiff -u -r1.219 -r1.220 pkgsrc/graphics/png/Makefile
cvs rdiff -u -r1.165 -r1.166 pkgsrc/graphics/png/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/png/Makefile
diff -u pkgsrc/graphics/png/Makefile:1.219 pkgsrc/graphics/png/Makefile:1.220
--- pkgsrc/graphics/png/Makefile:1.219  Mon Jan 12 22:40:24 2026
+++ pkgsrc/graphics/png/Makefile        Tue Feb 10 07:01:20 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.219 2026/01/12 22:40:24 wiz Exp $
+# $NetBSD: Makefile,v 1.220 2026/02/10 07:01:20 wiz Exp $
 
-DISTNAME=      libpng-1.6.54
+DISTNAME=      libpng-1.6.55
 PKGNAME=       ${DISTNAME:S/lib//}
 CATEGORIES=    graphics
 MASTER_SITES+= ${MASTER_SITE_SOURCEFORGE:=libpng/}

Index: pkgsrc/graphics/png/distinfo
diff -u pkgsrc/graphics/png/distinfo:1.165 pkgsrc/graphics/png/distinfo:1.166
--- pkgsrc/graphics/png/distinfo:1.165  Wed Jan 21 09:18:19 2026
+++ pkgsrc/graphics/png/distinfo        Tue Feb 10 07:01:20 2026
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.165 2026/01/21 09:18:19 tnn Exp $
+$NetBSD: distinfo,v 1.166 2026/02/10 07:01:20 wiz Exp $
 
 BLAKE2s (apng-20260116.patch) = b60bc1c57608e79afb87ba55fb152137d1910ba986d6aacad6d600392096b48a
 SHA512 (apng-20260116.patch) = f8de2168a1a8ed546de7eb6c3da993f99139f385ceaf008ecd8dc64869bb86a4cf61b749ee4060fa207a89917ead7c61d35e409ff477b6240e1a7bc141e2de24
 Size (apng-20260116.patch) = 49195 bytes
-BLAKE2s (libpng-1.6.54.tar.xz) = e42513eabc43dcfa49243094e41e98d5f1c7394bf37bb03347f6972595270fed
-SHA512 (libpng-1.6.54.tar.xz) = fc44530146af15c96232bf9954b9deda93d7bdd726c1a62685062f864215674fd3ae912e8eeafffc04329f2e802464262a8c4bca266ee7bc3559cdcd90eb785e
-Size (libpng-1.6.54.tar.xz) = 1064472 bytes
+BLAKE2s (libpng-1.6.55.tar.xz) = 113370cfbaf0f461395c4aa9e2b00fc28599089675c25f319c12deefb135dc4a
+SHA512 (libpng-1.6.55.tar.xz) = a9846fc32cb042bcce05f719a5b31255957e1c36ad6ad14dd23cf5eac3ce0b981dc5c34b18dc255e1fffc2cc064d0a77e3a1beb3c7167a0bdc3e1d0103383b4a
+Size (libpng-1.6.55.tar.xz) = 1064676 bytes
 SHA1 (patch-libpng-config.in) = 04f8d6af31114017ce9d1280e62f1768c35c289d
 SHA1 (patch-pngpriv.h) = 16f80df18a2f58eec784e2d821e8bb93c3e81747