CVS commit: pkgsrc/graphics/png

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Sep 29 06:10:36 UTC 2026

Modified Files:
        pkgsrc/graphics/png: Makefile distinfo

Log Message:
png: update to 1.6.59.

Version 1.6.59 [September 28, 2026]
  Fixed CVE-2026-46675 (medium severity):
    Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
    or iCCP decompression.
    (Reported independently by Ze Sheng and
    <JasonHonKL%users.noreply.github.com@localhost>.)
  Fixed a regression introduced in version 1.6.47 that caused libpng to reject
    hIST chunks in their correct position, after PLTE.
    (Contributed by Yuki Sekiguchi.)
  Prevented a double free of `png_struct` members after an allocation failure.
    (Contributed by Anthony Hurtado.)
  Applied fixes and updates to the CMake build.
  Adopted the REUSE Specification for licensing the CI files.


To generate a diff of this commit:
cvs rdiff -u -r1.224 -r1.225 pkgsrc/graphics/png/Makefile
cvs rdiff -u -r1.170 -r1.171 pkgsrc/graphics/png/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/png/Makefile
diff -u pkgsrc/graphics/png/Makefile:1.224 pkgsrc/graphics/png/Makefile:1.225
--- pkgsrc/graphics/png/Makefile:1.224  Sun May 17 13:50:09 2026
+++ pkgsrc/graphics/png/Makefile        Tue Sep 29 06:10:35 2026
@@ -1,11 +1,11 @@
-# $NetBSD: Makefile,v 1.224 2026/05/17 13:50:09 tnn Exp $
+# $NetBSD: Makefile,v 1.225 2026/09/29 06:10:35 wiz Exp $
 
-DISTNAME=      libpng-1.6.58
-PKGREVISION=   1
+DISTNAME=      libpng-1.6.59
 PKGNAME=       ${DISTNAME:S/lib//}
 CATEGORIES=    graphics
-MASTER_SITES+= ${MASTER_SITE_SOURCEFORGE:=libpng/}
-EXTRACT_SUFX=  .tar.xz
+MASTER_SITES+= ${MASTER_SITE_GITHUB:=pnggroup/}
+GITHUB_PROJECT=        libpng
+GITHUB_TAG=    v${PKGVERSION_NOREV}
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
 HOMEPAGE=      https://github.com/pnggroup/libpng

Index: pkgsrc/graphics/png/distinfo
diff -u pkgsrc/graphics/png/distinfo:1.170 pkgsrc/graphics/png/distinfo:1.171
--- pkgsrc/graphics/png/distinfo:1.170  Sun May 17 13:45:31 2026
+++ pkgsrc/graphics/png/distinfo        Tue Sep 29 06:10:36 2026
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.170 2026/05/17 13:45:31 tnn Exp $
+$NetBSD: distinfo,v 1.171 2026/09/29 06:10:36 wiz Exp $
 
 BLAKE2s (libpng-1.6.58-apng.patch.gz) = c51ac8a4548215fa387ab451500a8a2b7bc96f3578da03ce3bf54bc35e0bde03
 SHA512 (libpng-1.6.58-apng.patch.gz) = 95a6f5bb7148b5c48dccd73811d7bcf9752a631a7bb4f4856670a7da12a7159581ac1bce1749318343794e0f5cb86972711ba2ec0f523c168f0991fa940687d5
 Size (libpng-1.6.58-apng.patch.gz) = 10671 bytes
-BLAKE2s (libpng-1.6.58.tar.xz) = c53b047d1fe8e03f7414951d234c9b88bb5fa2a9a1d5f6e2ce955e67f936658c
-SHA512 (libpng-1.6.58.tar.xz) = 5937d6409d7ad564c9dba7969c5d39eea8bbc01936f433bf5936c872ec290dea353783f89bded91e124b3b3b15518320097de365acd3b0bcc922a0e90c94adc8
-Size (libpng-1.6.58.tar.xz) = 1070096 bytes
+BLAKE2s (libpng-1.6.59.tar.gz) = dd56fc25f2a724d89cf26fcf14d37537edadbb1e1def77cd94952fdc20b81964
+SHA512 (libpng-1.6.59.tar.gz) = 2d753e764846a0a75a10f2a00c6f4ae23d2ae37237c69d59d5e619da3f143d59f4ea9ce29c1fb39435df1cef77877c83b042a2275934c353a6603061da2d2dd9
+Size (libpng-1.6.59.tar.gz) = 1600400 bytes
 SHA1 (patch-libpng-config.in) = 04f8d6af31114017ce9d1280e62f1768c35c289d
 SHA1 (patch-pngpriv.h) = 16f80df18a2f58eec784e2d821e8bb93c3e81747