CVS commit: [pkgsrc-2026Q3] pkgsrc/graphics/png

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Sat Oct  3 19:37:23 UTC 2026

Modified Files:
        pkgsrc/graphics/png [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7262 - requested by taca
graphics/png: security fix

Revisions pulled up:
- graphics/png/Makefile                                         1.225
- graphics/png/distinfo                                         1.171

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Tue Sep 29 06:10:36 UTC 2026

   Modified Files:
        pkgsrc/graphics/png: Makefile distinfo

   Log Message:
   png: update to 1.6.59.

   Version 1.6.59 [September 28, 2026]
     Fixed CVE-2026-46675 (medium severity):
       Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
       or iCCP decompression.
       (Reported independently by Ze Sheng and
       <JasonHonKL%users.noreply.github.com@localhost>.)
     Fixed a regression introduced in version 1.6.47 that caused libpng to reject
       hIST chunks in their correct position, after PLTE.
       (Contributed by Yuki Sekiguchi.)
     Prevented a double free of `png_struct` members after an allocation failure.
       (Contributed by Anthony Hurtado.)
     Applied fixes and updates to the CMake build.
     Adopted the REUSE Specification for licensing the CI files.


To generate a diff of this commit:
cvs rdiff -u -r1.224 -r1.224.4.1 pkgsrc/graphics/png/Makefile
cvs rdiff -u -r1.170 -r1.170.4.1 pkgsrc/graphics/png/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/png/Makefile
diff -u pkgsrc/graphics/png/Makefile:1.224 pkgsrc/graphics/png/Makefile:1.224.4.1
--- pkgsrc/graphics/png/Makefile:1.224  Sun May 17 13:50:09 2026
+++ pkgsrc/graphics/png/Makefile        Sat Oct  3 19:37:22 2026
@@ -1,11 +1,11 @@
-# $NetBSD: Makefile,v 1.224 2026/05/17 13:50:09 tnn Exp $
+# $NetBSD: Makefile,v 1.224.4.1 2026/10/03 19:37:22 bsiegert Exp $
 
-DISTNAME=      libpng-1.6.58
-PKGREVISION=   1
+DISTNAME=      libpng-1.6.59
 PKGNAME=       ${DISTNAME:S/lib//}
 CATEGORIES=    graphics
-MASTER_SITES+= ${MASTER_SITE_SOURCEFORGE:=libpng/}
-EXTRACT_SUFX=  .tar.xz
+MASTER_SITES+= ${MASTER_SITE_GITHUB:=pnggroup/}
+GITHUB_PROJECT=        libpng
+GITHUB_TAG=    v${PKGVERSION_NOREV}
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
 HOMEPAGE=      https://github.com/pnggroup/libpng

Index: pkgsrc/graphics/png/distinfo
diff -u pkgsrc/graphics/png/distinfo:1.170 pkgsrc/graphics/png/distinfo:1.170.4.1
--- pkgsrc/graphics/png/distinfo:1.170  Sun May 17 13:45:31 2026
+++ pkgsrc/graphics/png/distinfo        Sat Oct  3 19:37:22 2026
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.170 2026/05/17 13:45:31 tnn Exp $
+$NetBSD: distinfo,v 1.170.4.1 2026/10/03 19:37:22 bsiegert Exp $
 
 BLAKE2s (libpng-1.6.58-apng.patch.gz) = c51ac8a4548215fa387ab451500a8a2b7bc96f3578da03ce3bf54bc35e0bde03
 SHA512 (libpng-1.6.58-apng.patch.gz) = 95a6f5bb7148b5c48dccd73811d7bcf9752a631a7bb4f4856670a7da12a7159581ac1bce1749318343794e0f5cb86972711ba2ec0f523c168f0991fa940687d5
 Size (libpng-1.6.58-apng.patch.gz) = 10671 bytes
-BLAKE2s (libpng-1.6.58.tar.xz) = c53b047d1fe8e03f7414951d234c9b88bb5fa2a9a1d5f6e2ce955e67f936658c
-SHA512 (libpng-1.6.58.tar.xz) = 5937d6409d7ad564c9dba7969c5d39eea8bbc01936f433bf5936c872ec290dea353783f89bded91e124b3b3b15518320097de365acd3b0bcc922a0e90c94adc8
-Size (libpng-1.6.58.tar.xz) = 1070096 bytes
+BLAKE2s (libpng-1.6.59.tar.gz) = dd56fc25f2a724d89cf26fcf14d37537edadbb1e1def77cd94952fdc20b81964
+SHA512 (libpng-1.6.59.tar.gz) = 2d753e764846a0a75a10f2a00c6f4ae23d2ae37237c69d59d5e619da3f143d59f4ea9ce29c1fb39435df1cef77877c83b042a2275934c353a6603061da2d2dd9
+Size (libpng-1.6.59.tar.gz) = 1600400 bytes
 SHA1 (patch-libpng-config.in) = 04f8d6af31114017ce9d1280e62f1768c35c289d
 SHA1 (patch-pngpriv.h) = 16f80df18a2f58eec784e2d821e8bb93c3e81747